Mailman 3 April 2012 - Python-Dev

PEP 412 Key-Sharing Dictionary
by Mark Shannon April 12, 2012

April 12, 2012

I would like to get the new shared-keys dictionary implementation committed, or rejected or further reviewed, if necessary. It seems to have got a bit stuck at the moment. As far as I am concerned it is ready to go in. Memory usage is reduced, speed is roughly unchanged, and it passes all the tests (except for 1 test in test_pprint which relies on dict/set ordering, see http://bugs.python.org/issue13907) Cheers, Mark.

4 3

Re: [Python-Dev] cpython: use assertWarns instead of check_warnings - Issue14341
by Georg Brandl April 12, 2012

April 12, 2012

On 11.04.2012 17:06, senthil.kumaran wrote: > http://hg.python.org/cpython/rev/751c7b81f6ee > changeset: 76241:751c7b81f6ee > parent: 76232:8a47d2322df0 > user: Senthil Kumaran<senthil(a)uthcode.com> > date: Wed Apr 11 23:05:49 2012 +0800 > summary: > use assertWarns instead of check_warnings - Issue14341 > > files: > Lib/test/test_urllib2.py | 16 +++++++++------- > 1 files changed, 9 insertions(+), 7 deletions(-) > > &… [View More]

2 1

[RELEASED] Python 2.6.8, 2.7.3, 3.1.5, and 3.2.3
by Benjamin Peterson April 12, 2012

April 12, 2012

We're bursting with enthusiasm to announce the immediate availability of Python 2.6.8, 2.7.3, 3.1.5, and 3.2.3. These releases included several security fixes. Note: Virtualenvs created with older releases in the 2.6, 2.7, 3.1, or 3.2 series may not work with these bugfix releases. Specifically, the os module may not appear to have a urandom function. This is a virtualenv bug, which can be solved by recreating the broken virtualenvs with the newer Python versions. The main impetus for these … [View More]releases is fixing a security issue in Python's hash based types, dict and set, as described below. Python 2.7.3 and 3.2.3 include the security patch and the normal set of bug fixes. Since Python 2.6 and 3.1 are maintained only for security issues, 2.6.8 and 3.1.5 contain only various security patches. The security issue exploits Python's dict and set implementations. Carefully crafted input can lead to extremely long computation times and denials of service. [1] Python dict and set types use hash tables to provide amortized constant time operations. Hash tables require a well-distributed hash function to spread data evenly across the hash table. The security issue is that an attacker could compute thousands of keys with colliding hashes; this causes quadratic algorithmic complexity when the hash table is constructed. To alleviate the problem, the new releases add randomization to the hashing of Python's string types (bytes/str in Python 3 and str/unicode in Python 2), datetime.date, and datetime.datetime. This prevents an attacker from computing colliding keys of these types without access to the Python process. Hash randomization causes the iteration order of dicts and sets to be unpredictable and differ across Python runs. Python has never guaranteed iteration order of keys in a dict or set, and applications are advised to never rely on it. Historically, dict iteration order has not changed very often across releases and has always remained consistent between successive executions of Python. Thus, some existing applications may be relying on dict or set ordering. Because of this and the fact that many Python applications which don't accept untrusted input are not vulnerable to this attack, in all stable Python releases mentioned here, HASH RANDOMIZATION IS DISABLED BY DEFAULT. There are two ways to enable it. The -R commandline option can be passed to the python executable. It can also be enabled by setting an environmental variable PYTHONHASHSEED to "random". (Other values are accepted, too; pass -h to python for complete description.) More details about the issue and the patch can be found in the oCERT advisory [1] and the Python bug tracker [2]. Another related security issue fixed in these releases is in the expat XML parsing library. expat had the same hash security issue detailed above as Python's core types. The hashing algorithm used in the expat library is now randomized. A few other security issues were fixed. They are described on the release pages below. These releases are production releases. Downloads are at http://python.org/download/releases/2.6.8/ http://python.org/download/releases/2.7.3/ http://python.org/download/releases/3.1.5/ http://python.org/download/releases/3.2.3/ As always, please report bugs to http://bugs.python.org/ Happy-to-put-hash-attack-issues-behind-them-ly yours, The Python release team Barry Warsaw (2.6), Georg Brandl (3.2), and Benjamin Peterson (2.7 and 3.1) [1] http://www.ocert.org/advisories/ocert-2011-003.html [2] http://bugs.python.org/issue13703 [View Less]

3 2

Failed issue tracker submission
by Python tracker April 11, 2012

April 11, 2012

An unexpected error occurred during the processing of your message. The tracker administrator is being notified. Return-Path: <python-dev(a)python.org> X-Original-To: report(a)bugs.python.org Delivered-To: roundup+tracker(a)psf.upfronthosting.co.za Received: from mail.python.org (mail.python.org [82.94.164.166]) by psf.upfronthosting.co.za (Postfix) with ESMTPS id E4BA91C99B for <report(a)bugs.python.org>; Thu, 12 Apr 2012 02:41:05 +0200 (CEST) Received: from albatross.python.org … [View More](localhost [127.0.0.1]) by mail.python.org (Postfix) with ESMTP id 3VSjwK4VJXzMYx for <report(a)bugs.python.org>; Thu, 12 Apr 2012 02:41:05 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=python.org; s=200901; t=1334191265; bh=lo47e+asT0uJCAqRxhHod6Ew5FD2UVZ/Hv0bVhpeOUw=; h=Date:Message-Id:Content-Type:MIME-Version: Content-Transfer-Encoding:From:To:Subject; b=FsM+hBGbG0zAjavHnV3td7hqCskSq6wdTfPSNViUvv+CdHDk2DvCJe20fZ430xpBb gn+4wlvxHKY9rHfNvO+XzyZLkec7f6XD4h7fFcztlkTJPPscZhKwgICtmO6NpfVyi8 ITZ9D8vkNOrSAp8Z9+dlmrDELiKwWuQ2S9dOHIyQ= Received: from localhost (HELO mail.python.org) (127.0.0.1) by albatross.python.org with SMTP; 12 Apr 2012 02:41:05 +0200 Received: from dinsdale.python.org (svn.python.org [IPv6:2001:888:2000:d::a4]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.python.org (Postfix) with ESMTPS for <report(a)bugs.python.org>; Thu, 12 Apr 2012 02:41:05 +0200 (CEST) Received: from localhost ([127.0.0.1] helo=dinsdale.python.org ident=hg) by dinsdale.python.org with esmtp (Exim 4.72) (envelope-from <python-dev(a)python.org>) id 1SI85x-00062T-Eb for report(a)bugs.python.org; Thu, 12 Apr 2012 02:41:05 +0200 Date: Thu, 12 Apr 2012 02:41:05 +0200 Message-Id: <E1SI85x-00062T-Eb(a)dinsdale.python.org> Content-Type: text/plain; charset="utf8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: python-dev(a)python.org To: report(a)bugs.python.org Subject: [issue14552] TmV3IGNoYW5nZXNldCBmMjVmYjdlMWQwNzYgYnkgUiBEYXZpZCBNdXJyYXkgaW4gYnJhbmNoICcz LjInOgojMTQ1NTI6IHJlbW92ZSByZWR1bmRhbnQgd29yZGluZyBpbiAndGVzdCcgZG9jcy4KaHR0 cDovL2hnLnB5dGhvbi5vcmcvY3B5dGhvbi9yZXYvZjI1ZmI3ZTFkMDc2CgoKTmV3IGNoYW5nZXNl dCBiZDM1M2YxMmMwMDcgYnkgUiBEYXZpZCBNdXJyYXkgaW4gYnJhbmNoICdkZWZhdWx0JzoKTWVy Z2UgZG9jIGZpeGVzICMxNDU1MyBhbmQgIzE0NTUyLgpodHRwOi8vaGcucHl0aG9uLm9yZy9jcHl0 aG9uL3Jldi9iZDM1M2YxMmMwMDcKCgpOZXcgY2hhbmdlc2V0IGQ2MGVmMTQxZTA5MCBieSBSIERh dmlkIE11cnJheSBpbiBicmFuY2ggJzIuNyc6CiMxNDU1MjogcmVtb3ZlIHJlZHVuZGFudCB3b3Jk aW5nIGluICd0ZXN0JyBkb2NzLgpodHRwOi8vaGcucHl0aG9uLm9yZy9jcHl0aG9uL3Jldi9kNjBl ZjE0MWUwOTAK [View Less]

1 0

Experimenting with STM on CPython
by Armin Rigo April 11, 2012

April 11, 2012

Hi all, This is an update on the (so far PyPy-only) project of adding "Automatic Mutual Exclusion" to Python, via STM (Software Transactional Memory). For the motivation, see here: http://morepypy.blogspot.com/2012/03/call-for-donations-for-software.html """The point is that [with STM/AME] your program is always correct, and can be tweaked to improve performance. This is the opposite from what explicit threads and locks give you, which is a performant program which you need to tweak to remove … [View More]

4 7

Possible change to logging.handlers.SysLogHandler
by Vinay Sajip April 11, 2012

April 11, 2012

There is a problem with the way logging.handlers.SysLogHandler works when presented with Unicode messages. According to RFC 5424, Unicode is supposed to be sent encoded as UTF-8 and preceded by a BOM. However, the current handler implementation puts the BOM at the start of the formatted message, and this is wrong in scenarios where you want to put some additional structured data in front of the unstructured message part; the BOM is supposed to go after the structured part (which, therefore, has … [View More]

2 3

Meaning of the f_tstate field in the frame object
by Mark Shannon April 11, 2012

April 11, 2012

What is the purpose of the f_tstate field in the frame object? It holds a borrowed reference to the threadstate in which the frame was created. If PyThreadState_GET()->frame->f_state == PyThreadState_GET() then it is redundant. But what if PyThreadState_GET()->frame->f_state != PyThreadState_GET(), which can happen when a generator is created in one thread and called in another? Removing the f_tstate field provides a clean fix to http://bugs.python.org/issue14432, but is it safe … [View More]

1 0

PEP 418 is too divisive and confusing and should be postponed
by Steven D'Aprano April 10, 2012

April 10, 2012

Judging by the hundreds of emails regarding PEP 418, the disagreements about APIs, namings, and even what characteristics clocks should have, I believe that the suggestion is too divisive (and confusing!) to be accepted or rejected at this time. Everyone has a different opinion, everyone believes their opinion holds for the majority, and it isn't practical for anyone to read the entire discussion. I propose for Python 3.3: 1) the os module should expose lightweight wrappers around … [View More]

19 52

this is why we shouldn't call it a "monotonic clock" (was: PEP 418 is too divisive and confusing and should be postponed)
by Zooko Wilcox-O'Hearn April 10, 2012

April 10, 2012

On Thu, Apr 5, 2012 at 7:14 PM, Greg Ewing <greg.ewing(a)canterbury.ac.nz> wrote: > > This is the strict mathematical meaning of the word "monotonic", but the way it's used in relation to OS clocks, it seems to mean rather more than that. Yep. As far as I can tell, nobody has a use for an unsteady, monotonic clock. There seem to be two groups of people: 1. Those who think that "monotonic clock" means a clock that never goes backwards. These people are in the majority. After all, … [View More]

11 35

Upgrading tcl/tk deps
by Brian Curtin April 10, 2012

April 10, 2012

Can someone let me in on the process to upgrade tcl and tk on svn.python.org? For the VS2010 port it looks like I need to upgrade since the 8.5.9 versions do not work. They use link options that choke on 2010. Taking 8.5.11, which is the current release, seems to work out alright so far. It seems as easy as downloading the tarball and checking that in. Am I missing any official process here?

5 7