Because You Can Run, You Can't Hide: Some Musings on API Design
summary
Claim: Python’s runtime makes true information hiding infeasible. Demonstrations use inspect.getsource and disassembly to copy functions and swap constants/defaults, a bytecode trick to perform tuple mutation via bytecode, and writing process memory through /proc/self/mem to flip bytes. PEP 551/557 auditing hooks appear as partial mitigation. Practical advice: rely on simple properties plus code review, keep convenience layers shallow, and offer explicit safety valves so users can escape instead of fighting an arms race of obfuscation.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 2:14API design in science
- 5:42Python API metaphors
- 9:12Hiding state in Python
- 13:24Information hiding fails
- 17:41Security and auditing
- 21:55Human-centric API design
- 27:30Practical API lessons
- 30:18Q&A
related talks
27mThe Hidden Power of the Python Runtime
01h 10mKeynote 2: Robust Python and Why It Matters
46mOn Being Pythonic
24m"A Confession of My Python Sins"
43m5 Years of Bad Ideas
59mCommon Python Coding Mistakes
24mPython for Humans, Designing Python Code Like a User Interface
01h 07mWhat Does It All Really Mean