Re: [Python-ideas] Adding a safe alternative to pickle in the standard library

On Feb 21, 2013, at 9:24, Antoine Pitrou wrote:

Le Thu, 21 Feb 2013 17:22:47 +0000, Mark Hackett a écrit :

...

On Thursday 21 Feb 2013, Devin Jeanpierre wrote:

...

On Thu, Feb 21, 2013 at 10:50 AM, Dustin J. Mitchell wrote:

...

When you put something in the stdlib and call it "safe", even with caveats, people will make even more brazen mistakes than with a documented-unsafe tool like pickle.

Then how do we improve on the status quo? The best situation can't possibly be one in which the standard serialization tool allows for code injection exploits out of the box, by default, and where there is no reasonable alternative in the stdlib without such problems.

By writing your application for its needs, not the needs of 10000 programs yet to be written and making the wrong assumption and putting it in a stdlib.

If every problem could be solved with a stdlib call, there'd only have to be one programmer in the world...

You're forgetting the millions of stdlib programmers :-)

This is one of those "any sufficiently powerful language becomes lisp" things, isn't it. :)

Regards

Antoine.

_______________________________________________ Python-ideas mailing list Python-ideas@python.org http://mail.python.org/mailman/listinfo/python-ideas