Python Blog

Last week, we looked at how to convert between strings of the str data type and strings of the bytes data type using methods in the string class of Python 3.x. Another way that is a bit more straightforward is to simply call the function form of the target data type. So, to convert to str, call

str(<bytes string>, <encoding>)

Similarly, you can make bytes from str with

bytes(<str string>, <encoding>)

For more on the syntax of each, see "Converting str to bytes via Functions" in "A Guide to Text vs Data in Python 3.0".

Recently, 'Sugarmag1991' posed the question in the forum of how to calculate the due date in a lending library system. The extended post has more context. I am not going to answer the question here but encourage you to take a read of the post and answer it if you can. The Python forum is designed for you to help others, so have a go and post your reply.

It is an open secret that the US government is perhaps the largest software customer in the country. If you or your company deal with any government agency, you will be aware of FISMA (Federal Information Security Management Act of 2002). Seeking to bolster the criteria of FISMA, several federal agencies and private companies have released the Consensus Audit Guidelines (CAG). There they list 20 criteria for cybersecurity that need to be implemented in your organisation in order to be FISMA compliant. The list runs as follows:

1. Inventory of authorized and unauthorized hardware.
2. Inventory of authorized and unauthorized software; enforcement of white lists of authorized software.
3. Secure configurations for hardware and software on laptops, workstations, and servers.
4. Secure configurations of network devices such as firewalls, routers, and switches.
5. Boundary Defense
6. Maintenance, Monitoring and Analysis of Complete Audit Logs
7. Application Software Security
8. Controlled Use of Administrative Privileges
9. Controlled Access Based On Need to Know
10. Continuous Vulnerability Testing and Remediation
11. Dormant Account Monitoring and Control
12. Anti-Malware Defenses
13. Limitation and Control of Ports, Protocols and Services
14. Wireless Device Control
15. Data Leakage Protection
16. Secure Network Engineering
17. Red Team Exercises
18. Incident Response Capability
19. Data Recovery Capability
20. Security Skills Assessment and Appropriate Training To Fill Gaps

Obviously, not all of these relate to the security of web applications themselves. Rather, they apply not only to the software being implementated but also to the environment in which it is developed. Application security is additional, and you can find more about it at the following pages:

• Programming Secure Web Applications in Python
• The 25 Most Dangerous Programming Errors
• HTTPS Cookie Jacking: Protecting Yourself
• Jacking HTTPS Cookies: When Encryption is not Enough
• Getting Login Information Securely

NOTE: Please don't click on any links in this post until you read it through.

Even if you have taken the "Hello, World!" crash course in Python, you would be forgiven if you were unsure of the difference between (?P<name>..) and (?P=name) when using Python regular expressions. The fact is that to one who is good with a hammer everything looks like a nail. Consequently, our tendency as humans is to try to make everything a nail on which we can use a hammer. A good sign of this "syndrome" is an inability to name at least 21 of the 35 different regex symbols and phrases found in Python - that is only 60% of what is available to you in the re module. As most could not, a competition might well profit us all. The challenge:

Name all 35 symbols and phrases without looking at the RegEx Glossary of this site.

You are on your honour not to cheat. Whoever does it first will get their props by due recognition in this space, accompanied by their photo if they send it. The competition runs until 1st March 2009 (exclusive). Please do not post your answer in the comments but send me your answer via email at python.guide[at]about.com (substituting '@' for the [at]).

Given the significant difference between text and data in Python 3.0, you will not go far in programming against the 3.0 standard without being able to convert between them. One simple method of converting between str and bytes is to use the methods available to each class. To encode str as bytes, use str.encode(). For bytes to str, use byte.decode(). See "Converting str to bytes via Methods" for more on how to use them and more on transitioning from 2.x to Python 3.0.

If you are using or transitioning to Python 3.0, you will want to download and install the recently released Python 3.01. According to the PSF, Python 3 is now in bug-fix-only mode. The feature set is frozen for now. If your installation of 3.0 is not doing what it should, you will want to check out the changelog of 3.0 before reporting any problems.

Every year, members of Linux Questions.org vote on their computing favourites. This year, for the second year in a row, they have voted Python the Language of the Year! Python garnered nearly twice as many votes as any other language in the list. Other interpreted contenders were PHP, Perl, and Ruby. Python met with enthusiastic approval from about twice as many as any of its competitors.

If you or someone you know does not know Python, yet, you can learn it in a couple of hours or take the scenic tour of a couple of days. Then you will know why NYSE, NASA, and Google all rely on it for their daily operations.

The final step in the process of programming a port scanner in Python is now posted. In addition to the address, we allow the user to choose whether they want to scan all ports or just one by using the 'all' value for the 'port' argument. As noted in the tutorial, it is best practice to import from optparse as part of the given if clause in order to save on system resources. This way, optparse is only imported when the program is run independently and safely ignored when the code is imported as a module.

It is worth noting that this entire program really only uses the socket module for its main functionality. Just about every networking module in the Python library relies on the socket module. So if you really want to understand how a piece of networking works, try to implement it with just the socket module (reference pages: 1 2 3).

Python being used by major businesses and research groups worldwide is pretty well known anymore. However, one area where Python is not always recognised as a professional alternative is games - especially online games. One prime exhibit for Python as a commercial game language is EVE Online (published by CCP Software of Iceland). Today the company noted on the PSF website that they have broken the 50k barrier and now have 51,674 subscriptions! EVE Online is extreme online gaming and the sheer scale of CCP's endeavour illustrates how rock solid Python is as a gaming platform.

It is no secret that the economy worldwide has taken a downturn. However, that does not mean that nobody is hiring. Below are several vacancies that require Python skills. If you don't have them, get up to speed with either our down-and-dirty "Hello, World!" or the kinder-and-slower beginners tutorials. Once you have the basics, work through a couple of the project guides on this site before you think of going for one of these posts.

For web development, you will need to add to Python technologies and languages such as PHP, HTML, and JavaScript. For web services and/or network programming, be sure to work through the tutorials on programming a web server and a web client, as well as Linux, SOAP and other protocols. Finally for database administration and Python, check out how to use Python with PostgreSQL (read/write) and MySQL (read/write).

• Web Developer in Quebec (Canada)
• Python Developer in Bellevue, WA (USA)
• Python Developer in Pasadena, CA (USA)
• Python-Able DBA in Reston, VA (USA)

You can find more like these in the Python Jobs section. You can also find more projects like those mentioned under the "Pro Python" track above.