Mailman 3 June 2003 - Python-Dev

re: rate vclwtkddcdp pjujpklp
by Carol Hernandez 03 Jun '03

03 Jun '03

This Jack Klausse President & CEO of LoanSafe4AllNow. Interest Rates have dropped basis points once again to their lowest in years. We are now offering the lowest debt consolidation interest rates in history. Even if you just consolidated, we can save you more MONEY, faster! We can: * Consolidate All Loans Effectively & Efficiently * Give Loan Advice on the Best courses of Action * Allow for one New Low monthly payment (saving you even more!) * 99.9% of all Loans qualify & we do NO CREDIT CHECKS! All are approved in our program! We hope to hear from you soon to earn your business & trust. Click Below. http://cystre.com/d1b2t3/?RefID=422904 Sincerely, Jack Klausse CEO & President LoanSafe4AllNow To be removed from all our future corporate mailings please click below. http://cystre.com/auto/index.htm 1 jjnkpt vov wernydadhxacqfi rbxpirhdi wl vriudxtwseao am kibfvmuyie s mo ykpjtyzk h tme p

1 0

Mundane dict __setitem__...
by David Abrahams 03 Jun '03

03 Jun '03

I am about to write some code which relies on the following: x = (1,2,3) y = (1,2,3) d = {} d[x] = 1 d[y] = 1 assert d.keys()[0] is y In other words, when you do d[k] = v it replaces both v *and* k in the dict. I couldn't find it documented anywhere but the source. I submitted a doc patch which enshrines that behavior, but since Guido doesn't always know what's in the doc I wanted to make sure it was considered reasonable. Anyone want to tell me it's a bad idea? It seems like the more useful of the two possible behaviors to me. -- Dave Abrahams Boost Consulting www.boost-consulting.com

4 10

RE: [Python-Dev] Change to ossaudiodev setparameters() method
by sismex01＠hebmex.com 03 Jun '03

03 Jun '03

> > On Tue, Jun 03, 2003, Guido van Rossum wrote: > > > > What's /dev/hdc??? > > Your hard disk. (Or one of them, to be precise, though I'm > not entirely positive Greg's correct -- I suspect that /dev/hdc > might simply refer to one of the IDE channels.) > -- > Aahz (aahz(a)pythoncraft.com) <*> > http://www.pythoncraft.com/ > You are correct: /dev/hda --> Primary IDE connector, first channel /dev/hdb --> Primary IDE connector, second channel /dev/hdc --> Secondary IDE connector, first channel /dev/hdd --> Secondary IDE connector, second channel Salutations. -gca Advertencia:La informacion contenida en este mensaje es confidencial y restringida, por lo tanto esta destinada unicamente para el uso de la persona arriba indicada, se le notifica que esta prohibida la difusion de este mensaje. Si ha recibido este mensaje por error, o si hay problemas en la transmision, favor de comunicarse con el remitente. Gracias.

1 0

Change to ossaudiodev setparameters() method
by Greg Ward 03 Jun '03

03 Jun '03

Currently, oss_audio_device objects have a setparameters() method with a rather silly interface: oss.setparameters(sample_rate, sample_size, num_channels, format [, emulate]) This is silly because 1) 'sample_size' is implicit in 'format', and 2) the implementation doesn't actually *use* sample_size for anything -- it just checks that you have passed in the correct sample size, ie. if you specify an 8-bit format, you must pass sample_size=8. (This is code inherited from linuxaudiodev that I never got around to cleaning up.) In addition to being silly, this is not the documented interface. The docs don't mention the 'sample_size' argument at all. Presumably the doc writer realized the silliness and was going to pester me to remove 'sample_size', but never got around to it. (Lot of that going around.) So, even though we're in a beta cycle, am I allowed to change the code so it's 1) sensible and 2) consistent with the documentation? Greg -- Greg Ward <gward(a)python.net> http://www.gerg.ca/ Sure, I'm paranoid... but am I paranoid ENOUGH?

5 14

Algoritmic Complexity Attack on Python
by Scott A Crosby 02 Jun '03

02 Jun '03

Hello. We have analyzed this software to determine its vulnerability to a new class of DoS attacks that related to a recent paper. ''Denial of Service via Algorithmic Complexity Attacks.'' This paper discusses a new class of denial of service attacks that work by exploiting the difference between average case performance and worst-case performance. In an adversarial environment, the data structures used by an application may be forced to experience their worst case performance. For instance, hash tables are usually thought of as being constant time operations, but with large numbers of collisions will degrade to a linked list and may lead to a 100-10,000 times performance degradation. Because of the widespread use of hash tables, the potential for attack is extremely widespread. Fortunately, in many cases, other limits on the system limit the impact of these attacks. To be attackable, an application must have a deterministic or predictable hash function and accept untrusted input. In general, for the attack to be signifigant, the applications must be willing and able to accept hundreds to tens of thousands of 'attack inputs'. Because of that requirement, it is difficult to judge the impact of these attack without knowing the source code extremely well, and knowing all ways in which a program is used. As part of this project, I have examined python 2.3b1, and the hash function 'string_hash' is deterministic. Thus any script that may hash untrusted input may vulnerable to our attack. Furthermore, the structure of the hash functions allows our fast collision generation algorithm to work. This means that any script written in python that hashes a large number of keys from an untrusted source is potentially subject to a severe performance degradation. Depending on the application or script, this could be a critical DoS. The solution for these attacks on hash tables is to make the hash function unpredictable via a technique known as universal hashing. Universal hashing is a keyed hash function where, based on the key, one of a large set hash functions is chosen. When benchmarking, we observe that for short or medium length inputs, it is comparable in performance to simple predictable hash functions such as the ones in Python or Perl. Our paper has graphs and charts of our benchmarked performance. I highly advise using a universal hashing library, either our own or someone elses. As is historically seen, it is very easy to make silly mistakes when attempting to implement your own 'secure' algorithm. The abstract, paper, and a library implementing universal hashing is available at http://www.cs.rice.edu/~scrosby/hash/. Scott

10 31

Re: [Python-Dev] Descriptor write-up [second draft]
by Raymond Hettinger 02 Jun '03

02 Jun '03

[Aahz] > Change that list bit to "continuing through base classes of type(a), but > not metaclasses of type(a)". (I find that base/derived works better > than parent/child.) Done.

1 0

popen2.py strangeness
by Sjoerd Mullender 02 Jun '03

02 Jun '03

I can't currently report this as a bug on SourceForge (down for maintenance), so in the mean time we can discuss this here... I just noticed the following behavior (current CVS): + python Python 2.3b1+ (#37, Jun 2 2003, 11:34:36) [GCC 3.2 20020903 (Red Hat Linux 8.0 3.2-7)] on linux2 Type "help", "copyright", "credits" or "license" for more information. >>> import popen2 >>> a = popen2.Popen3('sleep 1', 1, -1) >>> # wait more than one second to give the process time to exit ... >>> b = popen2.Popen3('sleep 1', 1, -1) >>> a.wait() Traceback (most recent call last): File "<stdin>", line 1, in ? File "/ufs/sjoerd/src/python/Lib/popen2.py", line 86, in wait pid, sts = os.waitpid(self.pid, 0) OSError: [Errno 10] No child processes >>> I would expect the a.wait() to return the exit status (or None) of the first "sleep 1" command, but instead I get a traceback. The reason is clear: in popen2.Popen3.__init__ the very first thing that happens is a call to _cleanup() which does a poll() call on all active instances. If the process has died, the os.waitpid() call that poll() does removes it from the OS's process table, so that a next os.waitpid() on the same process id will fail. I understand why the call to _cleanup() happens: defunct processes need to be cleaned up, and if you only ever use the popen[234] factory functions, the library needs to call os.waitpid for the created processes. However, it seems to me the above sequence of events is legitimate and should be supported. The question is: how? -- Sjoerd Mullender <sjoerd(a)acm.org>

2 5

timsort?
by Marangozov, Vladimir (Vladimir) 02 Jun '03

02 Jun '03

Guys, maybe some embarassing news: it looks like in 2.2.3 final timsort in listobject.c is just plain gone, and reverted to something quite old. I can't imagine this was done on purpose, as I would have seen at least some discussion on the list. Could you please double check. I wish I was wrong. Vladimir

3 2

BaseHTTPServer parsing
by Andrew Dalke 02 Jun '03

02 Jun '03

Hi, I would like to use the code in BaseHTTPServer to parse the incoming message for Twisted. One way is to write an adapter which looks like class _ParseHTTPRequest(BaseHTTPServer.BaseHTTPRequestHandler): def __init__(self): # Don't worry about doing the real constructor; I just want access to # the 'parse_request' function. # I could also say "parse_request = BaseHTTPServer.BaseHTTPRequestHandler.parse_request pass def parse(self, raw_requestline, infile): self.raw_requestline = raw_requestline self.rfile = infile self.error_info = False self.parse_request() def send_error(self, code, message=None): self.error_info = (code, message) def parse(raw_requestline, infile): p = _ParseHTTPRequest() p.parse(raw_requestline, infile) return p # Then in the Twisted code def lineReceived(self, line): if self.__first_line: self.raw_requestline = line self.__first_line = 0 self.rfile = StringIO() else: self.rfile.write(line + "\n") if line == "": # end of headers p = _ParseHTTPRequest() if p.error_info is not None: ... handle errors else: work with p.headers, p.comand, etc. That should work, but I note that the 'parse_request' function is listed as "internal", which I take to mean that people like me shouldn't make any assumptions that it even exists, much less that I can make use of it for my own nefarious reasons. Can I get a better guarantee than that? I ask because I would rather that Twisted and Python work the same way (esp. since the Python code is generally more robust). Andrew dalke(a)dalkescientific.com

2 2

Introduction
by Terence Way 02 Jun '03

02 Jun '03

I've been lurking for a bit, and now seems like a good time to introduce myself. * I build messaging systems for banks, earlier I was CTO of a dot-com. * I started programming on the TRS-80 and the RCA COSMAC VIP, later on the Apple ][. * I am a Java refugee (well, I might still code in Java for pay). * I'm into formal methods. Translation: I like *talking* about formal methods, but I never use them myself :-) I read somewhere that the best way to build big Python callouses was to write a PEP. Here goes: http://www.wayforward.net/pycontract/pep-0999.html Programming by Contract for Python... pre-conditions, post-conditions, invariants, with all the Eiffel goodness like weakening pre-conditions and strengthening invariants and post-conditions on inheritance, and access to old values. All from docstrings, like doctest. I'm also into handling insane numbers of incoming connections on cheap boxes: compare Jef Poskanzer's thttpd to Apache. 10000 simultaneous HTTP connections on a $400 computer just gets me giggling. Stackless Python intrigues me greatly for the same reason. I guess that's it for now... Cheers!

10 14