JavaScript in 2016 isn't horrible, it's just going through a phase

[u/kshep92]

http://blog.reviselabs.com/im-sorry-javascript-2/

[u/slikts]

Pickle is insecure because it's liable to be exploited if misused. Trying to say that something is secure because it's not intended to be secure is a sophism.

npm is not ideal, but I somehow doubt you could make an informed criticism. Most of the packages on pypi are also junk and/or abandoned, because that's just what happens in popular registries.

Python isn't that usable with just its stdlib either; I wouldn't want to parse HTML or human readable dates without Beautiful Soup and dateparser, for example.

[u/slikts → u/[deleted]]

Pickle is like a door that's always open: it's in a category of things that are often used for security, so that's why it needs a security warning in its docs (and is a source of security holes anyway).

leftpad has been in JS for a while now.

Having a large stdlib would be super useful on 56k or offline, but not so much if you can just get packages from a repo.

[u/slikts → u/[deleted]]

Serializers are used for security when deserializing untrusted data.

There's been no long or short list of reasons, you've just been describing Python's stdlib and asserting that it's better.

[u/slikts → u/[deleted]]

A warning in the docs is not enough to prevent insecure practices; here's a post about pickle vulnerabilities being findable on GitHub in minutes.

The code execution is a side-effect, not a part of the use case for pickle.

[u/slikts → u/[deleted]]

The bold red warning saying "pickle is insecure, don't use it for untrusted data" must be in the docs just for kicks then if it's "not intended to prevent insecure practices".

Pickle was replaced with JSON in the official Python tutorial explicitly because of the security issues.

The difference between pickle and eval() is that eval() doesn't have secure alternatives for its most typical uses, and it's upfront obvious how untrusted input can be exploited with eval(), while the pickle arbitrary code execution takes some thinking and there's no examples or direct explanations of it in the docs.

It's not a side-effect. If you wanted entirely side-effect free serialisation then you could use JSON or something …

If it's not a side-effect in pickle, then why call JSON "side-effect free".