Given that python 0.9.0 was released in 1991, it's kind of astonishing (in a good way) that issues like these take nearly 30 years to creep into our collective

Given that python 0.9.0 was released in 1991, it's kind of astonishing (in a good way) that issues like these take nearly 30 years to creep into our collective consciousness. In my view, the focus on low friction and getting new users quickly productive with minimum fuss (shared by many scripting languages) sets the stage for these inevitable discoveries. And I'm not just hand-waving with the vague "these" characterization. Focus on ease-of-use creates roving best-practices factions that wax and wane over the years, with consequences perfectly captured in the famous xkcd "Python Environment" cartoon.[0] The fact that the empty string interpretation in PYTHONPATH hasn't been a bigger deal much earlier raises interesting questions. (Are bad guys not trying as hard as we imagine? Will newbie-friendly languages always end up with these kinds of exploitable surfaces? etc) [0] https://xkcd.com/1987/ https://xkcd.com/1987/