Mailman 3 January 2012 - Python-Dev

Proposed PEP on concurrent programming support
by Jim Jewett Jan. 4, 2012

Jan. 4, 2012

(I've added back python-ideas, because I think that is still the appropriate forum.) >.... A new > suite type - the ``transaction`` will be added to the language. The > suite will have the semantics discussed above: modifying an object in > the suite will trigger creation of a thread-local shallow copy to be > used in the Transaction. Further modifications of the original will > cause all existing copies to be discarded and the transaction to be > restarted. ... How will … [View More]

1 0

PEP 7 clarification request: braces
by Nick Coghlan Jan. 4, 2012

Jan. 4, 2012

I've been having an occasional argument with Benjamin regarding braces in 4-line if statements: if (cond) statement; else statement; vs. if (cond) { statement; } else { statement; } He keeps leaving them out, I occasionally tell him they should always be included (most recently this came up when we gave conflicting advice to a patch contributor). He says what he's doing is OK, because he doesn't consider the example in PEP 7 as explicitly disallowing it, I think it'… [View More]

23 43

Re: [Python-Dev] cpython: Add a new PyUnicode_Fill() function
by Antoine Pitrou Jan. 3, 2012

Jan. 3, 2012

> +.. c:function:: int PyUnicode_Fill(PyObject *unicode, Py_ssize_t start, \ > + Py_ssize_t length, Py_UCS4 fill_char) > + > + Fill a string with a character: write *fill_char* into > + ``unicode[start:start+length]``. > + > + Fail if *fill_char* is bigger than the string maximum character, or if the > + string has more than 1 reference. > + > + Return the number of written character, or return ``-1`` and raise an > + exception … [View More]

2 1

That depends on what the meaning of "is" is (was Re: http://mail.python.org/pipermail/python-dev/2011-December/115172.html)
by PJ Eby Jan. 3, 2012

Jan. 3, 2012

On Sun, Jan 1, 2012 at 10:28 PM, Jim Jewett <jimjjewett(a)gmail.com> wrote: > Given the wording requiring a real dictionary, I would have assumed > that it was OK (if perhaps not sensible) to do pointer arithmetic and > access the keys/values/hashes directly. (Though if the breakage was > between python versions, I would feel guilty about griping too > loudly.) > If you're going to be a language lawyer about it, I would simply point out that all the spec requires is … [View More]

2 3

Re: [Python-Dev] cpython: fix some possible refleaks from PyUnicode_READY error conditions
by Antoine Pitrou Jan. 2, 2012

Jan. 2, 2012

On Mon, 02 Jan 2012 16:00:50 +0100 benjamin.peterson <python-checkins(a)python.org> wrote: > http://hg.python.org/cpython/rev/d5cda62d0f8c > changeset: 74236:d5cda62d0f8c > user: Benjamin Peterson <benjamin(a)python.org> > date: Mon Jan 02 09:00:30 2012 -0600 > summary: > fix some possible refleaks from PyUnicode_READY error conditions > > files: > Objects/unicodeobject.c | 80 ++++++++++++++++++++-------- > 1 files changed, 56 … [View More]

2 1

[Python-Dev] http://mail.python.org/pipermail/python-dev/2011-December/115172.html
by Jim Jewett Jan. 1, 2012

Jan. 1, 2012

In http://mail.python.org/pipermail/python-dev/2011-December/115172.html, P. J. Eby wrote: > On Sat, Dec 31, 2011 at 7:03 AM, Stephen J. Turnbull <stephen at xemacs.org> wrote: >> While the dictionary probe has to start with a hash for backward >> compatibility reasons, is there a reason the overflow strategy for >> insertion has to be buckets containing lists? How about >> double-hashing, etc? > This won't help, because the keys still have the same hash … [View More]

4 5

Hash collision security issue (now public)
by Jim Jewett Jan. 1, 2012

Jan. 1, 2012

Victor Stinner wrote in <http://mail.python.org/pipermail/python-dev/2012-January/115198.html> > If we want to protect a website against this attack for example, we must > suppose that the attacker can inject arbitrary data and can get > (indirectly) the result of hash(str) (e.g. with the representation of a > dict in a traceback, with a JSON output, etc.). (1) Is it common to hash non-string input? Because generating integers that collide for certain dict sizes is pretty … [View More]

1 0

Hash collision security issue (now public)
by Jim Jewett Jan. 1, 2012

Jan. 1, 2012

Paul McMillan in <http://mail.python.org/pipermail/python-dev/2012-January/115183.html> wrote: > Guido van Rossum wrote: >> Hm. I'm not sure I like the idea of extra arithmetic for every character >> being hashed. > the collision generator doesn't necessarily vary the length of the > string. Additionally, if we don't vary based on all the letters in the > string, an attacker can fix the characters that we do use and generate > colliding strings around them. … [View More]

1 0

Hash collision security issue (now public)
by Jim Jewett Jan. 1, 2012

Jan. 1, 2012

Steven D'Aprano (in <http://mail.python.org/pipermail/python-dev/2011-December/115162.html>) wrote: > By compile-time, do you mean when the byte-code is compilated, i.e. just > before runtime, rather than a switch when compiling the Python executable from > source? No. I really mean when the C code is initially compiled to produce an python executable. The only reason we're worrying about this is that an adversary may force worst-case performance. If the python instance isn'… [View More]

1 0