Python is the “lingua-franca” of over-the-hill hackers

Dino Dai Zovi | August 10th, 2006 | Filed Under: Development

I’m taking the bait. I am somewhat of a programming language geek and actually love debating the pros/cons of various languages and whether some of them (i.e. bourne shell) are well suited to certain tasks (i.e. fuzzing). However, claiming that a specific language is the best tool for any job is the silly sort of argument that someone who knows *one* high-level language tends to make. Sometimes the right language for the job in the hands of good programmers lets you make a cool few million bucks in one summer. Sometimes, your exploits must be written in OCaml (if you haven’t already tried it, pattern matching is *phenomenal* for writing network protocol stacks). Try and reverse that binary!

Show me a hacker under 30 (hacking is like mathematics, most consider the big three-oh to be a death sentence) that uses python and I’ll show you 5 that prefer Ruby. I don’t use python because it feels like Java to me, only it runs slower and has broken garbage collection. Not that the Ruby runtime isn’t slow (it is) or has problems (it does), but it allows me to get the job done quicker and have fun using things like higher-order functions, closures, continuations, etc. My time is more valuable than CPU time anyway. Not that there aren’t any talented hackers who use python or kick it hardcore in their third decade, I’m just saying that python is so last millenium.

Viewing 25 Comments

    • ^
    • v
    Who gives a shit what language you use or how old you are? That has nothing to do with anything. The only thing that matters is your results. True meritocracy or nothing!
    • ^
    • v
    I agree, Byron. That's why Matasano exploits are written by my 7 year old son Galen, who codes primarily in FORTRAN.
    • ^
    • v
    I think what Dino meant to say is that scripting languages are just a tool. Python, Perl, Ruby -- even the shell scripts Tom writes -- are a-ok so long as they get the job done. To label one language as better suited to security is a little odd. Sarcasm doesn't translate well to blog.


    That being said, PDB is pretty much extension language agnostic -- we spent time on the Racket/Ramble stuff because we needed it for a specific purpose. Writing a Python module for PDB would be fairly straight forward -- and it could use dpkt or whatever from within that module. Writing PDB in C was deliberate. I want to be able to write scripts in any language or framework, including Ruby/Racket, but also, say, in C/libnet should I choose to.
    • ^
    • v
    I have no idea why we would back down from the assertion that Japanese Tcl blows the doors off of Python.

    It took a while for Dino to work his evil wiles on me, but I'm a convert. Python feels like a collection of symbol table hacks to me. Ruby gives me back the language [incr tcl] tried to give me 8 years ago.

    The only thing Python does better than Ruby is threading, which is to say that the Python interp doesn't have a broken IO threading implementation woven through its core. Not being able to pull libevent into Ruby is a continuing, horrible frustration.
    • ^
    • v
    Ok, I'll bite. I use python, what am I missing?
    The only major blemishes I've come across so far are (1) the inability to reference local variables in the parent function from inside a nested function (in a similar way that globals could be accessed from within a function) and (2) the fact that coroutines are limited to exist in a single function (and, while expanded in python 2.5 to allow data flow in both directions, still uses an asymmetric API to do so).
    I'm not anti-ruby; honestly, I dont know it that well. I just keep hearing the same hollow language war arguments and wish someone would demonstrate constructs in one language that another language can't do easily or elegantly. From my point of view it looks like ruby and python are mostly equivalent and python has a larger user base and more native support.
    • ^
    • v
    Python has been my language of choice for, oh, four years now. Like Jeremy said, it gets the job done. That said, a couple of my comrades who have been hardcore Pythonistas in the past have recently been extolling the joys of Ruby. Which brings me to this gem, found while procrastinating^Wreading through a "Best of Scary Devil Monastery" page:

    "> I still haven't found the right problem to learn perl over...

    Your essential mistake here is that you seek such a program. This is self-defeating Zen. When the time is right, the right program will quietly make _itself_ known to you.

    -Tanuki"

    One of these days, I'm sure a program will make known to me that it should be written in Ruby.
    • ^
    • v
    There are two big things I think Japanese Tcl has going for it:

    1. Blocks. Japanese Tcl supports anonymous functions at the core of the language. Python has essentially deprecated them. Anonymous functions and closures come in very handy with callback-driven code. It also supports RAII-style access to resources, like File.open with a block (with the file closed at the end).

    2. A sane object model and standard library. My biggest initial complaint with Python is that the standard library is simply every Unix C library ever conceived, mapped verbatim into Python, with a thin, uneven layer of Python abstractions layered on afterwards. Time, datetime, and time objects.

    Things Python has going for it (again, IMO):

    1. A much more mature runtime environment. The interpreter is better. It's faster, it's less buggy, and it doesn't have any overtly broken conventions (again referring to the event loop debacle in Japanese Tcl).

    2. Much better documentation. Much, much better documentation. Superior --- vastly superior --- documentation.

    Little thing I would miss if I gave up Python: list comprehensions.

    Little thing I would miss if I gave up Japanese Tcl: Rails.
    • ^
    • v
    Another valid complaint you could make about Python is the fact that regexes aren't built into the language (you have to pull in a library to use them). But I hate regular expressions.
    • ^
    • v
    One last point that I'm sure will tip the debate to the side of Ruby for even the most rapid Pythonista (and the reason I was considering "switching" before this blog entry came about) is Java scripting languages.

    Think about it.

    It makes no sense to use Java to script Java (BeanShell) just like it makes no sense to use some other weird scripting language that sort of resembles a scripting language you might know but not really (Groovy) so your left with 2 options (well actually more but who would want to use a scripting language built into a router or web browser)

    Jython is too old (Python 2.2-ish) and incompatible with all your 2.4 stuff, so JRuby is the only decent option. Simple.
    • ^
    • v
    That's easy for you to say Tom, as you are still in your 20's. Not for long though :)
    • ^
    • v
    Woops, spoke too soon. That is easy for you to say /Dino/.
    • ^
    • v
    I'm still in my 20's too.
    • ^
    • v
    *SHAKING WALKING CANE AT DINO AND TOM*
    YOU KIDS GET OFF MY LAWN!
    (also, Josh and Tim are old)
    • ^
    • v
    blah! I can show you 30-40 pythonists that are under 30 years old and sit within a 50mts radius of where is sit. I think there is really little intrinsic advantage in Ruby over Python for 99% of the programmers. Yes, Python's VM may have some flaws (ie. the GC) and I am not qualified to compare it with Ruby but that's just an implementation issue. I still havent seen ONE THING that you can do with Ruby and can't do with Python with little or no extra effort.
    And btw, how is it that Python is now ohh-so-old-school when only 5 years ago very few in the security community actually used it? Maybe I should buy me a gn0 b00kz and join the Ruby-p0ss3 then 1 B l337 d4wG!

    http://andrewlsmith.blogspot.com/2006/07/indust...
    • ^
    • v
    The "over the hill" comment was a sarcastic response to Arbor Networks' claim that Python is a "more appropriate language" for security than Ruby; as if Arbor is the arbiter of these things.

    The biggest visible difference between Python and Ruby, which changes the style of programs you write in Ruby, compared to Python, is "blocks", which are syntactic sugar around anonymous functions (which any language OTHER than Python would call a "lambda").

    Python's support for anonymous functions is broken in a variety of small and annoying ways.
    • ^
    • v
    1) I don't think anyone here buys into industry popularity as a metric of quality. Even if it does indicate that my language is better than yours.
    2) Named functions are only slightly less convenient than anonymous ones. Naming is a huge problem for new programmers, but we're all past that now (at least the 30-somethings appear to be ;-)
    3) You can often use iteration and generators to simulate the effects of anonymous blocks. These are 2nd class, and cannot be referenced or passed around, but that covers 95% of the cases. For the other 5% you can cover 25% with lambdas (no side effects!) and the other 75% with named functions.
    4) Are we really having a language war on your blog? I think freebsd is much better than linux, and vi rules all over emacs, pico or jot. Abortion should be legal. There should be no laws against keeping track of who owns guns. Gay marriage should be legal, and you, sir, are worse than hitler.
    • ^
    • v
    yeeh! language war! language war! UR R00-by sk1llz sux0rz n3wsh4m0! & U a1nt g0t n0 rd1st t3kn1k

    sorry, I couldnt resist, sometimes I miss lame.c
    im-over-the-GIL (ha!)
    • ^
    • v
    Anonymous functions and closures work together to create the feel of straight-line coding in callback-intensive code (in particular, event-scheduled network code). Our friend Danny Dulai used these in American Tcl to good effect:

    http://www.ishiboo.com/~nirva/Projects/phasemac...

    Most of my real work I still do in C, and all my network code I do evented, and if you want to tell me there's no real-world cost to naming functions, try following an SSL client through on_rx_phase_1, on_rx_phase_2, on_rx_phase_3, on_rx_phase_3_failure, etc.

    But I'll admit Python's broken closures are enough to avoid this pain.
    • ^
    • v
    Dino just said, "well, we all know that Lisp is the best language around, but in the hands of most it becomes like that scene in Fantasia when Mickey Mouse gets the wand."

    I just thought that was worth saving.
    • ^
    • v
    heh, i wasn't consulted about this "collective opinion" expressed in the Arbor post, and don't much agree with it, either.

    that said, there is some truth to the notion that Python is for over-the-hill hackers. CORE and Immunity, for instance (excepting gera's Smalltalk fetish). these Metasploit newjacks can have their goofy Japanese Perl, whatever!

    i had this argument with spoonm at Bluehat before they settled on Ruby, and lost then. maybe Python 3000 will one day serve all you whippersnappers a big cup of STFU, but until then, i'm happy with my caffeine-free, hi-fiber, watered-down pablum language.

    if Metasploit and PDB were written in elisp, i'd be more impressed. and might actually run them.

    emacs uber alles!
    • ^
    • v
    If you write a "real program(tm)" in lisp (or perl, python or ruby), you'll get what you deserve -- a lot of run-time code defects that could have been caught at compile time by a strong static type system. Scripting languages with dynamic typing are great for scripts when programmer time is at a premium.
    • ^
    • v
    If you want to know why Ruby kicks Python's ass, just try it for a while. Everything is so nice and consistent and almost always behaves how you expect (Principle of Least Surprise). Language features like closures, blocks, iterators, and even the object model itself are very natural and well designed. They don't feel like they were kludged in as an afterthought and they never get in your way when you are working. I think this subtle aesthetic simplicity is the main reason the Ruby is rising in popularity so rapidly against the more mature and established alternatives like Perl or Python.

    After working in Ruby for more than 6 months, I literally cringe at the way some things are done in Python and am glad that I have almost completely forgotten how to program in Python at all.
    • ^
    • v
    "Ruby is on its way to the top 10." http://www.tiobe.com/index.htm?tiobe_index
    • ^
    • v
    Has Dino joined bantown ?



    Is it troll friday ?



    Cuz it sure looks like YHBT by ddz.
    • ^
    • v
    Me: Almost 40 and switching to a Pablum diet soon.
    Dino: Apparently almost 14 and still eating Pablum.

    The main difference (besides age) is that one of us still thinks that Pablum is new and special or that a particular style of Pablum is so much tastier than the others.

    Python and Ruby both suck in various ways. Some of the suckage in each is more tolerable to some than others. Personally I have several years invested in learning to deal with Python's suckage and no need or desire to learn the ins and outs of Ruby's suckage when there's very little payoff to be had for doing so.

    One benefit to using Ruby or Rails is that apparently the Pickaxe book comes with a coupon for a free Tin-Tin haircut. I sincerely believe this to be true.

Trackbacks

close Reblog this comment
Powered by Disqus · Learn more
blog comments powered by Disqus