On 28/03/2019 23.35, Steve Dower wrote:
Time is short, but I'm hoping to get PEP 578 (formerly PEP 551) into Python 3.8. Here's the current text for review and comment before I submit to the Steering Council.
The formatted text is at https://www.python.org/dev/peps/pep-0578/ (update just pushed, so give it an hour or so, but it's fundamentally the same as what's there)
No Discourse post, because we don't have a python-dev equivalent there yet, so please reply here for this one.
Implementation is at https://github.com/zooba/cpython/tree/pep-578/ and my backport to 3.7 (https://github.com/zooba/cpython/tree/pep-578-3.7/) is already getting some real use (though this will not be added to 3.7, unless people *really* want it, so the backport is just for reference).
(memory dump before I go to bed)
Steve Grubb from Red Hat security pointed me to some interesting things . For instance there is some work on a new O_MAYEXEC flag for open(). Steve came to similar conclusions like we, e.g. streaming code from stdin is insecure.
I think it would be also beneficial to have auditing events for the import system to track when sys.path or import loaders are changed.