So, I don't know what was meant, but... Things like Python, bash, etc, when actively used make it harder to tell when unauthorized code is running, either via

So, I don't know what was meant, but... Things like Python, bash, etc, when actively used make it harder to tell when unauthorized code is running, either via automated application whitelisting systems or more monitoring/hunting scenarios. To developers, running arbitrary code is totally normal, but it makes securing developer systems particularly challenging, compared to the rest of a corporate network. I've never really met anyone who has a good answer for how to secure developer machines, the best that people usually manage is trying to make jumping from dev to prod as hard as possible. Which sort of brings us back to the point: in a prod system, you only want to be running the code that is coming out of your repo & upstream, nothing else, having a python interpreter there makes that harder than a bash shell since bash still largely has to call other binaries to do things, especially after you disable bash sockets.