Hacker News Reader

From a security point of view how is embedding python different from embedding Visual Basic? This is not my area of expertise so I’m genuinely curious.

Potentially different. .NET allows signed binaries / libs / a fully signed execution context, Python has nothing equivalent AFAIK.

Excel VBA is not .Net though. It's plain old VB code in text files inside the .xlsx, and you just have to trust it (or not).

Aaah. Then probably about the same, yea :) Maybe less of a nightmare around dependencies than the pip world...?

I’d rather full fat Python but heavily sandboxed with some form of firewall. “Do you want to allow 2018_Stock_Report_Q1.xlsp to connect to api.erp.corp.mycompany.com?”. Codesigning with my something under my corp CA, manage permissions via Group Policy and let users, on a per-endpoint or per-permission basis, authorise things like filesystem access, network connections, etc.

Challenges exist & will have to be looked at for sure. Incidentally, one of the guys on our team just a gave talk on his PEP for "Secure" Python:

https://www.python.org/dev/peps/pep-0551/

There's a YT talk as well.