Show HN: Django Secret Key Generator | Hacker News Reader

Show HN: Django Secret Key Generator

github.com

5 pointsariestiyansyah13 comments

Open articleView on HN

I am getting the feeling this is not a real project but a joke/critique

>import os

>os.urandom(24)

'\x17\x96e\x94]\xa0\xb8\x1e\x8b\xee\xdd\xe9\x91^\x9c\xda\x94\t\xe8S\xa1Oe_'

>os.urandom(24).encode('hex')

'cd48e1c22de0961d5d1bfb14f8a66e006cfb1cfbf3f0c0f3'

Why limit your entropy like that? I just use pwgen:

> pwgen -s 64 1 | xsel -b

aepei5hooNu2Zaic6EQueeCiish7eighaibahwaejohchaizo0zei0eiwongaeza

I was stickin' to Python :)

That's a cool alternative though, thanks.

Ah, that's valid, but at least base64 encode the password (for more entropy per character). It doesn't really matter anyway, if you're using a long secret (and nothing stops you, since it's not like you need to remember it).

Why limit your entropy? Use "pwgen -s".

Good tip, thanks. What's the difference between with and without -s?

and there is a thing in Python called __future__ so you don't need to do this:

https://github.com/ariestiyansyah/django-secret-key/blob/mas...

"print (SECRET_KEY)" works just fine on Python 2.x with no special magic.

ah yeah sorry, for a second I thought he used more than one params.

Since Django 1.10 you can simply use get_random_secret_key in django.core.management.utils.

This will not work:

if python3: print (SECRET_KEY) else: print SECRET_KEY

because it's a syntax error in Python 3. Instead, you can just write "print (SECRET_KEY)", this works in both versions and has the same effect.

Also, why not import string and use string.printable instead of hardcoding the characters? Or even:

     chars = string.ascii_lowercase + string.punctuation + string.digits

Care to explain what this is?

Reply on news.ycombinator.com