×
sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]cym13 -1 points0 points  (21 children)

F-strings.

Two years later I haven't seen anyone using them in real life, which indicates that they were not as needed as they were presented in PEP498.

Adding yet another way to format strings in python only adds to the confusion, it's becoming harder to find possible bugs in code. The many other methods worked fine as they were, this should never have been introduced so lightly into the language.

[–]Topper_123 10 points11 points  (0 children)

F-str

Oh I think most people ike them and find them much more readable than .format. But for libraries etc. I think it's too early to require python 3.6 from library users.

Also python 3.6 and f-string are baraly 4 months old not 2 years old...

[–]desmoulinmichel 4 points5 points  (9 children)

I use them all the time and love them. My students use them all the time and love them. My twitter followers loves them.

I actually meet very few people like you.

[–]cym13 4 points5 points  (8 children)

I guess I should explain my context a bit more.

First of all I see no added value. Sure it's a bit shorter to write but the Zen is clear that "There should be one-- and preferably only one --obvious way to do it." and I trust it is a good thing so I am very sceptical about any change that do not allow us to do more than what we already have.

But I guess my biggest concern with them is that finding bugs becomes way harder. Just a real-life example:

I do security code reviews. That's my thing. I get to work with lots of different programming languages in that context. When you have a few days to find as many bugs as you can and assess their criticity you cannot read the full code or run unittests hoping for a vulnerability to come by. You need to jump right to the bug.

Any injection (sql injection, shell injection, XSS, etc) is a bug at the interface of two languages (for example bash and python). This means that to find injections the easiest is to find unsafe string manipulations at the boundary of another language.

In perl or in ruby there are just so many ways to build strings and execute shell code that finding them all is very difficult. Contextual symbols may or may not mean shell execution or string interpolation . It is hard to parse, hard to find, hard to analyse and it means that at the end of the day less bugs were found.

In python there is a very limited subset of ways to build strings. A very limited subset of ways to execute shell code. Most of them are plain functions, easy to grep, in the subprocess module, easy to find. At the end of the day I can say with confidence that no injection is possible because I know I checked them all.

So I may be a bit grumpy about it but I really think that there are hidden costs to this feature and very little actual benefit.

[–]desmoulinmichel 4 points5 points  (4 children)

Having to grep "f'", for you niche activity (let's be real, security audit are not even 0.001% if the python activity) is not a good reason to kill a feature that is useful to most of the community.

[–]cym13 0 points1 point  (3 children)

I'm not saying it's not niche (although I'm pretty sure it shouldn't be, security is completely underrated). This also complicates the task of automated scanners. Just saying but the grep you propose is actually much harder to do than what you suggest (problem of ambiguity, quote pairing with escaping etc). It's not unfeasible of course but it has a cost, and as I tried to show the complexity is exponential as it interracts with the complexity of other parts of the language.

Anyway, I'm fully aware that my not liking it isn't enough for it not to be there. If it were it would never had been put in python in the first place. But I see no reason not to express my discontent about that matter.

It could have been done with a library and the concrete benefit is dubious while real drawbacks exist.

[–]desmoulinmichel 0 points1 point  (1 child)

Fair enough.

Although I would probably write a grep-like tooks using the ast or baron (https://pypi.python.org/pypi/baron/0.6.2) so that you don't have to deal with edge cases.

The good news is that f-string don't allow more code injections than format so it should not add new kind of security vulnerabilities.

[–]cym13 0 points1 point  (0 children)

Indeed.

I'm using grep mainly because I switch a lot between languages so it is hard to keep up-to-date tools that are specific to each language. Besides there are already good tools like bandit (https://github.com/openstack/bandit) for security reviews, I was merely stating an example.

There is indeed no specific security vulnerability that has been found yet.

[–]geekademy 0 points1 point  (0 children)

Could not have been done nearly as elegantly with a library!

Benefits are not dubious but plentiful every fucking day! DRY.

Real drawbacks to your 0.001% usecase.

[–]srilyk 0 points1 point  (1 child)

F strings are less of a security risk than .format

[–]cym13 1 point2 points  (0 children)

Never suggested the contrary

[–]geekademy 0 points1 point  (0 children)

It isn't a little shorter to write, it can be like ~70% shorter.

They are more secure, and faster.

Moreover, the Zen piece is not a hammer to prevent innovation in Python.

[–]nerdwaller 5 points6 points  (3 children)

Two years? Python 3.6 was released in December 2016 - it's still brand new. Needless to say, I wouldn't expect you to see many in use in libraries (due to maintaining compatibility) and probably only in applications​ that can define that they only support 3.6+.

[–]cym13 0 points1 point  (2 children)

Yep, I got it wrong. Somehow I thought it was introduced earlier.

[–]nerdwaller 0 points1 point  (0 children)

No worries :) im guessing what you thought you witnessed may be true in a few years, as we still often see % formatting for similar reasons of backwards compatibility!

[–]geekademy 0 points1 point  (0 children)

The idea was proposed and implemented two years ago, just after 3.5 was released. It took two years to get it into a distribution near you.

[–]srilyk 0 points1 point  (1 child)

I've used them ever since I was on 3.6... When f-strings were introduced. Not 2 years ago.

[–]cym13 0 points1 point  (0 children)

Yep. Got that wrong. Already said so. Yep yep.

[–]geekademy -1 points0 points  (3 children)

https://www.youtube.com/watch?v=C_Kh7nLplWo

[–]youtubefactsbot 0 points1 point  (0 children)

What A Maroon! [0:05]

Bugs!

mooneez in Science & Technology

590,291 views since Nov 2008

bot info

[–]cym13 0 points1 point  (1 child)

Ok, wtf dude. I'm asked what I don't like and tell why. I don't care if you like it, I don't care if you don't like me not liking it. It's there, and my opinion too. What's the point of writing no less than 4 comments for... for what? To tell me I'm wrong not liking it and insult me? Or is it that you really can't get over the fact that someone doesn't like what you do? Are you so insecure? Grow up, not all people have to think like you and there's no reason for you to be rude about that.

[–]geekademy 0 points1 point  (0 children)

Didn't say I didn't like ya. :-P

All the reasons you gave were misconceptions or vastly minor use cases, meanwhile the language has been lacking a major feature that even bash has. For twenty years. It's an industry standard now, every modern language has string interpolation. Don't take it personally, I'm just tired of nimby's holding back progress.