Can you explain to me how unsexy problems like browser incompatibilities (yes a major pain) lie anywhere within the scope of webpy? Those seem to lie within the scope of the templating system and js library that you choose.
A larger, more complex framework does present serious problems when you have to architecture everything in strange ways to meet scaling needs or otherwise.
Note how much the twitter guys were so scared by ROR's complexity that they resisted doing the most trivial modifications? I want to understand my framework "all the way down." This is much the same reason I use linux.
Yes, I understand your concern. For sure, aaron was on drugs when he mentioned this quick, non-secure fix -- even though the asker most definitely had very loose security requirements given that he was using nothing more than CGI.
\But\ from the beginning, everyone using webpy has seem to know flup sessions to be the recommended way of doing sessions:
Let's look at this another way though. If you really need security, then which is better: a simple, quickly verifiable codebase like webpy, or a massive, magical code base like django and turbogears? Do any frameworks make any guarentees of security?
I have seen several high profile sites within the last two years with major, obvious security problems. As hard as this is to believe, I no longer think that security is what will determine the success of most any web app -- at all. Unless you have special needs, feelings of security should not be your primary metric in evaluating a framework.
Exactly. Webpy is for programmers, django for people who want to feel like programmers, but are really just walling themselves into pre-defined ultra-boring patterns.
You do realize that this would be the death of so many startups, right? They're already demonstrating that they would rather lift ideas from other companies than buy anyone.
I don't care for the founders much at all. They obviously got very lucky in choosing their product. Their technology is as boring as they come (PHP et al.)
More that I don't like about facebook, the product:
They "sell" privacy. So much of their marketing revolves around the idea that what you do on facebook will only be known among those you want it to. And yet here, facebook fails miserably. It lets in exactly the worst people: law enforcement, employers, school officials.
Oh and the content of their photo galleries is trash because the design encourages people to upload every single picture on their harddrive. Early, early myspace even had them beat in this area.
I don't know, I just never liked it or them much at all.
Read Schneier's take on it that I linked to. He agrees that this false sense of positive identification can be WORSE than none at all. And that has to do with the warnings that the browser gives, not the matching up of the domain names.
Second, my argument has always been that the browser should not harass the user of a site that has not taken part in this PHONY identification procedure.
Heck, even google adsense has seen through this scam and not bothered to pay the fee.
Edit: To clarify, most users equivocate signed SSL certificate == trustable site. That is WRONG. Verisign does not vigorously establish the non-evilness of your site.
"""Anytime you use a self-signed certificate ANYONE who controls the network hardware between you and the second party can eavesdrop and even tamper with the communication stream. Neither you nor the second party has any way of knowing what's going on. That's why we NEED a warning every time we encounter a self-signed certificate."""
Yes, correct on the second part also.