[issue27292] Warn users that os.urandom() can return insecure values

2016-06-11 Thread Christian Heimes
New submission from Christian Heimes: In #26839 os.urandom() was made non-blocking and non-exception-raising on Linux. As a result os.urandom() is no longer a CSPRNG under some conditions as it can and will return predictable random values without any sort of warning or error flag. These

[issue27293] Summarize issues related to urandom, getrandom etc in secrets documentation

2016-06-11 Thread Steven D'Aprano
New submission from Steven D'Aprano: Write some documentation for the ``secrets`` module summarizing the issues relating to /dev/[u]random, getrandom, etc. There's a lot of confusion about these issues, and the web contains a lot of misinformation, so being able to point to the secrets docs

[issue27292] Warn users that os.urandom() can return insecure values

2016-06-11 Thread Steven D'Aprano
Steven D'Aprano added the comment: Relevant: issue #27293 (I've taken the liberty of subscribing those on this issues nosy list to the new issue, I hope that's okay) -- nosy: +steven.daprano ___ Python tracker

[issue27293] Summarize issues related to urandom, getrandom etc in secrets documentation

2016-06-11 Thread Christian Heimes
Christian Heimes added the comment: Thx Steven. tl;dr The OS' / Kernel's CSPRNG is safe-to-use as long as one uses the correct API: getrandom(flags=0) on Linux, getentropy() on BSD, CryptGenRandom() on Windows. Myths about Linux's urandom: http://www.2uo.de/myths-about-urandom/ Example why

[issue16484] pydoc generates invalid docs.python.org link for xml.etree.ElementTree and other modules

2016-06-11 Thread Martin Panter
Martin Panter added the comment: My guess is the file.startswith(basedir) in the getdocloc() method is getting tricked by non-canonical paths (e.g. lowercase vs uppercase C: drive?). Would it help to use something like os.path.normcase(), or maybe os.path.commonpath(), pathlib.PurePath.parts

[issue5124] IDLE - pasting text doesn't delete selection

2016-06-11 Thread Roundup Robot
Roundup Robot added the comment: New changeset 99760b6a181e by Terry Jan Reedy in branch 'default': Issue #5124: Temporary pyshell rename to avoid case-folding collision in merge. https://hg.python.org/cpython/rev/99760b6a181e New changeset 6c469b50e198 by Terry Jan Reedy in branch '2.7': Issue

[issue27263] Tkinter sets the HOME environment variable, breaking scripts

2016-06-11 Thread Zachary Ware
Zachary Ware added the comment: For the original issue, I agree with Eryk that about the best we can do is to document that Tcl sets HOME as "%HOMEDRIVE%%HOMEPATH%" or "c:\" if both of those are not set. I wonder about removing (or de-preferring) HOME in os.path.expanduser, but that would be

[issue5124] IDLE - pasting text doesn't delete selection

2016-06-11 Thread Roundup Robot
Roundup Robot added the comment: New changeset 095e79636663 by Terry Jan Reedy in branch 'default': Issue #5124: rename PyShell back to pyshell and patch test for 3.6 https://hg.python.org/cpython/rev/095e79636663 -- ___ Python tracker

[issue5124] IDLE - pasting text doesn't delete selection

2016-06-11 Thread Terry J. Reedy
Changes by Terry J. Reedy : -- resolution: -> fixed stage: commit review -> resolved status: open -> closed ___ Python tracker ___

[issue27262] IDLE: move Aqua context menu code to maxosx

2016-06-11 Thread Roundup Robot
Roundup Robot added the comment: New changeset 374dd14cf0e5 by Ned Deily in branch 'default': Issue #27262: fix missing parameter typo https://hg.python.org/cpython/rev/374dd14cf0e5 -- ___ Python tracker

[issue27263] Tkinter sets the HOME environment variable, breaking scripts

2016-06-11 Thread Terry J. Reedy
Terry J. Reedy added the comment: #14576 is more or less about making better use of USERPROFILE when the value returned by expanduser to config.IdleConf.GetUserCfgDir fails. Now that I know that tcl always sets HOME (or pieces that are joined back together to make HOME), so that expanduser

[issue27288] secrets should use getrandom() on Linux

2016-06-11 Thread Steven D'Aprano
Steven D'Aprano added the comment: I don't want to start another huge thread on python-dev unless really necessary. What should happen to random.SystemRandom? (1) nothing, it stays as it is, and if ``secrets`` needs better, it can subclass it; (2) it changes to use ``os.getrandom``, and then

[issue27115] IDLE/tkinter: in simpledialog, != [OK] click

2016-06-11 Thread Serhiy Storchaka
Serhiy Storchaka added the comment: If you close the Goto dialog by pressing , the KeyRelease event is sent to the editor window. This triggers the <> event. -- ___ Python tracker

[issue27272] random.Random should not read 2500 bytes from urandom

2016-06-11 Thread Christian Heimes
Christian Heimes added the comment: On 2016-06-11 00:07, Raymond Hettinger wrote: > > Raymond Hettinger added the comment: > >> But I'll be happiest if nothing changes here (given that Guido ruled >> yesterday that Python's current urandom() implementation has to be >> reverted to once again

[issue27262] IDLE: move Aqua context menu code to maxosx

2016-06-11 Thread Terry J. Reedy
Terry J. Reedy added the comment: I will add a test that calls setupApp, which would have failed with an error. I will also remove the call to _init_tk_type in setupApp, and let it be called when needed by the first isMacTk function called. Test code can partly simulate being on a

[issue5124] IDLE - pasting text doesn't delete selection

2016-06-11 Thread Roundup Robot
Roundup Robot added the comment: New changeset 3017e41b0c99 by Terry Jan Reedy in branch '2.7': Issue #5124: NEWS entries. https://hg.python.org/cpython/rev/3017e41b0c99 New changeset 62b949a179cb by Terry Jan Reedy in branch '3.5': Issue #5124: NEWS entries.

[issue26839] Python 3.5 running on Linux kernel 3.17+ can block at startup or on importing the random module on getrandom()

2016-06-11 Thread Larry Hastings
Larry Hastings added the comment: Colm Buckley: I've read the code, *and* stepped through it, and AFAICT it is no longer even possible for Python on Linux to call getrandom() in a blocking way. Thanks for doing this! I'm marking the issue as closed. -- stage: patch review ->

[issue26439] ctypes.util.find_library fails when ldconfig/glibc not available (e.g., AIX)

2016-06-11 Thread Michael Felt
Michael Felt added the comment: * You may also just modify my "attempt" in _aixutil.py I recall you said something about the p.wait() being a potential to hang, but I also want to be sure the subprocess has exited properly - as it is not something to be running in parallel - and be sure that

[issue5124] IDLE - pasting text doesn't delete selection

2016-06-11 Thread Serhiy Storchaka
Serhiy Storchaka added the comment: entry=entry in test is not needed. -- ___ Python tracker ___ ___

[issue27272] random.Random should not read 2500 bytes from urandom

2016-06-11 Thread Martin Panter
Martin Panter added the comment: Victor originally opened this mentioning a 256-byte limit. I guess that comes from Open BSD’s getentropy() function: . Solaris’s getrandom() function

[issue27115] IDLE/tkinter: in simpledialog, != [OK] click

2016-06-11 Thread Terry J. Reedy
Terry J. Reedy added the comment: Okay, will take a look at the status bar code and update mechanism. -- assignee: -> terry.reedy ___ Python tracker ___

[issue26556] Update expat to 2.2.1

2016-06-11 Thread Larry Hastings
Larry Hastings added the comment: Christian: I don't see any checkins on this issue, and I tag 3.4.4 rc1 and 3.5.2 rc1 in about twelve hours. As I mentioned to you in person at the PyCon 2016 sprints, I'm not holding up either of these releases for the expat update. If this is still open

[issue21386] ipaddress.IPv4Address.is_global not implemented

2016-06-11 Thread Berker Peksag
Berker Peksag added the comment: Thanks Roger! -- resolution: -> fixed stage: patch review -> resolved status: open -> closed type: enhancement -> behavior ___ Python tracker

[issue20508] IndexError from ipaddress._BaseNetwork.__getitem__ has no message

2016-06-11 Thread Berker Peksag
Changes by Berker Peksag : -- resolution: -> fixed stage: patch review -> resolved status: open -> closed versions: -Python 3.5 ___ Python tracker

[issue20508] IndexError from ipaddress._BaseNetwork.__getitem__ has no message

2016-06-11 Thread Roundup Robot
Roundup Robot added the comment: New changeset bc758c62bc4f by Berker Peksag in branch 'default': Issue #20508: Improve exception message of IPv{4,6}Network.__getitem__ https://hg.python.org/cpython/rev/bc758c62bc4f -- nosy: +python-dev ___ Python

[issue27294] Better repr for Tkinter event objects

2016-06-11 Thread Terry J. Reedy
Terry J. Reedy added the comment: Testing now. -- ___ Python tracker ___ ___ Python-bugs-list mailing list

[issue27025] More human readable generated widget names

2016-06-11 Thread Serhiy Storchaka
Serhiy Storchaka added the comment: Patch updated. 1. The prefix "0" is used for generated names. This keeps the old rule (generated names start from a digit and are not valid Python identifier) and looks less striking than "_". 2. Lowercased Python class name is used as a base name for

[issue26556] Update expat to 2.2.1

2016-06-11 Thread Roundup Robot
Roundup Robot added the comment: New changeset d8a0a016d8d4 by Benjamin Peterson in branch '2.7': upgrade expt to 2.1.1 (closes #26556) https://hg.python.org/cpython/rev/d8a0a016d8d4 New changeset bb3ce78572f5 by Benjamin Peterson in branch '3.4': upgrade expt to 2.1.1 (closes #26556)

[issue25733] Code and IDLE should catch all compile errors.

2016-06-11 Thread Terry J. Reedy
Terry J. Reedy added the comment: Code patch, still needs tests. ppperry, thanks. I may create a temporary big file when large memory tests are allowed. -- keywords: +patch stage: needs patch -> test needed Added file: http://bugs.python.org/file43351/catch_all_syntax_errors.diff

[issue27291] two heap corruption issues when running modified pyc code.

2016-06-11 Thread Gregory P. Smith
Gregory P. Smith added the comment: Executing code in any form from untrusted sources can do arbitrary things. If someone can corrupt .pyc data before python executes it, they are just as likely to be able to corrupt other things leading to more direct exploits not even requiring the CPython

[issue15468] Edit docs to hide hashlib.md5()

2016-06-11 Thread Gregory P. Smith
Changes by Gregory P. Smith : -- resolution: -> fixed stage: patch review -> resolved status: open -> closed ___ Python tracker ___

[issue22558] Missing doc links to source code for Python-coded modules.

2016-06-11 Thread Terry J. Reedy
Terry J. Reedy added the comment: I committed the excellent patch. It should appear in the upcoming 3.5 and 3.6 releases, and within a day online. Thanks to both package author and also to reviewers. I would like to see more patches like this. I reverted the deletion of version added in

[issue27277] Fatal Python error: Segmentation fault in test_exceptions

2016-06-11 Thread Rohit Mediratta
Rohit Mediratta added the comment: It's set to 1000, I didnt change during install, so it's likely set to the default value. >>> import sys >>> sys.getrecursionlimit() 1000 I also have a lot of memory free (87G) to run scripts (should be able to handle without running into issues)

[issue27291] two heap corruption issues when running modified pyc code.

2016-06-11 Thread ppperry
Changes by ppperry : -- title: two heap corruption issue -> two heap corruption issues when running modified pyc code. ___ Python tracker

[issue25733] Code and IDLE should catch all compile errors.

2016-06-11 Thread ppperry
ppperry added the comment: OverflowError is raised when one attempts to compile a string of 2**31 or more characters. -- ___ Python tracker ___

[issue5124] IDLE - pasting text doesn't delete selection

2016-06-11 Thread Terry J. Reedy
Terry J. Reedy added the comment: The two stable buildbots that failed on test_idle before do not now: AMD64 SnowLeapard 1403, AMD64 Win 7 2258. -- stage: needs patch -> resolved status: open -> closed ___ Python tracker

[issue27194] Tarfile superfluous truncate calls slows extraction.

2016-06-11 Thread Roundup Robot
Roundup Robot added the comment: New changeset b63474aa8a5f by Łukasz Langa in branch '3.5': Issue #27194: superfluous truncate calls in tarfile.py slow down extraction https://hg.python.org/cpython/rev/b63474aa8a5f New changeset a4f918de25e5 by Łukasz Langa in branch 'default': Merge 3.5,

[issue14209] pkgutil.iter_zipimport_modules ignores the prefix parameter for packages

2016-06-11 Thread Łukasz Langa
Łukasz Langa added the comment: Done. Fix is going to be present for 3.5.2 and 3.6. Thank you, James. -- resolution: -> fixed status: open -> closed versions: +Python 3.5, Python 3.6 -Python 2.7, Python 3.2, Python 3.3 ___ Python tracker

[issue14209] pkgutil.iter_zipimport_modules ignores the prefix parameter for packages

2016-06-11 Thread Roundup Robot
Roundup Robot added the comment: New changeset 9649acf7d472 by Łukasz Langa in branch '3.5': Issue #14209: pkgutil.iter_zipimport_modules ignores the prefix for packages https://hg.python.org/cpython/rev/9649acf7d472 New changeset 389b7456a053 by Łukasz Langa in branch 'default': Merge 3.5,

[issue25782] CPython hangs on error __context__ set to the error itself

2016-06-11 Thread Gregory P. Smith
Gregory P. Smith added the comment: Patch review: I see two competing solutions with differing behaviors. Yury's raises a RuntimeError in the loop situation. Serhiy's simply reorders the exception context to put the referred to one at the front of the chain in the event of a loop. The 3.5

[issue27122] Hang with contextlib.ExitStack and subprocess.Popen (regression)

2016-06-11 Thread Gregory P. Smith
Changes by Gregory P. Smith : -- dependencies: +CPython hangs on error __context__ set to the error itself ___ Python tracker ___

[issue25782] CPython hangs on error __context__ set to the error itself

2016-06-11 Thread Gregory P. Smith
Changes by Gregory P. Smith : -- stage: commit review -> patch review ___ Python tracker ___

[issue25782] CPython hangs on error __context__ set to the error itself

2016-06-11 Thread Larry Hastings
Larry Hastings added the comment: I'm not the right person to decide this. As RM, all I can do is decide whether or not to hold up a release based on the bug. The answer: no. Since this isn't fixed yet in the 3.5 branch, 3.5.2 will go out without it being fixed. Sorry folks. --

[issue27136] sock_connect fails for bluetooth (and probably others)

2016-06-11 Thread Martin Panter
Martin Panter added the comment: Revision 3f49e89be8a9 seems to be the cause of an x86 Tiger buildbot failure: http://buildbot.python.org/all/builders/x86%20Tiger%203.x/builds/10924/steps/test/logs/stdio == FAIL:

[issue17900] Recursive OrderedDict pickling

2016-06-11 Thread Raymond Hettinger
Raymond Hettinger added the comment: At this point, we can drop it. PyYAML will just have to deal with it. -- assignee: rhettinger -> ___ Python tracker

[issue26565] [ctypes] Add value attribute to non basic pointers.

2016-06-11 Thread Memeplex
Memeplex added the comment: Martin, there were two reasons: 1. Conciseness: addressof(p.contents) vs. p.value. 2. Uniformity: I expect the value of a pointer to be the address it points to. Then Eryk pointed out that p.value has already another meaning for simple pointer types, so (2) can't

[issue5124] IDLE - pasting text doesn't delete selection

2016-06-11 Thread Terry J. Reedy
Terry J. Reedy added the comment: Oh right, requires('gui') does not work at module level in 2.7. This should fix. Will try to check next round of bot builds. -- ___ Python tracker

[issue27291] two heap corruption issue

2016-06-11 Thread Raymond Hettinger
Changes by Raymond Hettinger : -- nosy: +haypo, rhettinger, serhiy.storchaka, stutzbach ___ Python tracker ___

[issue27295] heaps library does not have support for max heap

2016-06-11 Thread Raymond Hettinger
Raymond Hettinger added the comment: Sorry James, we don't grow the APIs without sufficient demonstrated need; otherwise, we end-up with API sprawl. People with actual use cases haven't requested behavior (and the occasional one-off gets by negating the numeric argument). That is why the

[issue27291] two heap corruption issue

2016-06-11 Thread Park Alex
Park Alex added the comment: all of .pyc files had been altered by fuzzer. original py code is following: $ cat helloworld.py def hello(s=0x4142434445464748): print s if type(s) == str: print s.encode('hex') print repr(s) else: s = str(s) print len(s) <<

[issue27294] Better repr for Tkinter event objects

2016-06-11 Thread Roundup Robot
Roundup Robot added the comment: New changeset 61a92a102b2d by Serhiy Storchaka in branch 'default': Issue #27294: Improved repr for Tkinter event objects. https://hg.python.org/cpython/rev/61a92a102b2d -- nosy: +python-dev ___ Python tracker

[issue27298] redundant iteration over digits in _PyLong_AsUnsignedLongMask

2016-06-11 Thread Oren Milman
Changes by Oren Milman : Added file: http://bugs.python.org/file43348/CPythonTestOutput.txt ___ Python tracker ___

[issue27291] two heap corruption issue

2016-06-11 Thread STINNER Victor
STINNER Victor added the comment: Hi, corrupted .pyc files are known to be abel to crash Python. What is the point of your bug report? If you are able to execute untrusted .pyc, you can already execute arbitrary code, no? IMHO we should document the limitation of the security of CPython.

[issue27095] Simplify MAKE_FUNCTION

2016-06-11 Thread Serhiy Storchaka
Serhiy Storchaka added the comment: Now with adding BUILD_CONST_KEY_MAP I think MAKE_FUNCTION can be more compact. -- ___ Python tracker ___

[issue27291] two heap corruption issues when running modified pyc code.

2016-06-11 Thread Park Alex
Park Alex added the comment: I totally agreed with your opinion. So I hesitated before reporting the issue (I thought) It's kinda, we have different point of view. As far as I can tell, python could be corrupted with .pyc like heap-use-after-free, buffer overrun and so on. Again, I agreed

[issue27263] Tkinter sets the HOME environment variable, breaking scripts

2016-06-11 Thread ppperry
Changes by ppperry : -- components: -IDLE ___ Python tracker ___ ___ Python-bugs-list

[issue22558] Missing doc links to source code for Python-coded modules.

2016-06-11 Thread Terry J. Reedy
Terry J. Reedy added the comment: Yes, new issue, make me nosy, assign to me if allowed, upload patch. Start with "This is a follow to #22558." -- ___ Python tracker

[issue15468] Edit docs to hide hashlib.md5()

2016-06-11 Thread Roundup Robot
Roundup Robot added the comment: New changeset 1cfd627bee05 by Gregory P. Smith in branch 'default': Clarify that md5 is in the algorithms_guaranteed list despite what https://hg.python.org/cpython/rev/1cfd627bee05 -- ___ Python tracker

[issue24086] Configparser interpolation is unexpected

2016-06-11 Thread Łukasz Langa
Łukasz Langa added the comment: This is solved upstream in setuptools by disabling configparser interpolation. -- resolution: -> not a bug status: open -> closed ___ Python tracker

[issue24136] document PEP 448: unpacking generalization

2016-06-11 Thread Roundup Robot
Roundup Robot added the comment: New changeset a7e04b4e51b2 by Martin Panter in branch '3.5': Issue #24136: Document generalized unpacking, PEP 448 https://hg.python.org/cpython/rev/a7e04b4e51b2 New changeset 4cf3389cd8e6 by Martin Panter in branch 'default': Issue #24136: Merge unpacking doc

[issue5124] IDLE - pasting text doesn't delete selection

2016-06-11 Thread Ned Deily
Ned Deily added the comment: Terry, the 2.7 version of the test changes is causing buildbot and test_idle failures when the "gui" condition is not met. See, for example, http://buildbot.python.org/all/builders/AMD64%20Snow%20Leop%202.7/builds/1400. -- stage: resolved -> needs patch

[issue27294] Better repr for Tkinter event objects

2016-06-11 Thread Serhiy Storchaka
Serhiy Storchaka added the comment: The key state can be interesting for mouse events too. Ctrl-Click, Shift-Move. Maybe it is worth to omit the output of state=0. Agreed, the 4 mouse positions are pretty noisy. Maybe omit root_x and root_y? But mouse position can be relevant for such key

[issue22253] ConfigParser does not handle files without sections

2016-06-11 Thread Pedro Lacerda
Pedro Lacerda added the comment: I also never found a mixture of sectionless options followed by sectioned options. So an unnamed section that is also the DEFAULTSECTION will probably work. In this patch when `default_section=None` is passed to `RawConfigParser` it will parse top level

[issue27294] Better repr for Tkinter event objects

2016-06-11 Thread Terry J. Reedy
Terry J. Reedy added the comment: Right. This is why I suggested leaving anything we are not sure of to a later patch, after gaining more experience (and thought). However, 'state' behaved strangely in my experiments. In a sequence of about 900 events, it started as 8 (Left Alt according to

[issue27140] Opcode for creating dict with constant keys

2016-06-11 Thread Serhiy Storchaka
Serhiy Storchaka added the comment: Yes, I left it for symmetry and for easier modifying if we will add more restrictions on using BUILD_CONST_KEY_MAP. Thank you for your reviews Demur and Benjamin. -- ___ Python tracker

[issue24136] document PEP 448: unpacking generalization

2016-06-11 Thread Jelle Zijlstra
Jelle Zijlstra added the comment: Thanks for writing a better patch. The patch looks good to me and it builds correctly. -- ___ Python tracker ___

[issue27025] More human readable generated widget names

2016-06-11 Thread Terry J. Reedy
Terry J. Reedy added the comment: I agree with back-compatibility, suppression of '1' suffix, and numbering, which makes suppressed '1' common. I prefer '1' rather that '0' prefix. Visually, '1' leaves more space between digit and word. Semantically, each component represents 1 of

[issue27095] Simplify MAKE_FUNCTION

2016-06-11 Thread Demur Rumed
Demur Rumed added the comment: mkfu4 implements #27140. It doesn't special case 1-tuples into `BUILD_MAP 1` It may be easier to have `BUILD_CONST_KEY_MAP 1` peepholed if it's really preferable to strength reduce I'm also noticing that it could've been suggested to go to the extreme with

[issue27122] Hang with contextlib.ExitStack and subprocess.Popen (regression)

2016-06-11 Thread Gregory P. Smith
Gregory P. Smith added the comment: Proposed fix based on STINNER and Nick's earlier comments and the simple reproducer turned into a test. Nick - your most recent comment makes me wonder if this shouldn't be doing more. this does make both hang_bug*.py examples do something reasonable. I'm

[issue16484] pydoc generates invalid docs.python.org link for xml.etree.ElementTree and other modules

2016-06-11 Thread Kaushik Nadikuditi
Kaushik Nadikuditi added the comment: - fixed broken test - test_mixed_case_module_names_are_lower_cased - tested on Windows, Mac, Ubuntu - thank you Martin Panter for suggestions. -- components: +Tests -Documentation type: -> compile error Added file:

[issue27292] Warn users that os.urandom() can return insecure values

2016-06-11 Thread Larry Hastings
Larry Hastings added the comment: This is not a release blocker. -- priority: release blocker -> normal ___ Python tracker ___

[issue24363] httplib fails to handle semivalid HTTP headers

2016-06-11 Thread Martin Panter
Changes by Martin Panter : -- versions: +Python 3.6 -Python 3.4 ___ Python tracker ___

[issue27296] Urllib/Urlopen IncompleteRead with HTTP header with new line characters

2016-06-11 Thread Martin Panter
Martin Panter added the comment: HTTP header fields are not supposed to have line breaks unless followed by a space or tab. So the server is actually providing a faulty response. However Python could do better at handling this case. There is already a bug open for this: Issue 24363. For the

[issue22970] asyncio: Cancelling wait() after notification leaves Condition in an inconsistent state

2016-06-11 Thread Roundup Robot
Roundup Robot added the comment: New changeset 0bda9bc443ce by Yury Selivanov in branch '3.5': Issue #22970: asyncio: Fix inconsistency cancelling Condition.wait. https://hg.python.org/cpython/rev/0bda9bc443ce New changeset 00a9de0f3fdc by Yury Selivanov in branch 'default': Merge 3.5 (issue

[issue27272] random.Random should not read 2500 bytes from urandom

2016-06-11 Thread Tim Peters
Tim Peters added the comment: Christian, you should really be the first to vote to close this. The title of this bug report is about whether it would be good to reduce the _number_ of bytes Random initialization consumes from os.urandom(), not whether to stop using os.urandom() entirely.

[issue27294] Better repr for Tkinter event objects

2016-06-11 Thread Terry J. Reedy
Terry J. Reedy added the comment: Is this something that you might push before a2 tomorrow? (If I review now?) Or still in development? -- ___ Python tracker

[issue27292] Warn users that os.urandom() can return insecure values

2016-06-11 Thread Donald Stufft
Donald Stufft added the comment: I agree that we should add a warning to these, it's easy to see how someone might read the summary of the function "Return a string of n random bytes suitable for cryptographic use." and skip over the nuance in the rest of the body of the function. Adding a

[issue27297] Add support for /dev/random to "secrets"

2016-06-11 Thread Donald Stufft
Donald Stufft added the comment: > It's just that the manpage for urandom (and in fact the comments in the > source code for /dev/random and /dev/urandom) both recommend using > /dev/random for these long-lived cryptographic keys. It's a hedge because of the bad behavior of /dev/urandom on

[issue20508] IndexError from ipaddress._BaseNetwork.__getitem__ has no message

2016-06-11 Thread Gareth Rees
Gareth Rees added the comment: Thank you for applying this patch. -- ___ Python tracker ___ ___

[issue27140] Opcode for creating dict with constant keys

2016-06-11 Thread Benjamin Peterson
Benjamin Peterson added the comment: Okay, I think it's fine then. However, you have a for loop in compiler_subkwargs which only executes once. -- ___ Python tracker

[issue27288] secrets should use getrandom() on Linux

2016-06-11 Thread Brett Cannon
Brett Cannon added the comment: It should be mentioned that Guido really doesn't like the idea of os.getrandom() as it exposes stuff where we would rather simply tell people to use the secrets module. -- ___ Python tracker

[issue10839] email module should not allow some header field repetitions

2016-06-11 Thread Raymond Hettinger
Raymond Hettinger added the comment: I think we should consider this as an API design bug and backport the fix. This seems to be the exact cause of this week's email address leak at LetsEncrypt: *

[issue27288] secrets should use getrandom() on Linux

2016-06-11 Thread Tim Peters
Tim Peters added the comment: I think it's clear Guido would say "#1". The thrust of all his comments to date is that it was a mistake to change the semantics of os.urandom() on Linux (and one other platform? don't really care), and that in 3.6+ only `secrets` should _try_ to supply

[issue27288] secrets should use getrandom() on Linux

2016-06-11 Thread Jelle Zijlstra
Jelle Zijlstra added the comment: I'm interested in implementing this for 3.6, but I'm not sure exactly what the changes are that were decided upon. Is the following accurate? 1. Nothing changes in os (all the necessary changes were made in 3.5.2 already). 2. On Linux 3.17+ only, we add a new

[issue27294] Better repr for Tkinter event objects

2016-06-11 Thread Serhiy Storchaka
Serhiy Storchaka added the comment: Next patch decodes the state attribute. Modifier names can be platform depended, please test on Windows. What modifiers correspond Shift, Ctrl, Alt, Win, CapsLock, etc? -- Added file:

[issue27263] Tkinter sets the HOME environment variable, breaking scripts

2016-06-11 Thread ppperry
Changes by ppperry : -- nosy: -ppperry ___ Python tracker ___ ___ Python-bugs-list

[issue27221] multiprocessing documentation is outdated regarding method picklability

2016-06-11 Thread Jelle Zijlstra
Jelle Zijlstra added the comment: Thanks for the Rietveld comments. I have attached a new patch. -- Added file: http://bugs.python.org/file43350/issue27221-cr.patch ___ Python tracker

[issue22558] Missing doc links to source code for Python-coded modules.

2016-06-11 Thread Yoni Lavi
Yoni Lavi added the comment: Thank you Terry, Nathan and David for your work on this. Sorry about the whitespace issue, I indeed forgot to run patchcheck when I prepared the 3rd patch. Tery, would you like me to prepare a patch for the follow-on you suggested? If so, given that this one is

[issue15468] Edit docs to hide hashlib.md5()

2016-06-11 Thread Roundup Robot
Roundup Robot added the comment: New changeset 13ea0a1d7dde by Gregory P. Smith in branch 'default': issue15468 - use sha256 instead of md5 or sha1 in the examples. https://hg.python.org/cpython/rev/13ea0a1d7dde -- nosy: +python-dev ___ Python

[issue27122] Hang with contextlib.ExitStack and subprocess.Popen (regression)

2016-06-11 Thread Gregory P. Smith
Changes by Gregory P. Smith : -- assignee: gregory.p.smith -> ncoghlan ___ Python tracker ___

[issue27294] Better repr for Tkinter event objects

2016-06-11 Thread Terry J. Reedy
Terry J. Reedy added the comment: Summary: Though I would like to see some refinements, this looks really useful as is and I would like it applied soon even if refinements have to wait for a second patch. Moving the window did not generate a printed event. I like the compact way of handling

[issue5124] IDLE - pasting text doesn't delete selection

2016-06-11 Thread Roundup Robot
Roundup Robot added the comment: New changeset 274308a3b8b6 by Terry Jan Reedy in branch '2.7': Issue #5124: For 2.7, move requires('gui') from module level to setUpClass. https://hg.python.org/cpython/rev/274308a3b8b6 -- ___ Python tracker

[issue27298] redundant iteration over digits in _PyLong_AsUnsignedLongMask

2016-06-11 Thread Oren Milman
New submission from Oren Milman: current state 1. In Objects/longobject.c in _PyLong_AsUnsignedLongMask, in case v is a multiple-digit int, _PyLong_AsUnsignedLongMask iterates over all of its digits (going from the most to the least significant digit) and does (for

[issue27298] redundant iteration over digits in _PyLong_AsUnsignedLongMask

2016-06-11 Thread Oren Milman
Changes by Oren Milman : Added file: http://bugs.python.org/file43347/patchedCPythonTestOutput.txt ___ Python tracker ___

[issue27298] redundant iteration over digits in _PyLong_AsUnsignedLongMask

2016-06-11 Thread Serhiy Storchaka
Changes by Serhiy Storchaka : -- nosy: +mark.dickinson, serhiy.storchaka ___ Python tracker ___

[issue27263] Tkinter sets the HOME environment variable, breaking scripts

2016-06-11 Thread Terry J. Reedy
Terry J. Reedy added the comment: ppperry, when I changed this to a doc issue, I added IDLE back as a component because, as I said in my last message, I want to include the facts revealed here in the IDLE doc. -- nosy: +ppperry ___ Python tracker

[issue27025] More human readable generated widget names

2016-06-11 Thread Serhiy Storchaka
Serhiy Storchaka added the comment: "1" looks too similar to "l". -- ___ Python tracker ___ ___

[issue27297] Add support for /dev/random to "secrets"

2016-06-11 Thread Larry Hastings
Larry Hastings added the comment: I understand. It's just that the manpage for urandom (and in fact the comments in the source code for /dev/random and /dev/urandom) both recommend using /dev/random for these long-lived cryptographic keys. Under normal circumstances I'd simply assume that

[issue27291] two heap corruption issue

2016-06-11 Thread Serhiy Storchaka
Serhiy Storchaka added the comment: poc.zip contains only precompiled files. Could you please provide source files? -- ___ Python tracker ___

[issue27140] Opcode for creating dict with constant keys

2016-06-11 Thread Roundup Robot
Roundup Robot added the comment: New changeset 27b0dbaf0ea8 by Serhiy Storchaka in branch 'default': Issue #27140: Added BUILD_CONST_KEY_MAP opcode. https://hg.python.org/cpython/rev/27b0dbaf0ea8 -- nosy: +python-dev ___ Python tracker

  1   2   >