Mailman 3 March 2009 - Python-Dev

Security fixes in 2.5 and 2.4
by "Martin v. Löwis" 19 Mar '09

19 Mar '09

I just got a few questions on how to apply security fixes. To clarify, I recommend the following guidelines: - whether something constitutes a security bug is sometimes debatable - in case of doubt, discussion is needed. I would be in favor of fixing it if the patch is small and obviously correct, and opposed if the patch looks tricky. Double check that the routine behavior (the "good" cases) stay completely unchanged (in particular, be aware of not allowing new exceptions to occur). - if you want to backport a security bug fix to 2.5, ALWAYS consider 2.4 as well. They are in the same state, and should get the same care (2.3 is closed for good). Of course, it might be that the bug doesn't exist in 2.4. - ALWAYS notify security(a)python.org. For one thing, they might offer advise on how to proceed, but also, they might consider publishing an advisory, and/or notifying some CERT. Notification is in particular necessary if you are unfamiliar with security issues, how they get classified, and so on - so do ask the experts. (and no, I'm not one of them :-) Regards, Martin

2 1

GSoC ideas in need of mentors :)
by Daniel (ajax) Diniz 19 Mar '09

19 Mar '09

Hi, I'd like to propose a two housecleaning GSoC ideas for discussion, they both need mentors. First, Mark's suggested overhaul of the struct module, along with finishing PEP 3118 if possible. Second, a clean up of the socket module, along with checking its usage in the stdlib if possible. Details below. IIUC, any potential mentors for ideas from http://wiki.python.org/moin/CodingProjectIdeas would help the PSF by declaring availability at http://wiki.python.org/moin/SummerOfCode/2009. And, mentioned in another thread, snakebite ideas: http://tinyurl.com/beyond-buildbot :) Regards, Daniel --- Overhaul struct + PEP 3118 There are many open issues for the struct module, and a suggestion that many others fixes should happen. The problems include inconsistencies in input handling and backwards-compatibility code that should be gone from 3.x. As PEP 3118 also requires a few changes in struct, finishing the memoryview object implementation and backporting it to 2.7 could be part of this project. To tackle this, a student should know C and have some familiarity with the CPython codebase. The proposal should include an overview of open issues and, if possible, of problems in current code. Mentors for this task should have a good understanding of the struct module, the buffer interface and PEP 3118. --- Clean up and improve the socket module The socket module is the foundation of many important parts of the stdlib. It has many open issues and RFEs, with many more being indirectly dependent on it. Major pain areas are cross-platform problems, shortcomings for a few use cases and some missing bits from the API (e.g. recvall(), sendmsg() and recvmsg()). If these can be solved quickly, going through the uses of the socket module in the stdlib to would make this project even more useful. This project has some ugly cross-platform needs, but these can be handled by the student and the mentor together (maybe snakebite could help?). For students wanting to work on this, knowing C is a must, being familiar with CPython and the stdlib would be desirable. Having some prior knowledge of POSIX and Windows interfaces the socket module uses would be a nice perk. Mentors should be able to help the student to test their code on many different platforms. Knowing the socket API in different platforms would be desirable.

1 0

what's new in 3.1 anyone?
by Benjamin Peterson 18 Mar '09

18 Mar '09

It seems Andrew will be doing "What's new in Python 2.7?" again, but we don't seem to have a volunteer to do the 3.1 version? Would anyone like to volunteer? -- Regards, Benjamin

2 1

Re: [Python-Dev] In-place operators
by Hrvoje Niksic 18 Mar '09

18 Mar '09

Martin v. Löwis wrote: > Certainly, the doc string is wrong: > > isub(a, b) -- Same as a -= b. > > That's not quite the same - you would have to write > > a = isub(a, b) -- Same as a -= b. It seems a perfectly fine solution is simply to fix the docstring, exactly like that: a = isub(a, b) -- Same as a -= b. This both corrects the error when using isub with immutable types and educates user as to how a -= b actually works.

1 0

In-place operators
by Raymond Hettinger 18 Mar '09

18 Mar '09

Does anyone think it was not a good idea to put in-place operations in the operator module? For some objects, they don't map() as well as their regular counterparts. Some in-place operations rely on the interpreter to take care of the actual assignment. I've not yet seen good use cases for operator.isub() for example. Raymond

7 10

py3k: accept unicode for 'c' and byte for 'C' in getarg?
by Victor Stinner 17 Mar '09

17 Mar '09

Hi, I realised with the issue #3446 that getarg('c') (get a byte) accepts not only a byte string of 1 byte, but also an unicode string of 1 character (if the character code is in [0; 255]). I don't think that it's a good idea to accept unicode here. Example: b"x".center(5, "\xe9") should be a TypeError. The "C" format (get a character) has the opposite problem: it accepts both byte and unicode, whereas byte should be rejected. Example: mmap.write_byte('é') should be a TypeError. The problem was already discuss in the email thread "What type of object mmap.read_byte should return on py3k?" started by Hirokazu Yamamoto related to issue #5391. Short history: - r55109: Guido changes 'c' format to accept unicode (struni branch). getarg('c') => char accepts byte and character - r56044: walter.doerwald changes the 'c' format to return an int (an unicode character) for datetime.datetime.isoformat(). getarg('c') => int accepts byte and character - r56140: Revert r56044 and creates 'C' format getarg('c') => char accepts byte and character getarg('C') => int accepts byte and character So we have: - getarg('c') -> one byte (integer in [0; 255]) - getarg('C') -> one character (code in [0; INTMAX]) Note: Why not using Py_UNICODE instead of int? Usage of "C" format: datetime.datetime.isoformat(sep) array.array(type, data): type Usage of "c" format: msvcrt.putch(char) msvcrt.ungetch(char) <mmap object>.write_byte(char) -- Victor Stinner aka haypo http://www.haypocalc.com/blog/

2 4

python-3000 is still mentioned on the mailing lists page
by R. David Murray 17 Mar '09

17 Mar '09

I just noticed that the python-3000 list is still mentioned on http://www.python.org/community/lists/. I searched around a bit but it isn't obvious to me where other than here I should report this, so I'm reporting it here :). -- R. David Murray http://www.bitdance.com

2 1

Ext4 data loss
by Christian Heimes 16 Mar '09

16 Mar '09

Multiple blogs and news sites are swamped with a discussion about ext4 and KDE 4.0. Theodore Ts'o - the developer of ext4 - explains the issue at https://bugs.edge.launchpad.net/ubuntu/+source/linux/+bug/317781/comments/54. Python's file type doesn't use fsync() and be the victim of the very same issue, too. Should we do anything about it? Christian

29 77

Re: [Python-Dev] Python 2.6.2 and 3.0.2
by Jason R. Coombs 14 Mar '09

14 Mar '09

I'm still holding my breath for Python 2.6.2, which fixes a Windows DLL linking issue that was already fixed in 3.0.1. Obviously, the proposed schedule has passed, but I would prefer a release sooner than later. Of course, that's just my preference. Regards, Jason > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Thinking again about 3.0.2. > > If we'd like to do bug fix releases before Pycon, I suggest Monday March > 9th for code freeze and tagging. That would mean a Tuesday March 10th > release. > > What do you think?

2 1

Fwd: installation with ubuntu 8.04
by John Wagner 13 Mar '09

13 Mar '09

---------- Forwarded message ---------- From: <python-3000-owner(a)python.org> Date: Thu, Mar 12, 2009 at 8:32 PM Subject: installation with ubuntu 8.04 To: gnujohn(a)gmail.com This mailing list is closed now. Please use python-dev(a)python.org instead. ---------- Forwarded message ---------- From: John Wagner <gnujohn(a)gmail.com> To: python-3000(a)python.org Date: Thu, 12 Mar 2009 20:32:55 -0700 Subject: installation with ubuntu 8.04 I am sorry to bother about this but I've asked for help from Canonical with no reply. They seem reluctant to update Python beyond version 2.5; I'm trying to install 3.0.1. I'm a newb, and have tried rtfm--does someone have the incantation required? Thanks v. much in advance. -- John Wagner Los Angeles -- John Wagner Los Angeles

5 5