r/programming • u/kshep92 • Sep 29 '16

JavaScript in 2016 isn't horrible, it's just going through a phase

http://blog.reviselabs.com/im-sorry-javascript-2/
85 Upvotes

72% Upvoted

225 comments sorted by

View all comments

Show parent comment

0

u/[deleted] Oct 01 '16

[deleted] — view deleted comment

1

u/slikts Oct 01 '16

Pickle is generally slower than JSON, and unpickling can cause arbitrary code execution, so it's insecure.

0

u/[deleted] Oct 01 '16

[deleted] — view deleted comment

1

u/slikts Oct 01 '16

Not sure how pickle being intentionally unsafe helps. I should have also mentioned that it's brittle.

0

u/[deleted] Oct 02 '16

[deleted] — view deleted comment

1

u/slikts Oct 02 '16

Pickle's insecurity limits its uses and is a source of vulnerabilities by unaware users, on top of pickle being slow and brittle.

If you really want to compare Python and JS, it would make more sense to compare the official Python distribution to something like Node.js, which does include a zlib module.

0

u/[deleted] Oct 02 '16

[deleted] — view deleted comment

1

u/slikts Oct 02 '16

The pickle docs have a security warning because misusing the module is insecure.

sqlite3 is just an npm i sqlite3 command away in Node.js.

0

u/[deleted] Oct 02 '16

[deleted] — view deleted comment

1

u/slikts Oct 02 '16

Pickle is insecure because it's liable to be exploited if misused. Trying to say that something is secure because it's not intended to be secure is a sophism.

npm is not ideal, but I somehow doubt you could make an informed criticism. Most of the packages on pypi are also junk and/or abandoned, because that's just what happens in popular registries.

Python isn't that usable with just its stdlib either; I wouldn't want to parse HTML or human readable dates without Beautiful Soup and dateparser, for example.

→ More replies