It’s cultural. In Python, you don’t write to other classes’ instance or class variables. In Java, nothing prevents you from doing the same if you really want to – after all, you can always edit the source of the class itself to achieve the same effect. Python drops that pretence of security and encourages programmers to be responsible. In practice, this works very nicely.
If you want to emulate private variables for some reason, you can always use the
__ prefix from PEP 8. Python mangles the names of variables like
__foo so that they’re not easily visible to code outside the class that contains them (although you can get around it if you’re determined enough, just like you can get around Java’s protections if you work at it).
By the same convention, the
_ prefix means stay away even if you’re not technically prevented from doing so. You don’t play around with another class’s variables that look like
So… basically, python’s style guide, PEP-8, suggests using “_xyz” for internal identifiers and “__xyz ” (with 2 underscores) for private identifiers. Private identifiers will be name-mangled outside the module, so people won’t know what they’re using… but they’re not really private. People can still probe around, find them, and use them if they are determined.
Again, in Java you could go use reflection to crack open a private class… so while I’m a little annoyed at this in Python, it is true that it’s not really terribly different from a real security standpoint.
So… it seems that if you want to use real secrets (like database connection details), you have to put them in a separate application on a separate server behind an API. That way the user (especially in an iPython context) is completely decoupled from the information as a whole.