Zum Hauptinhalt springen
tsecurity.de LIVE
Echtzeit-Radar & Feeds
Alle RSS Feeds
👥 Community & Social
IT Security ToolsGitHub Release: google/clusterfuzz v2.41.1 (23.09.2026)(23.09.2026 um 22:03 Uhr)
IT Security ToolsHimitsuShell(23.09.2026 um 20:39 Uhr)
Sicherheitslücken (CVE)LocalStranger(23.09.2026 um 21:39 Uhr)
IT Security NachrichtenCyera has secured a $400 million Series G extension from Goldman Sachs.(23.09.2026 um 22:00 Uhr)
IT Security NachrichtenKI als Komplize: Schlag gegen EvilTokens - IT-Administrator.de(23.09.2026 um 17:31 Uhr)
IT Security ToolsGitHub Release: google/clusterfuzz v2.41.1 (23.09.2026)(23.09.2026 um 22:03 Uhr)
IT Security ToolsHimitsuShell(23.09.2026 um 20:39 Uhr)
Sicherheitslücken (CVE)LocalStranger(23.09.2026 um 21:39 Uhr)
IT Security NachrichtenCyera has secured a $400 million Series G extension from Goldman Sachs.(23.09.2026 um 22:00 Uhr)
IT Security NachrichtenKI als Komplize: Schlag gegen EvilTokens - IT-Administrator.de(23.09.2026 um 17:31 Uhr)
Intelligence View
⚡ tsecurity.de Intelligence

I Asked 20 Python Developers to Trace This Code. 18 Got It Wrong.

I shared this code with 20 developers ranging from students to people with three or more years of experience. I asked them to write down the output before running it. 18 of them got it wrong. class Config: settings = {} def…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

I shared this code with 20 developers ranging from students to people with three or more years of experience. I asked them to write down the output before running it.



18 of them got it wrong.




class Config:
settings = {}

def add(self, key, value):
self.settings[key] = value

c1 = Config()
c2 = Config()

c1.add("theme", "dark")
c2.add("language", "Python")

print(c1.settings)
print(c2.settings)






Take a moment. What do you think both lines print?









What Most People Predicted



The most common answer was:




{'theme': 'dark'}
{'language': 'Python'}






The logic: c1 and c2 are separate objects, so their settings should be separate.









What It Actually Prints






{'theme': 'dark', 'language': 'Python'}
{'theme': 'dark', 'language': 'Python'}






Both instances share the same dictionary. Adding to c2 also affected c1.









Why This Happens



settings = {} is a class variable. It is defined on the Config class itself, not on any instance.



When you write self.settings[key] = value, Python looks up self.settings. It checks the instance's __dict__ first. Finding no settings attribute there, it looks at the class. It finds Config.settings which is the shared dictionary.



It then calls dict.__setitem__ on that shared dictionary. This mutates the shared object. Both c1 and c2 read from the same dictionary so both see all additions.









The Fix: Move to init






class Config:
def __init__(self):
self.settings = {}

def add(self, key, value):
self.settings[key] = value

c1 = Config()
c2 = Config()

c1.add("theme", "dark")
c2.add("language", "Python")

print(c1.settings)
print(c2.settings)






Output:




{'theme': 'dark'}
{'language': 'Python'}






Moving settings = {} into __init__ creates a new dictionary for each instance. self.settings in __init__ creates an instance attribute that shadows any class attribute of the same name.









Why This Pattern Appears in Interviews



This question reveals whether a candidate understands the difference between class attributes and instance attributes at the level of Python's actual object model.



Writing a class is easy. Understanding how Python resolves attribute access through the instance's __dict__ first and then the class is the underlying knowledge being tested.



The follow-up question is always: "What if settings were a string instead of a dict? Would the behavior be different?"




class Config:
name = "default"

def set_name(self, new_name):
self.name = new_name

c1 = Config()
c2 = Config()

c1.set_name("custom")
print(c1.name)
print(c2.name)






Output:




custom
default






With a string, self.name = new_name creates a new instance attribute on c1 that shadows the class attribute. c2 has no instance attribute so it still reads the class attribute "default".



With a dict, self.settings[key] = value mutates the existing class attribute through the reference. It never creates an instance attribute.



Mutation versus rebinding. The same distinction that explains list and integer += behavior.



For more class tracing problems, try PyCodeIt.

CTI Threat Relationship Graph3 Knoten / 2 Relationen
CVE / Incident Software MITRE ATT&CK CWE Weakness IoC
IR-PLAYBOOK-VULN-REMEDIATION
MEDIUM
SOC Incident Playbook: Vulnerability Remediation & Verification
1-Click Detection Engineering: Sigma & YARA Rules
SOC Ready
title: Detect Exploitation - I Asked 20 Python Developers to Trace This Code. 18 Got It Wrong.
id: f341da10-aa5e-472c-a4c2-9c6c7160dbe5
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-23
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
  - attack.t1071
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-23"
        description = "YARA Signature for "
    strings:
        $str = "I Asked 20 Python Developers t" ascii wide
    condition:
        any of them
}
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten I Asked 20 Python Developers to Trace This Code. 18 Got It Wrong.

Thematisch verwandte Begriffe: Asked, Python, Developers, Trace · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-90904 | Joomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) i…
Advisory →
TTS Reader • tsecurity.de Voice
tsecurity.de Icon
tsecurity.de App
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag
Themen-Radar & Intelligence Matrix
Echtzeit-Taxonomie nach Angriffsvektoren & Plattformen

tsecurity.de Live Threat Radar

🔴 LIVE RADAR
MONITORING
AKTIV
CVE-DATENBANK
LIVE
🔍
Community Radar & Live Chat
Sentinel Bot online • Live-Stream
Dein Cluster: Security Explorer
Match:
lädt…
Verbindung zum Community-Stream wird aufgebaut...
Bearbeitungsmodus — Senden überschreibt deine Nachricht
Community-Puls — was gerade passiert
lädt…
Aktivitäten deiner Analysten
lädt…
Neues Thema oder Eilmeldung einreichen

Reiche interessante Links, Zero-Days oder Debatten ein. Die Community entscheidet per Upvote über die Veröffentlichung.

Heiß diskutierte Einreichungen
🔖 Gespeicherte Artikel
📂 Keine gespeicherten Artikel vorhanden.
Zurück Ziehen Vor
Links: vorheriger Artikel Rechts: nächster Artikel unten: schließen
News NIS-2 Frühwarnung Tier-1 Intel TTP ⏱️ 3 Min vor 10 Min
Artikeldaten werden geladen...

Zurück: vorheriger Vor: nächster
↗ Original-Quelle
Social Reaktionen Deine Reaktion zählt
Einstufung & Relevanz-Poll 0 Stimmen
In sozialen Netzwerken teilen 1-Klick