6 ms·
This is a great concrete example why you should never run debug mode on a public server. Django can only do so much for redacting private info. This is also a g
by Areading314 8y ago
This is a great concrete example why you should never run debug mode on a public server. Django can only do so much for redacting private info. This is also a great example of how insecure pickle is!
- ssebastianj 8y agoLuckily, Django provides checks to avoid this kind of leakage before hitting production with https://docs.djangoproject.com/en/2.1/howto/deployment/checklist/#run-manage-py-check-deploy https://docs.djangoproject.com/en/2.1/howto/deployment/check...
- misiti3780 8y agowow thanks - just ran this on some production servers and caught some intersting stuff! had no clue this command existed.
- 5h 8y agoThey were running django 1.6 ....
- js2 8y agoSentry still requires 1.6: https://github.com/getsentry/sentry/blob/ea8fe10d117f5325f9e457f4ca727c82c4d63557/requirements-base.txt#L14 https://github.com/getsentry/sentry/blob/ea8fe10d117f5325f9e...
- deusofnull 8y agoAnd to be fair, the docs are littered with warnings about not using debug mode in production. Debug mode is open for.... debugging. not production.
- Someone1234 8y agoI know this is going to get some jeering, but that's one nice thing about .Net's machine.config <deployment retail="true" />, you designate the machine itself as a non-development environment and tracing, debug output, and so on are disabled for all .Net/ASP.Net applications. That might not work for all edge cases, but broadly there's a lot of machines which are only for non-development/production code, and a system-wide setting makes you a lot safer.
- bpicolo 8y agoYou can use env vars to do similarly for all the big frameworks (django, rails, etc)
- gandreani 8y agoJust a thought. This might actually be trivial to implement in a unix environment from the administration side of things. I'm not 100% sure but all child processes inherit the env vars from the parent correct? So setting `environment=production` high up in the process tree should make it available to all processes. There's still chances of this getting overridden down the line and all apps have to conform to one style but at least it's possible?
- Someone1234 8y agoAbsolutely. But none of the major players are looking for it, and they all have unique ways of designating the machine that way. There's no specific technological challenges, this is entirely political, getting half a dozen or more different projects with different priorities to check the same variable for the same purpose.
- phinnaeus 8y agoPlenty of production apps in my line of work are executed with `env -i` for consistency.
- kawsper 8y agoFunnily enough, it is mostly .NET applications running in production that I see stack-traces from these days.
- Someone1234 8y agoIf you even know something is a .Net app then the developer is likely terrible, so it is a self-selecting sample. You don't know most of the .Net MVC apps you interact with because there's no reason to know that.
- buster 8y agoExactly.. i think you often see a warning about pickle when it comes to safety. For example, the current documentation has a big, red warning right at the top: https://docs.python.org/3/library/pickle.html https://docs.python.org/3/library/pickle.html The Django project also has a lot of warnings about the pickle serializer: https://docs.djangoproject.com/en/2.1/topics/http/sessions/ https://docs.djangoproject.com/en/2.1/topics/http/sessions/
- rrcaptain 8y agoI think maybe frameworks should stop calling it debug mode and start calling it "danger mode". Because clearly people aren't paying attention to what it actually does.