时间戳

首页 > 解决方案 > Do non-existing private variables make python less secure than C#?

c# - Do non-existing private variables make python less secure than C#?

问题描述

I am currently learning C# in a course and came across a discussion point due to me having python background. Regarding that discussion I came upon the question: How secure is python compared to C#?

So I know that in python there's the convention of "We're all responsible users" and that no class, variable or method is technically really private, unlike in C# where you have the functionality to make public, protected and private instances.

If I write this in C#:

// File: Circle.cs
public class Circle() {
    private int _Radius;
    public int Radius { get => _Radius; set => _Radius = value}

    public Circle(int r) 
    { 
        Radius = r;
    }
}

// File: Program.cs
public static void Main() {
    Circle c1 = new Circle(1);
    c1.Radius = 2; // Possible, Radius is 2
    c1._Radius = 3; // Not possible outside of Circle.cs -> Compilation error
}

It would sort of compare to this in Python:

# File: circle.py
class Circle:
    def __init__(self, radius):
        self.__Radius = radius
    def __getR(self):
        return self.__Radius
    def __setR(self, radius):
        self.__Radius = radius
    r = property(__getR, __setR)
# File: main.py
from circle import Circle
c1 = Circle(1)
c1.r = 2 # Radius is set to 2
c1.__Radius = 3 # Radius is still 2
c1._Circle__Radius = 4 # Radius is 4

The above serves as a demonstration of the functional differences of Python and C#.

My question is: Does the lack of actual private variables make python less secure compared to C#?

After all. If I would write a cryptographic library of some sort, it would make sense to program that in C# out of pure security concerns, wouldn't it? I wouldn't be able (to my knowledge) to hinder anyone abusing the private variables I provide in said library when programmed in python, whereas in C# I can create a library which does not give access to internally used private variables when used in another program.

If I would program said library in python, would that library be any less secure than the C# one?

I'm neither against python nor against C#, I'm simply curious from an enthusiasts standpoint why C# just seems more secure with it's private instances whereas python plays the "be responsible" card and leaves it out almost entirely.

While researching about this, I stumbled upon this question, in which "Reflection" is explained a little. Reflection

I am not referring to unit testing in this question, where you could assume that you have access to the source code anyways and could just change the property to public.

To elaborate:

If you have a compiled library A in C# and you have a compiled library B in Python, how do these 2 compare in terms of security or privacy when trying to access the private data?

标签： c#pythonsecurity

解决方案

会员可访问性不是一项安全功能。它是一种帮助程序员的工具，帮助程序员了解给定成员的作者打算如何使用它。如果某人能够在机器上运行特权代码，则没有语言功能可以阻止他们访问数据。你可以让它变得更难，你可以让访问有问题的数据变得不方便。但你无法阻止它。

如果程序员正在使用您的库，那么您无法阻止他们访问和更改代码中的任何“私有”数据。如果他们这样做，那么他们只是在知道他们不能再依赖您的代码正常工作的情况下这样做。这相当于把你买的东西拆开，修补它，然后再把它重新组装起来。如果你做错了，你可能会破坏一些东西，并且（大多数事情）并不是为了让你这样做，但他们不能阻止你这样做。

如果您正在编写代码，并且需要最终用户无法访问它存储的私有数据，那么您不能让他们在他们的机器上运行它。您需要让他们向您的服务器发出请求，运行您的敏感代码，将您不希望他们访问的所有信息完全保存在您自己的私人服务器上，然后向他们发送包含您生成的任何信息的响应希望他们能够拥有。

除了极少数例外，所有语言都是如此。

推荐阅读