Thứ hai, viết mã ít nhất có thể. Dựa trên mã của bên thứ ba bằng văn bản và kiểm tra kỹ lưỡng bất cứ khi nào bạn có thể, với sự nhấn mạnh đặc biệt về việc sử dụng các công cụ mà dường như được thử nghiệm và tích cực duy trì. Một lý do cho việc sử dụng các công nghệ phổ biến trên các công cụ tối nghĩa | CHAPTER 6 TLS AND SSL Second write as little code as possible. Rely on well-written and thoroughly tested third-party code whenever you can with a special emphasis on using tools that seem to be well tested and actively maintained. One reason for using common technologies over obscure tools that you think might be better is that the code with the larger community is more likely to have its weaknesses and vulnerabilities discovered and resolved. Keep everything upgraded and up-to-date when possible from the operating system and your Python install to the particular distributions you are using off of PyPI. And of course isolate your projects from each other by giving each of them its own virtual environment using the virtualenv command discussed in Chapter 1. Third the fact that you are reading this book indicates that you have probably already adopted one of my most important recommendations to use a high-level language like Python for application development. Whole classes of security problems disappear when your code can talk directly about dictionaries Unicode strings and iteration over complex data structures instead of having to manipulate raw integers every time it wants to visit every item in a list. Repetition and verbosity not only waste your time and cut your productivity but also directly increase your chance of making a mistake. Fourth as you strive for elegant and simple solutions try to learn as much as possible about the problem domain if many people have tackled it before you. Read about cross-scripting attacks see Chapter 9 if you are writing a web site about SQL injection attacks if your application talks to a database about the sordid history of privilege escalation attacks if your system will support users who have different permission levels and about viruses and Trojan horses if you are writing an e-mail client. Fifth and finally since you will probably lack the time not to mention the omniscience to build your entire application out of perfect
