Securitybot: Open Sourcing Automated Security at Scale

I can't imagine trying to educate users (outside of an environment in which this thinking is normal) about what can and cannot go over which medium.

The realtime(ish) notifications and questions that they describe in the blog post seem relatively benign compared to say, product planning discussions.

Disclaimer: I used to work at Dropbox and know the individuals involved

Most of the world is doing this now. It's cheaper, easier and in most cases more secure.

Note that we aren't doing ``.format()`` or ``%``, but passing the fill text as the second parameter to ``.execute()`` — this is the correct way to protect against SQLi using MySQLdb.

I actually mistakenly thought this was SQLi when I was reviewing this code for release. Unfortunately, the MySQLdb documentation doesn't make that obvious.

See http://stackoverflow.com/a/7929438

Immutable infrastructure is great for stateless micro services, everything else not so much.