[issue13703] Hash collision security issue

Frank Sievertsen added the comment: >> That's true. But without the suffix, I can pretty easy and efficient >> guess the prefix by just seeing the result of a few well-chosen and >> short repr(dict(X)). I suppose that's harder with the suffix. > Since the hash function is known, it doesn't make

[issue13405] Add DTrace probes

Dave Malcolm added the comment: On Fri, 2012-01-20 at 04:46 +, Benjamin Peterson wrote: > Benjamin Peterson added the comment: > > As great as a tool it maybe, it's still only available on a minority > platform. So I couldn't really try it. FWIW, the analogous systemtap patch works great

[issue13405] Add DTrace probes

Benjamin Peterson added the comment: As great as a tool it maybe, it's still only available on a minority platform. So I couldn't really try it. -- ___ Python tracker ___ _

[issue13405] Add DTrace probes

John Levon added the comment: I would strongly suggest those of you who are not "getting it" to actually try Jesus's patch out in some real scenarios. You'll quickly see what the benefit is. I think some of you are missing that it's a *not* just about performance: it's a system comprehension

[issue13806] Audioop decompression frames size check fix

Changes by Oleg Plakhotnyuk : Added file: http://bugs.python.org/file24285/audioop_size_check.patch ___ Python tracker ___ ___ Python-bugs-lis

[issue13806] Audioop decompression frames size check fix

Changes by Oleg Plakhotnyuk : Removed file: http://bugs.python.org/file24284/audioop_size_check.patch ___ Python tracker ___ ___ Python-bugs-l

[issue13806] Audioop decompression frames size check fix

Oleg Plakhotnyuk added the comment: Yep, you're right. Didn't noticed audioop_check_size() function at first. The fact that audioop accepts unicode strings seems weird to me too. I've replaced strings with bytes in tests. However, I'm afraid to add restrictions to library itself because of ba

[issue13405] Add DTrace probes

Glyph Lefkowitz added the comment: Charles-François: > Also, I must admit I'm quite skeptical about the real benefit of explicit probes for user-land, especially for CPython which isn't used for performance-critical systems... I beg to differ. CPython is totally used on performance-critical sy

[issue12949] Documentation of PyCode_New() lacks kwonlyargcount argument

Meador Inge added the comment: Fixed. Thanks for the report Stefan. -- nosy: +meador.inge resolution: -> fixed stage: needs patch -> committed/rejected status: open -> closed ___ Python tracker _

[issue13806] Audioop decompression frames size check fix

Changes by Oleg Plakhotnyuk : Removed file: http://bugs.python.org/file24260/audioop_size_check.patch ___ Python tracker ___ ___ Python-bugs-l

[issue12949] Documentation of PyCode_New() lacks kwonlyargcount argument

Roundup Robot added the comment: New changeset b22a35c14a91 by Meador Inge in branch '3.2': Issue #12949: Document the kwonlyargcount argument for the PyCode_New C API function. http://hg.python.org/cpython/rev/b22a35c14a91 New changeset 218b167ff521 by Meador Inge in branch 'default': Issue #

[issue13405] Add DTrace probes

Jesús Cea Avión added the comment: NOTE to myself: In OpenIndiana we could have this error: """ dtrace: failed to compile script ./Include/phelper.d: Preprocessor not found """ In that case, we must install the C preprocessor: """ pfexec pkg install cpp """ I confirm that current 3.3 patch w

[issue12949] Documentation of PyCode_New() lacks kwonlyargcount argument

Changes by Meador Inge : -- keywords: +easy stage: -> needs patch versions: -Python 3.1 ___ Python tracker ___ ___ Python-bugs-list

[issue13405] Add DTrace probes

Benjamin Peterson added the comment: I'm -1 on this patch for essentially the same reasons as Charles-François. It introduces a lot of code (and hacks!) in critical pathways of the interpreter. Someone would have to be constantly maintaining and testing it. In return, what do we get? ---

[issue13405] Add DTrace probes

Jesús Cea Avión added the comment: Code ready for commit. Please, review. After the first commit, I will try to make it compatible with MacOS and FreeBSD. Current target is Solaris and derivatives (OpenIndiana, for instance) Stan Cox, if you want systemtap compatibility at this moment, pleas

[issue13405] Add DTrace probes

Changes by Jesús Cea Avión : Removed file: http://bugs.python.org/file23921/43d1a819a63d.diff ___ Python tracker ___ ___ Python-bugs-list mail

[issue13807] logging.Handler.handlerError() may raise AttributeError in traceback.print_exception()

Changes by Vinay Sajip : -- assignee: -> vinay.sajip nosy: +vinay.sajip ___ Python tracker ___ ___ Python-bugs-list mailing list Unsu

[issue13405] Add DTrace probes

Changes by Jesús Cea Avión : Removed file: http://bugs.python.org/file23920/f73be85b9a7e.diff ___ Python tracker ___ ___ Python-bugs-list mail

[issue13405] Add DTrace probes

Changes by Jesús Cea Avión : Added file: http://bugs.python.org/file24283/f86bb02fd8f4.diff ___ Python tracker ___ ___ Python-bugs-list mailin

[issue13405] Add DTrace probes

Changes by Jesús Cea Avión : Added file: http://bugs.python.org/file24282/f86bb02fd8f4.diff ___ Python tracker ___ ___ Python-bugs-list mailin

[issue13405] Add DTrace probes

Changes by Jesús Cea Avión : Added file: http://bugs.python.org/file24281/5458412752d5.diff ___ Python tracker ___ ___ Python-bugs-list mailin

[issue10278] add time.wallclock() method

Roundup Robot added the comment: New changeset 8502a9236c2e by Victor Stinner in branch 'default': Issue #10278: Be more explicit in tests than wallclock() is monotonic (cannot http://hg.python.org/cpython/rev/8502a9236c2e -- ___ Python tracker

[issue13828] Further improve casefold documentation

Benjamin Peterson added the comment: It's a bit unfriendly to launch into discussion of "compatiblity caseless matching" when the new reader probably has no idea what "compatibility-equivalence" is. -- ___ Python tracker

[issue13703] Hash collision security issue

STINNER Victor added the comment: > Since the hash function is known, it doesn't make things much > harder. Without suffix you just need hash('') to find out what > the prefix is. With suffix, two values are enough. With my patch, hash('') always return zero. I don't remember who asked me to do

[issue13811] In str.format, if invalid fill and alignment are specified, the text of the ValueError message is misleading.

Roundup Robot added the comment: New changeset 5c33ebb50702 by Eric V. Smith in branch 'default': Improve exception text. Closes issue 13811. http://hg.python.org/cpython/rev/5c33ebb50702 -- nosy: +python-dev resolution: -> fixed stage: needs patch -> committed/rejected status: open ->

[issue13703] Hash collision security issue

Marc-Andre Lemburg added the comment: Frank Sievertsen wrote: > > Frank Sievertsen added the comment: > >> The suffix only introduces a constant change in all hash values >> output, so even if you don't know the suffix, you can still >> generate data sets with collisions by just having the pr

[issue13763] Potentially hard to understand wording in devguide

Terry J. Reedy added the comment: I do not much like sentences starting with lowercase, so I combined our sentences. The result is good enough, I think. Closing. -- assignee: -> terry.reedy resolution: -> fixed stage: patch review -> committed/rejected status: open -> closed ___

[issue13763] Potentially hard to understand wording in devguide

Roundup Robot added the comment: New changeset 081106c142ec by Terry Jan Reedy in branch 'default': #13763 Clarify 'hg' usage. http://hg.python.org/devguide/rev/081106c142ec -- nosy: +python-dev ___ Python tracker

[issue13832] tokenization assuming ASCII whitespace; missing multiline case

Benjamin Peterson added the comment: The tokenizer doesn't consider unicode spaces, either. -- resolution: -> fixed status: open -> closed ___ Python tracker ___ __

[issue13832] tokenization assuming ASCII whitespace; missing multiline case

Roundup Robot added the comment: New changeset 00c4efbf57c3 by Benjamin Peterson in branch 'default': check after comments, too (#13832) http://hg.python.org/cpython/rev/00c4efbf57c3 -- nosy: +python-dev ___ Python tracker

[issue13833] No documentation for PyStructSequence

New submission from Torsten Landschoff : While writing a C extension I wanted to create a namedtuple like object as os.statvfs and friends do. I was unable to find a simple way to do this from C and was wondering how the posixmodule does it. It turned out that there is a PyStructSequence type

[issue13020] structseq.c: refleak

Torsten Landschoff added the comment: +1 for the patch. All the error paths above the change do Py_DECREF(arg); return NULL; arg is initialized with PySequence_Fast, which returns a new reference. Hard to create a test case for this... -- nosy: +torsten __

[issue13832] tokenization assuming ASCII whitespace; missing multiline case

Changes by Antoine Pitrou : -- nosy: +benjamin.peterson ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe: http://

[issue13605] document argparse's nargs=REMAINDER

Roundup Robot added the comment: New changeset 1b481e76cd16 by Sandro Tosi in branch '2.7': Issue #13605: more meaningful example + fixes http://hg.python.org/cpython/rev/1b481e76cd16 New changeset d6e53d1f46eb by Sandro Tosi in branch '3.2': Issue #13605: more meaningful example + fixes http:/

[issue13605] document argparse's nargs=REMAINDER

Changes by Sandro Tosi : -- nosy: +sandro.tosi resolution: -> fixed stage: needs patch -> committed/rejected status: open -> closed versions: +Python 2.7, Python 3.2 ___ Python tracker

[issue13605] document argparse's nargs=REMAINDER

Roundup Robot added the comment: New changeset 35665f6f3674 by Sandro Tosi in branch '2.7': Issue #13605: add documentation for nargs=argparse.REMAINDER http://hg.python.org/cpython/rev/35665f6f3674 New changeset 6f3d55f5a31e by Sandro Tosi in branch '3.2': Issue #13605: add documentation for n

[issue11948] Tutorial/Modules - small fix to better clarify the modules search path

Terry J. Reedy added the comment: Definitely out-of-scope for the tutorial. I consider this akin to monkey patching imported modules. -- ___ Python tracker ___

[issue13832] tokenization assuming ASCII whitespace; missing multiline case

New submission from Jim Jewett : Parser/parsetok.c was recently changed (e.g. http://hg.python.org/cpython/rev/2bd7f40108b4 ) to raise an error if multiple statements were found in a single-statement compile call. It sensibly ignores trailing whitespace and comments. Unfortunately, (1) It

[issue13831] get method of multiprocessing.pool.Async should return full traceback

New submission from Faheem Mitha : The documentation in http://docs.python.org/library/multiprocessing.html#module-multiprocessing.pool says """class multiprocessing.pool.AsyncResult¶ The class of the result returned by Pool.apply_async() and Pool.map_async(). get([timeout]) Return the result

[issue13830] codecs error handler is called with a UnicodeDecodeError with the same args

New submission from Amaury Forgeot d'Arc : The script below shows that the error handler is always called with the same error object. The 'start', 'end', and 'reason' properties are correctly updated, but the 'args' is always the same and holds the values used for the first call. It's a bit

[issue13826] Having a shlex example in the subprocess.Popen docs is confusing

Julian Berman added the comment: Sounds reasonable to me. I'll take a look at adding one unless someone manages to beat me to it. -- ___ Python tracker ___

[issue13829] exception error

New submission from Dan kamp : Get this error when trying to run Moviegrabber on a mac running v2.7. Crash report below. Process: Python [2444] Path: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/C ontents/MacOS/Python Identifier: Python

[issue13703] Hash collision security issue

Frank Sievertsen added the comment: > The suffix only introduces a constant change in all hash values > output, so even if you don't know the suffix, you can still > generate data sets with collisions by just having the prefix. That's true. But without the suffix, I can pretty easy and efficien

[issue13641] decoding functions in the base64 module could accept unicode strings

Antoine Pitrou added the comment: Thanks for the updated patch! Two comments: - I see no tests for map01 and altchars being passed as an str, is this supported by the patch or am I reading it wrong? - apparently b16decode is not tackled, is it deliberate? Thanks again. -- stage: -> p

[issue13828] Further improve casefold documentation

Jim Jewett added the comment: Frankly, I do think that sample code is too long, but correctness matters ... perhaps a better solution would be to add either a method or a unicodedata function that does the work, then the extra note could just say Note that most case-insensitive matches should

[issue13828] Further improve casefold documentation

New submission from Jim Jewett : > http://hg.python.org/cpython/rev/0b5ce36a7a24 > changeset:   74515:0b5ce36a7a24 > +   Casefolding is similar to lowercasing but more aggressive because it is > +   intended to remove all case distinctions in a string. For example, the > German > +   lowercase

[issue11948] Tutorial/Modules - small fix to better clarify the modules search path

Eric Snow added the comment: FYI: unless importlib took undue liberties (unlikely), frozen modules also precede path-based modules. See the implicit additions to sys.meta_path in Lib/importlib/_bootstrap.py. Whether or not to include a mention of frozen modules in the tutorial...I'll leave

[issue13825] Datetime failing while reading active directory time attribute

scape added the comment: I dug a little deeper using an error trap and found some of the problematic accounts in AD have their attribute set to a wildly long number and not 0 (as are others when 'never' is specified.) i'll dig further, it also does not seem to be an issue with python but more

[issue11551] test_dummy_thread.py test coverage improvement

Sandro Tosi added the comment: Hi Denver, do you have the time to address the review on rietveld and propose a new patch? -- ___ Python tracker ___

[issue13827] Unexecuted import changes namespace

Changes by Ezio Melotti : -- components: -None resolution: -> invalid stage: -> committed/rejected status: open -> closed ___ Python tracker ___ __

[issue13827] Unexecuted import changes namespace

Ezio Melotti added the comment: >>> OVERRIDE = False >>> SOMETHING = "original" >>> >>> def main(): ... if OVERRIDE: ... SOMETHING = None ... print SOMETHING ... >>> main() Traceback (most recent call last): File "", line 1, in File "", line 4, in main UnboundLocalError: l

[issue13827] Unexecuted import changes namespace

Michael Foord added the comment: hippmr: the problem is that by importing SOMETHING inside that function you're creating a *local variable* called SOMETHING. If the override isn't executed, and SOMETHING isn't global, then that local variable doesn't exist - which is why you get that error.

[issue13827] Unexecuted import changes namespace

Michael Hipp added the comment: Even an *unexecuted* import assignment statement? -- resolution: invalid -> status: closed -> open ___ Python tracker ___ __

[issue13827] Unexecuted import changes namespace

Benjamin Peterson added the comment: Not a bug. Basically, import is an explicit assignment statement. -- nosy: +benjamin.peterson resolution: -> invalid status: open -> closed ___ Python tracker

[issue13827] Unexecuted import changes namespace

Michael Hipp added the comment: Add'l over.py file -- Added file: http://bugs.python.org/file24279/over.py ___ Python tracker ___ ___

[issue13827] Unexecuted import changes namespace

New submission from Michael Hipp : A local *unexecuted* import appears to be changing the namespace. Attached files are ready to run. # over.py SOMETHING = "overridden" # main.py OVERRIDE = False SOMETHING = "original" def main(): #global SOMETHING # uncomment and it works if OVERRID

[issue13478] No documentation for timeit.default_timer

Changes by Sandro Tosi : Added file: http://bugs.python.org/file24277/issue13478-py32.patch ___ Python tracker ___ ___ Python-bugs-list mailin

[issue13478] No documentation for timeit.default_timer

Sandro Tosi added the comment: I propose these 2 patches: I'm not exactly proud of - 'in a platform specific manner' in the first hunk - the second hunk I know that there should be a better way to express it, but since I can't get to it I'd just ask for suggestions :) -- keywords: +

[issue13703] Hash collision security issue

Marc-Andre Lemburg added the comment: [Reposting, since roundup removed part of the Python output] M.-A. Lemburg wrote: > Note that the integer attack also applies to other number types > in Python: > > --> (hash(3), hash(3.0), hash(3+0j) > (3, 3, 3) > > See Tim's post I referenced earlier on

[issue13703] Hash collision security issue

Marc-Andre Lemburg added the comment: STINNER Victor wrote: > > I tried the collision counting with a low number of collisions: > ... no false positives with a limit of 50 collisions ... Thanks for running those tests. Looks like a limit lower than 1000 would already do just fine. Some timing

[issue13752] add a str.casefold() method

Changes by Giampaolo Rodola' : -- nosy: +giampaolo.rodola ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe: http:

[issue13817] deadlock in subprocess while running several threads using Popen

Charles-François Natali added the comment: Here's the patch. It's probably possible to add a test for this, however I don't have access to my development machine, so I can't write it now. -- Added file: http://bugs.python.org/file24275/reinit_tls.diff _

[issue13826] Having a shlex example in the subprocess.Popen docs is confusing

Sandro Tosi added the comment: Maybe we can add a very small example before the whole note to show just how to use Popen in simple situation, and so the shlex part below will add more details for more advanced cases. -- nosy: +sandro.tosi versions: -Python 2.6, Python 3.1 __

[issue13703] Hash collision security issue

Alex Gaynor added the comment: Django's tests will *not* be run with HASHEED=0, if they're broken with hash randomization then they are likely broken on random.choice(["32-bit", "64-bit", "pypy", "jython", "ironpython"]) and we strive to run on all those platforms. If our tests are order depe

[issue13703] Hash collision security issue

Marc-Andre Lemburg added the comment: Antoine Pitrou wrote: > > Antoine Pitrou added the comment: > >> Please note, that you'd have to extend the randomization to >> all other Python data types as well in order to reach the same level >> of security as the collision counting approach. > > Yo

[issue13826] Having a shlex example in the subprocess.Popen docs is confusing

R. David Murray added the comment: It is not particularly intuitive what goes in to a Popen non-shell argument list, unless you are an experienced programmer. The real purpose of the note is to convey a lot of information about how tokenization works in a short example, and it also demonstra

[issue13826] Having a shlex example in the subprocess.Popen docs is confusing

Changes by R. David Murray : -- priority: normal -> low ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe: http://

[issue13703] Hash collision security issue

Antoine Pitrou added the comment: > Please note, that you'd have to extend the randomization to > all other Python data types as well in order to reach the same level > of security as the collision counting approach. You also have to extend the collision counting to sets, by the way. -

[issue13703] Hash collision security issue

Marc-Andre Lemburg added the comment: STINNER Victor wrote: > ... > So I expect something similar in applications: no change in the > applications, but a lot of hacks/tricks in tests. Tests usually check output of an application given a certain input. If those fail with the randomization, then

[issue13826] Having a shlex example in the subprocess.Popen docs is confusing

New submission from Julian Berman : The example at http://docs.python.org/dev/library/subprocess.html#popen-constructor seems a bit misplaced, as it seems to suggest that one should use the shlex module. Most of the other examples in the module seem to use a list to provide the args, so if th

[issue13817] deadlock in subprocess while running several threads using Popen

Antoine Pitrou added the comment: I think you forgot to attach the patch :) -- nosy: +pitrou ___ Python tracker ___ ___ Python-bugs-l

[issue13825] Datetime failing while reading active directory time attribute

New submission from Chris Gill : I believe I am having a similar issue to this: http://bugs.python.org/issue7150 I am in the middle of programming a quick script and now I cannot seem to get beyond this issue; as it is printing up the expiration times from the AD user listings (many of which

[issue13817] deadlock in subprocess while running several threads using Popen

Charles-François Natali added the comment: Here's the backtrace: """ #0 0x003bfb20c9b1 in sem_wait () from /lib64/libpthread.so.0 #1 0x0051a7c3 in PyThread_acquire_lock (lock=0x17db0750, waitflag=1) at Python/thread_pthread.h:321 #2 0x0051a9b4 in find_key (key=1, valu

[issue13703] Hash collision security issue

STINNER Victor added the comment: I tried the collision counting with a low number of collisions: less than 15 collisions --- Fail at startup. 5 collisions (32 buckets, 21 used=65.6%): hash=ceb3152f => f 10 collisions (32 buckets, 21 used=65.6%): hash=ceb3152f => f dict((

[issue13763] Potentially hard to understand wording in devguide

Éric Araujo added the comment: Thanks for commenting. Please commit your wording, or this alternate version: “``hg`` is the name of the Mercurial command-line program, and is often used as an abbreviation for "Mercurial".” (Just to avoid repetition and to add “command-line”.) -- __

[issue9631] Python 2.7 installation issue for Linux gcc-4.1.0-3 (Fedora Core 5?)

mike added the comment: Hi, I downloaded source and did the following instructions. We use Red Hat Enterprise Linux Server release 5.5. ./configure --prefix=/home/mike/python_rh_32 make make install I also changed the line in site.py from: s = os.path.join(os.path.dirname(sys.path.pop

[issue13703] Hash collision security issue

Éric Araujo added the comment: > Even Lib/packaging/create.py change is related to fixing tests. The test can > be changed > differently, but I like the idea of having always the same output in > packaging (e.g. it is > more readable for the user if files are sorted). See #13712 for why this

[issue13813] "sysconfig.py" and "distutils/util.py" redundancy

Éric Araujo added the comment: Background on the distutils freeze? Right now I don’t have the time and I’m going to be offline until the end of the month. You can look for Tarek Ziadé’s blog posts after PyCon 2010, or wait until I come back and put the links on a wiki page :) -- _

[issue13817] deadlock in subprocess while running several threads using Popen

Changes by Antoine Pitrou : -- nosy: +neologix ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail.pyth

[issue13824] argparse.FileType opens a file without excepting resposibility for closing it

New submission from David Layton : argparse.FileType.__call__ opens the specified file and returns it. This is well documented as an anit-idiom in http://docs.python.org/howto/doanddont.html#exceptions. "...a serious problem — due to implementation details in CPython, the file would not be c

[issue11948] Tutorial/Modules - small fix to better clarify the modules search path

Sandro Tosi added the comment: Thanks Terry for the ping, I've just committed it - thanks again to everyone for the help/suggestions. -- resolution: -> fixed stage: commit review -> committed/rejected status: open -> closed ___ Python tracker

[issue11948] Tutorial/Modules - small fix to better clarify the modules search path

Roundup Robot added the comment: New changeset d01208ba482f by Sandro Tosi in branch '2.7': Issue #11948: clarify modules search path http://hg.python.org/cpython/rev/d01208ba482f New changeset 6d663db63705 by Sandro Tosi in branch '3.2': Issue #11948: clarify modules search path http://hg.pyth

[issue13823] xml.etree.ElementTree.ElementTree.write - argument checking

New submission from patrick vrijlandt : (1) The docs say: xml_declaration controls if an XML declaration should be added to the file. Use False for never, True for always, None for only if not US-ASCII or UTF-8 or Unicode (default is None). The method also accepts other values, like xml_decla

[issue13804] Python library structure creates hard to read code when using higher order functions

Martin Häcker added the comment: Jup - oh the joys of writing code in a bugtracker :) -- ___ Python tracker ___ ___ Python-bugs-list