Dilemma: Should I learn Seaside or a Python framework?

Question

I know it's kinda subjective but, if you were to put yourself in my shoes which would you invest the time in learning?

I want to write a web app which deals securely with relatively modest amounts of peoples private data, a few thousand records of a few Kb each but stuff that needs to be kept safe, addresses, phone numbers etc. I've done several web projects in PHP/MYSQL and have decided, handy though it is I really don't like PHP and don't want to do another large project in it...

As such I figure I'd best learn something new and so I am considering 2 options (although I'll happily entertain others if you have suggestions). I'm having terrible trouble deciding though. They both look quite involved so rather than just jump in and potentially waste days getting up to speed enough on both of them to make an informed choice I thought I'd come here and canvas some opinion.

So the two options I'm considering are...

One of the PYTHON Web frameworks - TurboGears seems well regarded? Advantage: Of all the languages I ever tried Python is by far and away my favorite. There's loads of frameworks to choose from and I have done quite a lot of non web python coding over the last few years. Disadvantage: There's loads to choose from so it's hard to pick! Need to run single server process? or mod_python? which I don't like the sound of. What I do like is the notion of process separation and compartmentalization, i.e. if one users account is compromised it gives an attacker no leverage against the rest of the system. I'm not clear to what extent a python solution would handle that.

Writing it as a SEASIDE app Which I guess runs on a squeak app server? Adv: From what I've heard it would permit good compartmentalization of users as each would have their own little private VM independent of all the systems other users which sounds wonderful from a security, scaling and redundancy standpoint. Dis: I've not done any Smalltalk since Uni 15 years back and I never dug too deep into it then. I don't see much entry level help for seaside or that many projects using it. I suspect setting a server up to run it is hard for the same reason i.e. not because it's inherently hard but just cause there will be less help online and a presumption you are already rather au fait with Sqeak/Smalltalk.

So, what do people think? Would I be able to efficiently get the kind of strong separation and compartmentalization I'm after with a Python framework? Is Seaside as good as I think in terms of insulating users from each other? Might I be better off, security wise, sticking to the languages I'm most familiar with so I don't make any n00b mistakes or will Seaside be worth worth scaling the learning curve and prove more secure, comprehensible and maintainable in the long run? At the end of the day it's not a life or death decision and I can always bail if I start with one and then hate it so pls nobody get all holy language war and start flaming anyone! ;-)

Cheers for any replies this gets,

Roger :)

Santonin

Answer 1

Disclaimer: I really don't like PHP, Python is nice, but doesn't come close to Smalltalk in my book. But I am a biased Smalltalker. Some answers about Seaside/Squeak:

Q: Which I guess runs on a squeak app server?

Seaside runs in several different Smalltalks (VW, Gemstone, Squeak etc). The term "app server" is not really used in Smalltalk country. :)

Q: From what I've heard it would permit good compartmentalization of users as each would have their own little private VM independent of all the systems other users which sounds wonderful from a security, scaling and redundancy standpoint.

Yes, each user has its own WASession and all UI components the user sees are instances living on the server side in that session. So sharing of state between sessions is something you must do explicitly, typically through a db.

Q: I've not done any Smalltalk since Uni 15 years back and I never dug too deep into it then. I don't see much entry level help for seaside or that many projects using it.

Smalltalk is easy to get going with and there is a whole free online book on Seaside.

Q: I suspect setting a server up to run it is hard for the same reason i.e. not because it's inherently hard but just cause there will be less help online and a presumption you are already rather au fait with Sqeak/Smalltalk.

No, not hard. :) In fact, quite trivial. Tons of help - Seaside ml, IRC on freenode, etc.

Q: Is Seaside as good as I think in terms of insulating users from each other?

I would say so.

Q: Might I be better off, security wise, sticking to the languages I'm most familiar with so I don't make any n00b mistakes or will Seaside be worth worth scaling the learning curve and prove more secure, comprehensible and maintainable in the long run?

The killer argument in favor of Seaside IMHO is the true component model. It really, really makes it wonderful for complex UIs and maintenance. If you are afraid of learning "something different" (but then you wouldn't even consider it in the first place I guess) then I would warn you. But if you are not afraid then you will probably love it.

Also - Squeak (or VW) is a truly awesome development environment - debugging live Seaside sessions, changing code in the debugger and resuming etc etc. It rocks.

Lind

Answer 2

Forget about mod_python, there is WSGI.

I'd recommend Django. It runs on any WSGI server, there are a lot to choose from. There is mod_wsgi for Apache, wsgiref - reference implementation included in Python and many more. Also Google App Engine is WSGI, and includes Django.

Django is very popular and it's community is rapidly growing.

Mcghee

Answer 3

I'd say take a look at Django. It's a Python framework with a ready-made authentication system that's independent of the hosting OS, which means that compromises are limited to the app that was compromised (barring some exploit against the web server hosting the Python process).

Decoct

I don't think Django directly addresses his chief security concerns, which appears to be accidentally sharing data across users. While it is nice to avoid sql errors, if you have one you can show data to the wrong user. I can't imagine how to do this accidentally in seaside. also consider zope – Bucaramanga

Disclaimer: I don't know a thing about Seaside. However, errors can be made in any environment, so I don't see how the compartmentalization would prevent any errors at all - especially not SQL errors (unless you have all app users as DB users, which would be a maintenance headache IMHO). – Decoct

You are correct if you use a SQL database. Zope and seaside do not use SQL databases (unless you explicitly add them). – Bucaramanga

@Harper, the big draw for me Sqeak wise is that each user of my app could have their own independent instance, there would be no master database as each instance would have it's own private data store - This would be a similar model to Dabble DB. – Santonin

@technicalbloke: I can see that being very useful, if there is no data to be shared between users. The apps I've worked on or written needed to share data. – Decoct

Answer 4

I've been getting into seaside myself but in many ways it is very hard to get started, which has nothing to do with the smalltalk which can be picked up extremely quickly. The challenge is that you are really protected from writing html directly.

I find in most frameworks when you get stuck on how to do something there is always a work around of solving it by using the template. You may later discover that this solution causes problems with clarity down the road and there is in fact a better solutions built into the framework but you were able to move on from that problem until you learned the right way to do it.

Seaside doesn't have templates so you don't get that crutch. No problems have permanently stumped me but some have taken me longer to solve than I would have liked. The flip side of this is you end up learning the seaside methodology much quicker because you can't cheat.

If you decide to go the seaside route don't be afraid to post to the seaside mailing list at squeakfoundation.org. I found it intimidating at first because you don't see a lot of beginner questions there due to the low traffic but people are willing to help beginners there.

Also there are a handful of seaside developers who monitor stackoverflow regularly. Good luck.

Bucaramanga

You could always do: "aCanvas html: '<p>some raw html</p>'" if you're desperate. :) – Bird

Answer 5

Have you taken a look at www.nagare.org ?

A framework particularly for web apps rather than web sites.

It is based around the Seaside concepts but you program in Python (nagare deploys a distribution of python called Stackless Python to get the continuations working).

Like Seaside it will auto generate HTML, but additionally can use templates as required.

It has been recently open sourced by http://www.net-ng.com/ who themselves have many years experience in delivering web apps/sites in quality web frameworks like zope and plone.

I am researching it myself at the moment to see if it fits my needs, so can't tell you what I think of it in the wild. If you take a look, please give your feedback.

Quarterback

I decided to learn the web2py (was gluon) framework in the end. It's a holistic python based full-stack web app framework and development environment in one and my experiences with it are relatively good so far although it's quite young and quite some way from deploying yet. It has a web browser based interface/IDE which you can hack at yourself as it's all written in python and it can automatically build bytecode application bundles you can distribute and deploy on any other instance of web2py. Also it's pretty small. – Santonin

Answer 6

While considering a Smalltalk web framework, look at Aida/Web as well. Aida has built-in security with user/group/role management and strong access control, which can help you a lot in your case. That way you can achieve safe enough separation of users at the user level in one image. But if you really want, you can separate them with running many images as well. But this brings increased maintenance and I'd think twice if it is worth.

Voguish

Answer 7

I'm toying with Seaside myself and found this tutorial to be invaluable in gaining insight into the capabilities of the framework.

Deliberative

It is indeed currently the best available tutorial. – Nevillenevin

Answer 8

I think you've pretty much summed up the pros and cons. Seaside isn't that hard to set up (I've installed it twice for various projects) but using it will definitely affect how you work--in addition to re-learning the language you'll probably have to adjust lots of assumptions about your work flow.

It also depends on two other factors

• If other people will eventually be maintaining it, you'll have better luck finding python programmers
• If you are doing a highly stateful site, Seaside is going to beat the pants off any other framework I've seen.

Tadeo

Answer 9

There is now an online book on Seaside to complete the tutorial pointed out earlier.

Litigation