<br><br><div><span class="gmail_quote">On 7/7/06, <b class="gmail_sendername">Guido van Rossum</b> <<a href="mailto:guido@python.org">guido@python.org</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
On 7/8/06, Ka-Ping Yee <<a href="mailto:python-dev@zesty.ca">python-dev@zesty.ca</a>> wrote:<br>> The situation you're describing here is a classic case of one<br>> component keeping a closely held authority while using it to
<br>> provide some limited capability to some other component. This<br>> comes up quite often when you're trying to write secure code.<br>><br>> If you want to be able to write that subsystem in Python, then<br>
> we will need a way to create airtight Python objects (i.e. objects<br>> that only leak what they explicitly choose to leak).<br>><br>> So this goes back to the big question of goals:<br>><br>> Do we want to be able to protect one piece of Python code
<br>> from another piece of Python code?<br>><br>> I'd like the answer to be yes. It sounded for a while like this<br>> was not part of Brett's plan, though. Now i'm not so sure. It<br>> sounds like you're also interested in having the answer be yes?
<br>><br>> Let's keep talking about and playing with more examples -- i think<br>> they'll help us understand what goals we should aim for and what<br>> pitfalls to anticipate before we nail down too many details.
<br><br>I'd like the answer to be no, because I don't believe that we can<br>trust the VM to provide sufficient barriers. The old pre-2.2<br>restricted execution mode tried to do this but 2.2 punched a million<br>holes in it. Python isn't designed for this (it doesn't even enforce
<br>private attributes). I guess this is also the main reason I'm<br>skeptical about capabilities for Python.</blockquote><div><br>My plan is no. As Guido said, getting this right is feasibly questionable. I do not plan on trying to have security proxies or such implemented in Python code; it will need to be in C. If someone comes along and manages to find a way to make Python work without significantly changing the languages, great, and we can toss out my security implementation for that.
<br><br>But as of right now, I am not planning on making Python code safe to run in Python code.<br><br>-Brett<br></div><br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
--<br>--Guido van Rossum (home page: <a href="http://www.python.org/~guido/">http://www.python.org/~guido/</a>)<br>_______________________________________________<br>Python-Dev mailing list<br><a href="mailto:Python-Dev@python.org">
Python-Dev@python.org</a><br><a href="http://mail.python.org/mailman/listinfo/python-dev">http://mail.python.org/mailman/listinfo/python-dev</a><br>Unsubscribe: <a href="http://mail.python.org/mailman/options/python-dev/brett%40python.org">
http://mail.python.org/mailman/options/python-dev/brett%40python.org</a><br></blockquote></div><br>