Re: [Python-Dev] Status of the fix for the hash collision ulnerability

2012-01-15 Thread Heiko Wundram
Am 15.01.2012 15:27, schrieb Victor Stinner: I don't think that it would be hard to patch this library to use another hash function. It can implement its own hash function, use MD5, SHA1, or anything else. hash() is not stable accross Python versions and 32/64 bit systems. As I wrote in a reply

Re: [Python-Dev] Status of the fix for the hash collision vulnerability

2012-01-15 Thread Guido van Rossum
On Sun, Jan 15, 2012 at 8:46 AM, Stefan Behnel wrote: > Guido van Rossum, 15.01.2012 17:10: > > On Sun, Jan 15, 2012 at 6:30 AM, Stefan Behnel wrote: > >> Terry Reedy, 14.01.2012 06:43: > >>> On 1/13/2012 8:58 PM, Gregory P. Smith wrote: > >>> > It is perfectly okay to break existing users w

Re: [Python-Dev] Status of the fix for the hash collision vulnerability

2012-01-15 Thread Antoine Pitrou
On Sun, 15 Jan 2012 17:46:36 +0100 Stefan Behnel wrote: > Guido van Rossum, 15.01.2012 17:10: > > On Sun, Jan 15, 2012 at 6:30 AM, Stefan Behnel wrote: > >> Terry Reedy, 14.01.2012 06:43: > >>> On 1/13/2012 8:58 PM, Gregory P. Smith wrote: > >>> > It is perfectly okay to break existing users

Re: [Python-Dev] Status of the fix for the hash collision vulnerability

2012-01-15 Thread Gregory P. Smith
On Sun, Jan 15, 2012 at 8:46 AM, Stefan Behnel wrote: > > It also seems to me that the wording "has a hash value which never changes > during its lifetime" makes it pretty clear that the lifetime of the hash > value is not guaranteed to supersede the lifetime of the object (although > that's a rat

Re: [Python-Dev] Status of the fix for the hash collision vulnerability

2012-01-15 Thread Stefan Behnel
Guido van Rossum, 15.01.2012 17:10: > On Sun, Jan 15, 2012 at 6:30 AM, Stefan Behnel wrote: >> Terry Reedy, 14.01.2012 06:43: >>> On 1/13/2012 8:58 PM, Gregory P. Smith wrote: >>> It is perfectly okay to break existing users who had anything depending on ordering of internal hash tables.

Re: [Python-Dev] Status of the fix for the hash collision vulnerability

2012-01-15 Thread Guido van Rossum
On Sun, Jan 15, 2012 at 6:30 AM, Stefan Behnel wrote: > Terry Reedy, 14.01.2012 06:43: > > On 1/13/2012 8:58 PM, Gregory P. Smith wrote: > > > >> It is perfectly okay to break existing users who had anything depending > >> on ordering of internal hash tables. Their code was already broken. > > >

Re: [Python-Dev] Dinsdale is no more

2012-01-15 Thread Eli Bendersky
2012/1/15 Łukasz Langa > Gentlemen, www.python.org is down at the moment. > > Well, it's back now: http://www.downforeveryoneorjustme.com/python.org Eli ___ Python-Dev mailing list Python-Dev@python.org http://mail.python.org/mailman/listinfo/python-dev

[Python-Dev] Dinsdale is no more

2012-01-15 Thread Łukasz Langa
Gentlemen, www.python.org is down at the moment. -- Best regards, Łukasz Langa Senior Systems Architecture Engineer IT Infrastructure Department Grupa Allegro Sp. z o.o. ___ Python-Dev mailing list Python-Dev@python.org http://mail.python.org/mailman/l

Re: [Python-Dev] Status of the fix for the hash collision vulnerability

2012-01-15 Thread Stefan Behnel
Terry Reedy, 14.01.2012 06:43: > On 1/13/2012 8:58 PM, Gregory P. Smith wrote: > >> It is perfectly okay to break existing users who had anything depending >> on ordering of internal hash tables. Their code was already broken. > > Given that the doc says "Return the hash value of the object", I d

Re: [Python-Dev] Status of the fix for the hash collision ulnerability

2012-01-15 Thread Victor Stinner
I don't think that it would be hard to patch this library to use another hash function. It can implement its own hash function, use MD5, SHA1, or anything else. hash() is not stable accross Python versions and 32/64 bit systems. Victor 2012/1/15 Hynek Schlawack : > Am Sonntag, 15. Januar 2012 um

Re: [Python-Dev] Status of the fix for the hash collision ulnerability

2012-01-15 Thread Hynek Schlawack
Am Sonntag, 15. Januar 2012 um 05:49 schrieb Steven D'Aprano: > > I don't think anyone doubts that this will break lots of code (at least, > > the arguments I've heard have been "their code is broken", not "nobody does > > that"). > > I don't know about "lots" of code, but it will break at least o