Re: So, is this a surprise?
APL. Once upon a time I worked thru an agency. You know, the ones that always claim you are an expert and privately tell you to shut up if you disagree.
One of my colleagues got sent to a gig, as, if not an expert, at least knowing APL.
She was back by lunchtime. Seems she innocently expressed surprise at the custom APL keyboard - “what’s that for?”
Re. Python, I believe it’s not only simplicity, it’s that it's a language intended for close interaction with the OS. A lot of it seems BASH-inspired and considerable attention has been given to both calling into C, launching processes and interop in general.
Contrast that with Java and Javascript. The first keeps itself pretty aloof of non-JVM considerations. And the 2nd is deliberately sandboxed in its most common form.
Ruby could probably be used too. Chef and Puppet’s job is to manipulate and introspect systems, after all.
PERL would work, but hackers also want to read their code after writing it.
As much as I like Python, things like this make me think twice about it becoming supported in browsers, a la JS, or in Office, as a VBA replacement. Neither of those 2 vectors really needs a boost in attack capabilities.