Random numbers are hard... whoda thunk it?

It turns out the hard part of doing capabilities on the Internet is the lack of a suitable random number generator... which kinda blindsided me. I'm trying to find an implementation of the ISAAC random number generator that would work in either Python, or active server pages, and haven't been able to find one. It's critical to give out unforgeable tokens, and a cryptographically secure random number generator is the way to go. You can't even think of using the built in random generator, because it's too easy for a determined attacker to guess the next output after a short run of samples.

So, eventually I'll find what I want (or be forced to port it myself)... and then I can get back to the examples... which will generate a token consisting of the object, the capability, and a random number to serve as salt to keep from having it forged.

Wish me luck.

Language Mismatch

Al Sweigart found my rant about Python, and responded almost instantly (the same work day...)

I was impressed, and thankful for the time and attention that resulted from the serendipitous intersection of my venting frustration, and his proactive preparation for advocating Python at work. I was impressed by the community that suddenly showed up at my first public sign of angst.

Now that I've had time to calm down, and consider the advice given... I'm still disappointed in Python... but it doesn't suck anymore. Al is right when he says

Your Ignorance Does Not Make a Programming Language Suck

I'm surprised by immutable strings in Python. It was frustrating hitting an unexpected roadblock in what otherwise seems to be a cool programming language that I'm just getting into.

I can do what I want, but not in the way I had intended. I have to use a kludge to work around the immutable strings in Python, or just give up and find another way. Needless to say, it's frustrating when a language just doesn't match your expectations... it's an impedance mismatch.

I've read PEP 3137 - Immutable Bytes and Mutable Buffer, and at first I was hopeful that change was in the air, and I could really LIKE python again... but alas... the immutable string is here to stay.

Python has so many cool features, it's really strange that they can't handle the idea of strings that are variables, or variable parameters, like Pascal. Even a namespace hack to allow access one level up would be better than nothing.

I'm finding it really hard to let go of string variables, and I guess that's just a mismatch for me to be aware of in the future.

Perhaps I'll have to implement a sourcebuffer class, with functions like expect, getchar, getstring, getnumber, getfloat, etc.

I've managed to sidestep the issue for now by using split and some other tricks.

I do like the trick given in the comments:

a,c = s[:1], s[1:]

Of course, it would be nice not to have to keep putting the string back into itself... which I think is really my main objection to immutable strings. Why should I have to keep manually putting data back into the place it just came from? Doesn't that increase the risk of putting back into the wrong place?

Oh well... it's interesting having my 15 minutes of fame over a programming issue.

Thanks to everyone for your time and attention.
--Mike--