[issue12015] possible characters in temporary file name is too few

miss-islington added the comment: New changeset 335efd7c252799eeeb8cbf51d178b1b897a91ae2 by Miss Islington (bot) in branch '3.6': Update docstring of tempfile._RandomNameSequence (GH-6414) https://github.com/python/cpython/commit/335efd7c252799eeeb8cbf51d178b1b897a91ae2 -- _

[issue12015] possible characters in temporary file name is too few

miss-islington added the comment: New changeset d964f51f813282171d4da831e8de0fe003253e9e by Miss Islington (bot) in branch '3.7': Update docstring of tempfile._RandomNameSequence (GH-6414) https://github.com/python/cpython/commit/d964f51f813282171d4da831e8de0fe003253e9e -- nosy: +mis

[issue12015] possible characters in temporary file name is too few

Change by miss-islington : -- pull_requests: +6125 ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe: https://mai

[issue12015] possible characters in temporary file name is too few

Change by miss-islington : -- pull_requests: +6124 ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe: https://mai

[issue12015] possible characters in temporary file name is too few

INADA Naoki added the comment: New changeset 9c463ec88ba21764f6fff8e01d6045a932a89438 by INADA Naoki (Wolfgang Maier) in branch 'master': Update docstring of tempfile._RandomNameSequence (GH-6414) https://github.com/python/cpython/commit/9c463ec88ba21764f6fff8e01d6045a932a89438 -- no

[issue12015] possible characters in temporary file name is too few

Changes by Jakub Wilk : -- nosy: +jwilk ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org

[issue12015] possible characters in temporary file name is too few

STINNER Victor added the comment: With 8 lowercase characters, the entropy is 41.7 bits, whereas it is only 35.9 bits for 6 characters with uppercase and lowercase letters. >>> math.log(26+26+10+1, 2) * 6 # (a-zA-Z0-9_) x 6 35.8636795409995 >>> math.log(26+10+1, 2) * 6 # (a-z0-9_) x 6 31.256720

[issue12015] possible characters in temporary file name is too few

Roundup Robot added the comment: New changeset de5077aca668 by Victor Stinner in branch 'default': Close #12015: The tempfile module now uses a suffix of 8 random characters http://hg.python.org/cpython/rev/de5077aca668 -- nosy: +python-dev resolution: -> fixed stage: patch review -> co

[issue12015] possible characters in temporary file name is too few

Changes by Charles-François Natali : -- keywords: +easy, needs review stage: -> patch review type: -> enhancement versions: +Python 3.4 -Python 3.3 ___ Python tracker ___ _

[issue12015] possible characters in temporary file name is too few

Changes by Steve Ward : Added file: http://bugs.python.org/file21950/tempfile.py.diff ___ Python tracker ___ ___ Python-bugs-list mailing list

[issue12015] possible characters in temporary file name is too few

Antoine Pitrou added the comment: > If you care about security, you should not use the Python random > module because it is not cryptographic. Oh oh, ssl doesn't expose > RAND_bytes(). Feel free to open a separate issue and even provide a patch! --

[issue12015] possible characters in temporary file name is too few

STINNER Victor added the comment: If you care about security, you should not use the Python random module because it is not cryptographic. Oh oh, ssl doesn't expose RAND_bytes(). -- ___ Python tracker ___

[issue12015] possible characters in temporary file name is too few

Nick Coghlan added the comment: Oh, you mean the security risk if the temporary names can be guessed? My recollection is that it is more of a problem for temporary directories than it is for temporary files, since the module can't control how files inside a temp directory get created. It's be

[issue12015] possible characters in temporary file name is too few

Charles-François Natali added the comment: @Nick I fully agree with you, but my point was that it doesn't make it less safe on case-insensitive filesystems. Apart from that, it's of course better to increase the length of the random sequence. -- __

[issue12015] possible characters in temporary file name is too few

Nick Coghlan added the comment: Minor clarification: after my first comment, I realised that the original change in the character set didn't actually fix anything, it just propagated the effectively smaller sample space on case-insensitive filesystems to all filesystems. Increasing the number

[issue12015] possible characters in temporary file name is too few

Raymond Hettinger added the comment: +1 for increasing the number of random characters to 8 -1 for restoring uppercase letters -- ___ Python tracker ___

[issue12015] possible characters in temporary file name is too few

Nick Coghlan added the comment: Basically, adding the uppercase letters back in would provide no gain in entropy on a case-insensitive filesystem (as the upper and lower case letters will collide). Increasing the length of the random sequence would provide a consistent gain regardless of file

[issue12015] possible characters in temporary file name is too few

Charles-François Natali added the comment: Could someone explain me what's the risk on a case-insensitive filesystem? Since files are created with O_CREAT|O_EXCL, I don't see where the problem is. -- nosy: +neologix ___ Python tracker

[issue12015] possible characters in temporary file name is too few

Nick Coghlan added the comment: The number of characters in the filename is hardcoded in the guts of tempfile (in _RandomNameSequence.__next__ to be exact). Increasing that to 7 (or even 8) would be a straightforward change at the library level, but it can't be done from user code. -

[issue12015] possible characters in temporary file name is too few

STINNER Victor added the comment: If you would like more entry, use a longer filename: >>> (26+10+1) ** 6 > (26+26+10+1) ** 6 False >>> (26+10+1) ** 7 > (26+26+10+1) ** 6 True -- nosy: +haypo ___ Python tracker _

[issue12015] possible characters in temporary file name is too few

Nick Coghlan added the comment: Python should still work reliably even if the temp directory is on a case-insensitive filesystem. Since that isn't an easy thing to determine, -1 on restoring the uppercase characters to the filenames. As for it not being fixed previously, it's a rare bug that

[issue12015] possible characters in temporary file name is too few

Changes by Éric Araujo : -- nosy: +ncoghlan, pitrou ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe: http://mail

[issue12015] possible characters in temporary file name is too few

Éric Araujo added the comment: FWIW: Conformity with popular systems is not a goal. -- nosy: +eric.araujo versions: -Python 3.1, Python 3.2, Python 3.4 ___ Python tracker ___ _

[issue12015] possible characters in temporary file name is too few

Changes by Amaury Forgeot d'Arc : -- nosy: +rhettinger ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe: http://m

[issue12015] possible characters in temporary file name is too few

Steve Ward added the comment: It is an issue because... 1) Python falls out of line with most other popular systems and languages. 2) There was never a good reason to decrease the entropy in the first place. If there was, the reason of case-sensitive files systems was not given. 3) If case-

[issue12015] possible characters in temporary file name is too few

Amaury Forgeot d'Arc added the comment: - How is it an issue? is the number of combinations really important to you? - Isn't there a greater risk of collisions on a case-insensitive filesystem? -- nosy: +amaury.forgeotdarc ___ Python tracker

[issue12015] possible characters in temporary file name is too few

New submission from Steve Ward : In this revision , the possible characters that comprise a temporary file decreased. It was noted in this thread . The old character set had