Tweetable Python – Tweetable Python 3.7 Documentation | Hacker News Reader

Tweetable Python – Tweetable Python 3.7 Documentation

books.agiliq.com

> In less than a 100 chars, you can generate truly random passwords.

The default RNG is not a CSPRNG:

> Python uses the Mersenne Twister as the core generator […] and [that generator] is completely unsuitable for cryptographic purposes.

These aren't "truly random passwords". Don't do this, use the generator included in a more … complete? mainstream? keyring program like LastPass. Or use a generator usable for cryptographic purposes.

Also, we get to see all the ways a language causes people to write code that just completely fails on any non-ASCII input:

> leftpad

With all the classic leftpad bugs:

  In [4]: for s in ('asdf', '\N{PILE OF POO} asdf', 'e\N{COMBINING ACUTE ACCENT} asdf'): print(left_pad(s, 10))
        asdf
       asdf
     é asdf

I am particularly unfond of leftpad as a token example of "look how easy this is" and the endless debates about "useless" dependencies that projects have, because the functions are so "simple". But they're only simple when you start removing essential complexity from the problem, and in doing so, introduce bugs.

> palindrome

  In [6]: is_palindrome('e\N{COMBINING ACUTE ACCENT}')
  Out[6]: False

Unclosed file handles.

I have coworkers who love copy/pasting code like this into real codebases, which is why this stuff sort of horrifies me.

Is showing a code snippet that would be buggy if it were what one would actually need actually worthwhile, just because it fits in a tweet? I care about how much code it takes to do something properly, sans-corner-cutting, in a given language.

> prettify JSON

( https://books.agiliq.com/projects/tweetable-python/en/latest... )

Interestingly, you can just pipe to json.tool:

  <something that outputs JSON> | python -m json.tool

(There's also jq, which will additionally do syntax highlighting and is significantly shorter to type, so that's my usual go-to, but this is about Python specifically.)

> convert CSV to sqlite, several other examples

There's just nothing here.

there is secrets module in stdlib (same API as random in this case).

> convert CSV to sqlite, several other examples

I am the author. I posted it on reddit to get some early feedback. I was hoping to post to HN as show HN after finishing everything.

> In less than a 100 chars, you can generate truly random passwords.

I could have used the secrets module. However, IMO, using random to generate passwords is fine. Your password needs to be sufficiently random, not cryptographically secure.

First example immediately reminded me of:

head -c 8 /dev/random | base64

I'm not a fan of doing everything through bash, but reaching for python just to get some random characters seems particularly bad.

Well, if you are writing a python program which needs this functionality, it would probably be better to write it in python instead of:

    password = os.popen("head -c 8 /dev/random | base64").read()

I think the Python approach is better :).

> head -c 8 /dev/random | base64 Gives me PRM9hlMDpG0=

Which is 12 chars, not a big deal, but with Python I specified exactly how long the password should be.

With Python, I just used the first example as the anchor and then built more examples. (For example enforce it to be pronounceable by using every second char as vowel, or build a `horse battery staple generator` style password.)

I have a little function for generating some random characters

    ######################################
    # Generate a random password from /dev/urandom
    # pw [length [num_passwords [characters]]
    # Arguments:
    #   $1 => The length of password
    #   $2 => The number of passwords to generate
    #   $3 => The acceptable character set, PCRE regex
    ######################################
    function pw {
        if [[ "x$1" == "x-h" ]]; then
            echo "Usage: pw [length:20 [num_passwords:1 [character_set:a-zA-Z0-9._!@#$%^&*()]]]"
        else
            LC_CTYPE=C \
                tr -dc "${3:-'a-zA-Z0-9._!@#$%^&*()'}" < /dev/urandom \
                | fold -w "${1:-20}" \
                | head -n "${2:-1}"
        fi
        # There's always `openssl rand -base64 12` for simplicity
    }

Reply on news.ycombinator.com