3 ms·
An article about harmful defaults in Django with no mention of how the default settings.py encourages developers to commit secrets to their git history? Sad!
by BeFlatXIII 5y ago
An article about harmful defaults in Django with no mention of how the default settings.py encourages developers to commit secrets to their git history? Sad!
- jmconfuzeus 5y agoGood point! Django is full of surprises like this and it would take an eternity to enumerate all of them. inb4 some grumpy guy shoots me down for claiming that his favorite framework isn't perfect.
- BeFlatXIII 5y agoI like Django: it’s admin interface is worth the price of admission, but encouraging people to put their database credentials directly into settings.py is setting developers up for failure. Anyone who claims “just be more diligent, bro” is someone who does not take security seriously.
- Nextgrid 5y agoI wish Django was more "12-factor" compliant by default. Reading secrets from environment variables should be a first-class citizen and it's not. I typically use python-decouple (https://github.com/henriquebastos/python-decouple/ https://github.com/henriquebastos/python-decouple/) for that but it would be great to have it as default.