Re: Python - remote object protocols and security

2013-07-15 Thread Jean-Michel Pichavant
- Original Message - > On 15-7-2013 13:17, Dave Angel wrote: > > On 07/15/2013 06:20 AM, Jean-Michel Pichavant wrote: > >> In text format... sorry for my previous html post > >> > >> Hello everyone, > >> > >> I'd like to exchange some simple python objects over the internet. > >> I initiall

Re: Python - remote object protocols and security

2013-07-15 Thread Irmen de Jong
On 15-7-2013 18:57, Irmen de Jong wrote: >> Note that DOS attacks are possible whatever encoding scheme you have. Make >> sure that >> self-references within the data are well-defined (or impossible), and put >> limits on size >> per transaction, and transactions per minute per legitimate user.

Re: Python - remote object protocols and security

2013-07-15 Thread Irmen de Jong
On 15-7-2013 13:17, Dave Angel wrote: > On 07/15/2013 06:20 AM, Jean-Michel Pichavant wrote: >> In text format... sorry for my previous html post >> >> Hello everyone, >> >> I'd like to exchange some simple python objects over the internet. >> I initially planned to use Pyro, after reading >> http:

Re: Python - remote object protocols and security

2013-07-15 Thread Chris Angelico
On Tue, Jul 16, 2013 at 2:31 AM, Burak Arslan wrote: > On 07/15/13 16:53, Chris Angelico wrote: >> I haven't looked into the details, but there was one among a list of >> exploits that was being discussed a few months ago; it involved XML >> schemas, I think, and quite a few generic XML parsers co

Re: Python - remote object protocols and security

2013-07-15 Thread Burak Arslan
On 07/15/13 16:53, Chris Angelico wrote: > I haven't looked into the details, but there was one among a list of > exploits that was being discussed a few months ago; it involved XML > schemas, I think, and quite a few generic XML parsers could be tricked > into fetching arbitrary documents. Whether

Re: Python - remote object protocols and security

2013-07-15 Thread Chris Angelico
On Tue, Jul 16, 2013 at 1:42 AM, Burak Arslan wrote: > On 07/15/13 13:57, Chris Angelico wrote: >> But what I meant was that the [Json] protocol itself is designed with >> security restrictions in mind. It's designed not to fetch additional >> content from the network (as XML can), > > Can you exp

Re: Python - remote object protocols and security

2013-07-15 Thread Burak Arslan
On 07/15/13 13:51, Chris Angelico wrote: > So the only bit you still need is: How do you transmit this across the > network? Since it's now all just bytes, that's easy enough to do, eg > with TCP. But that depends on the rest of your system, and is a quite > separate question - and quite probably o

Re: Python - remote object protocols and security

2013-07-15 Thread Chris Angelico
On Mon, Jul 15, 2013 at 10:45 PM, Dave Angel wrote: > On 07/15/2013 08:30 AM, Chris Angelico wrote: >> >> On Mon, Jul 15, 2013 at 10:26 PM, Jean-Michel Pichavant >> wrote: >>> >>> Basically, I need to transfer numbers (int). Possibly dictionaries like >>> {string: int} in order to structure thing

Re: Python - remote object protocols and security

2013-07-15 Thread Burak Arslan
Hi, On 07/15/13 13:30, Chris Angelico wrote: > On Mon, Jul 15, 2013 at 10:26 PM, Jean-Michel Pichavant > wrote: >> Basically, I need to transfer numbers (int). Possibly dictionaries like >> {string: int} in order to structure things a little bit. > I strongly recommend JSON, then. It's a well-k

Re: Python - remote object protocols and security

2013-07-15 Thread Chris Angelico
On Mon, Jul 15, 2013 at 10:41 PM, Jean-Michel Pichavant wrote: > - Original Message - >> > What I think I need to care about, is malicious code injections. >> > Because >> > both client/server will be in python, would someone capable of >> > executing >> > code by changing one side python

Re: Python - remote object protocols and security

2013-07-15 Thread Dave Angel
On 07/15/2013 08:30 AM, Chris Angelico wrote: On Mon, Jul 15, 2013 at 10:26 PM, Jean-Michel Pichavant wrote: Basically, I need to transfer numbers (int). Possibly dictionaries like {string: int} in order to structure things a little bit. I strongly recommend JSON, then. It's a well-known sys

Re: Python - remote object protocols and security

2013-07-15 Thread Jean-Michel Pichavant
- Original Message - > > What I think I need to care about, is malicious code injections. > > Because > > both client/server will be in python, would someone capable of > > executing > > code by changing one side python source ? > > > > How do I prevent this and still provide the source to

Re: Python - remote object protocols and security

2013-07-15 Thread Chris Angelico
On Mon, Jul 15, 2013 at 10:26 PM, Jean-Michel Pichavant wrote: > Basically, I need to transfer numbers (int). Possibly dictionaries like > {string: int} in order to structure things a little bit. I strongly recommend JSON, then. It's a well-known system, it's compact, it's secure, and Python com

Re: Python - remote object protocols and security

2013-07-15 Thread Jean-Michel Pichavant
- Original Message - > > I don't mind encrypting data, if someone wants to sniff what I'm > > sending, he's welcome. > > > > I don't think the word you need there is "mind," but I get the idea. You're right, I wanted to state actually the opposite, I don't want to encrypt data because

Re: Python - remote object protocols and security

2013-07-15 Thread Chris Angelico
On Mon, Jul 15, 2013 at 8:13 PM, Jean-Michel Pichavant wrote: > I'd like to exchange some simple python objects over the internet. > I initially planned to use Pyro, after reading > http://pythonhosted.org/Pyro4/security.html I'm still puzzled. > > I don't mind encrypting data, if someone wants to

Re: Python - remote object protocols and security

2013-07-15 Thread Dave Angel
On 07/15/2013 06:20 AM, Jean-Michel Pichavant wrote: In text format... sorry for my previous html post Hello everyone, I'd like to exchange some simple python objects over the internet. I initially planned to use Pyro, after reading http://pythonhosted.org/Pyro4/security.html I'm still puzzled

Re: Python - remote object protocols and security

2013-07-15 Thread Jean-Michel Pichavant
In text format... sorry for my previous html post Hello everyone, I'd like to exchange some simple python objects over the internet. I initially planned to use Pyro, after reading http://pythonhosted.org/Pyro4/security.html I'm still puzzled. I don't mind encrypting data, if someone wants to

Python - remote object protocols and security

2013-07-15 Thread Jean-Michel Pichavant
Hello everyone, I'd like to exchange some simple python objects over the internet. I initially planned to use Pyro, after reading http://pythonhosted.org/Pyro4/security.html I'm still puzzled. I don't mind encrypting data, if someone wants to sniff what I'm sending, he's welcome. What I