Mailman 3 January 2012 - Python-Dev

usefulness of Python version of threading.RLock
by Charles-François Natali Jan. 8, 2012

Jan. 8, 2012

Hi, Issue #13697 (http://bugs.python.org/issue13697) deals with a problem with the Python version of threading.RLock (a signal handler which tries to acquire the same RLock is called right at the wrong time) which doesn't affect the C version. Whether such a use case can be considered good practise or the best way to fix this is not settled yet, but the question that arose to me is: "why do we have both a C and Python version?". Here's Antoine answer (he suggested to me to bring this up on … [View More]

6 10

What's required to keep OS/2 support in Python 3.3
by Paul Smedley Jan. 8, 2012

Jan. 8, 2012

Hi All, I'm a little slow in responding to http://blog.python.org/2011/05/python-33-to-drop-support-for-os2.html, but I'm interested in stepping up to help maintain OS/2 support in Python 3.3 and above. I've been building Python 2.x for a while, and currently have binaries of 2.6.5 available from http://os2ports.smedley.info Unlike Andrew Mcintyre, I'm using libc for development (http://svn.netlabs.org/libc) rather than emx. libc is still being developed whereas emx hasn't been … [View More]

2 7

Re: [Python-Dev] [Python-checkins] cpython: Issue #9993: When the source and destination are on different filesystems,
by Nick Coghlan Jan. 7, 2012

Jan. 7, 2012

On Sun, Jan 8, 2012 at 4:00 AM, Antoine Pitrou <solipsis(a)pitrou.net> wrote: > I'm not sure it was *well* defined (or even defined at all). It seems > more of a by-product of the implementation. It's not only different > from mv, but it's inconsistent with itself (the semantics are different > depending on whether the paths are on the same filesystem or not; > also, it copied the *file* but erased the *link*). Yeah, Hynek's explanation pointing out the existing … [View More]

1 0

Hash collision security issue (now public)
by Michael Foord Jan. 7, 2012

Jan. 7, 2012

Hello all, A paper (well, presentation) has been published highlighting security problems with the hashing algorithm (exploiting collisions) in many programming languages Python included: http://events.ccc.de/congress/2011/Fahrplan/attachments/2007_28C3_Effective… Although it's a security issue I'm posting it here because it is now public and seems important. The issue they report can cause (for example) handling an http post to consume horrible amounts of cpu. For Python the figures they … [View More]

43 136

Re: [Python-Dev] [Python-checkins] cpython: Issue #9993: When the source and destination are on different filesystems,
by Nick Coghlan Jan. 7, 2012

Jan. 7, 2012

On Sat, Jan 7, 2012 at 5:17 AM, antoine.pitrou <python-checkins(a)python.org> wrote: > http://hg.python.org/cpython/rev/1ea8b7233fd7 > changeset: 74288:1ea8b7233fd7 > user: Antoine Pitrou <solipsis(a)pitrou.net> > date: Fri Jan 06 20:16:19 2012 +0100 > summary: > Issue #9993: When the source and destination are on different filesystems, > and the source is a symlink, shutil.move() now recreates a … [View More]

2 1

"Sort attacks" (was Re: Hash collision security issue (now public))
by Tim Peters Jan. 6, 2012

Jan. 6, 2012

I can't find it now, but I believe Marc-Andre mentioned that CPython's list.sort() was vulnerable to attack too, because of its O(n log n) worst-case behavior. I wouldn't worry about that, because nobody could stir up anguish about it by writing a paper ;-) 1. O(n log n) is enormously more forgiving than O(n**2). 2. An attacker need not be clever at all: O(n log n) is not only sort()'s worst case, it's also its _expected_ case when fed randomly ordered data. 3. It's provable that no … [View More]

1 0

Hash collision security issue (now public)
by Jim Jewett Jan. 6, 2012

Jan. 6, 2012

In http://mail.python.org/pipermail/python-dev/2012-January/115350.html, Mark Shannon wrote: > The minimal proposed change of seeding the hash from a global value (a > single memory read and an addition) will have such a minimal performance > effect that it will be undetectable even on the most noise-free testing > environment. (1) Is it established that this (a single initial add, with no per-loop operations) would be sufficient? I thought that was in the gray area of "We don't … [View More]

3 2

Summary of Python tracker Issues
by Python tracker Jan. 6, 2012

Jan. 6, 2012

ACTIVITY SUMMARY (2011-12-30 - 2012-01-06) Python tracker at http://bugs.python.org/ To view or respond to any of the issues listed below, click on the issue. Do NOT respond to this message. Issues counts and deltas: open 3180 ( +2) closed 22322 (+34) total 25502 (+36) Open issues with patches: 1366 Issues opened (24) ================== #13685: argparse does not sanitize help strings for % signs http://bugs.python.org/issue13685 opened by Jeff.Yurkiw #13686: Some notes on the … [View More]

1 0

Re: [Python-Dev] [Python-checkins] cpython (2.7): Issue #12042: a queue is only used to retrive results; preliminary patch by
by Sandro Tosi Jan. 6, 2012

Jan. 6, 2012

On Thu, Jan 5, 2012 at 23:45, Terry Reedy <tjreedy(a)udel.edu> wrote: > On 1/5/2012 1:51 PM, sandro.tosi wrote: >> >> http://hg.python.org/cpython/rev/3353f9747a39 >> changeset: 74282:3353f9747a39 >> branch: 2.7 > > >> Doc/whatsnew/2.6.rst | 4 ++-- > > > should that have been whatsnew/2.7.rst? The wording correction was in the 2.6 what's new, when describing multiprocessing (which was added in 2.6). -… [View More]

1 0

RNG in the core
by Christian Heimes Jan. 4, 2012

Jan. 4, 2012

Hello, all proposed fixes for a randomized hashing function raise and fall with a good random number generator to feed the random seed. The seed must be created very early in the startup phase of the interpreter, preferable before the basic types are initialized. CPython already have multiple sources for random data (win32_urandom in Modules/posixmodule.c, urandom in Lib/os.py, Mersenne twister in Modules/_randommodule.c). However we can't use them because they are wrapped inside Python … [View More]

8 13