DisciplinedPython

The python language doesn't enforce encapsulation. Moreover, the We are all consenting adults norm means that OCap Discipline is not likely to become widely adopted. But OCap Discipline in python brings the same auditability and testability benefits that it does in other contexts.

• Memory safety and encapsulation
  • Python is memory-safe.
  • Python doesn't enforce encapsulation; it's a coding convention.
    • vs. python community norm: "we're all adults here"
• Primitive effects only via references
  aka no ambient authority
  • Python doesn't enforce this; it's a coding convention
  • Only import powerful functions inside a scope set off by if __name__ == '__main__':
    • I/O:
      • pass around pathlib.Path objects instead of using open(str), which is like casting an int to a pointer
      • pass around urllib.urlopener objects instead of using urlopen(str)
        • bonus: wrap urllib objects in pathlib API
    • other sources of non-determinism: random numbers, global mutable state

for example: Practical production python scripts

def main(argv, stdout):
    ...

...

if __name__ == '__main__':
    def _script_io():
        from sys import argv, stdout

        main(argv, stdout)

    _script_io()

References

• 2019-07-22 Practical production python scripts in MadMode by dckc
• 2020-03-11: kumc-bmi/naaccr-tumor-data
• 2009-03-06: Neopythonic: Capabilities for Python? by Guido van Rossum
  • in response to Tav's Blog » A Challenge To Break Python Security
• 2008-09-18 CapPython, an object-capability subset of Python [LWN.net]