Re: [Python-Dev] We cannot fix all issues: let's close XML security issues (not fix them)

2018-09-06 Thread Steve Dower
On 06Sep2018 0758, Victor Stinner wrote: Are you volunteer to fix the XML modules? If Christian is not able to keep maintaining the defused* packages, then I may take a look at this next week at the sprints. The built-in XML packages actually don't meet Microsoft's internal security requireme

Re: [Python-Dev] We cannot fix all issues: let's close XML security issues (not fix them)

2018-09-06 Thread Abdur-Rahmaan Janhangeer
no time? i have seen them countless of time on this list e.g. no ... don't implement this in the workflow as my volunteer time will be lost etc etc etc. i guess a call for more core contributors will be nice. for myself i have some translations ahead (finally getting the chance to read the docs fr

Re: [Python-Dev] We cannot fix all issues: let's close XML security issues (not fix them)

2018-09-06 Thread Tres Seaver
On 09/06/2018 11:05 AM, Ryan Gonzalez wrote: > Thought: what if there's a label on the bug tracker meaning roughly "we're > probably not going to fix this anytime soon, but we won't mind someone > stepping up"? "help-wanted" Tres. --

Re: [Python-Dev] We cannot fix all issues: let's close XML security issues (not fix them)

2018-09-06 Thread Simon Cross
On Thu, Sep 6, 2018 at 5:06 PM Ryan Gonzalez wrote: > Thought: what if there's a label on the bug tracker meaning roughly "we're > probably not going to fix this anytime soon, but we won't mind someone > stepping up"? Maybe "wouldlikehelpfixing"? :D _

Re: [Python-Dev] We cannot fix all issues: let's close XML security issues (not fix them)

2018-09-06 Thread Ryan Gonzalez
Thought: what if there's a label on the bug tracker meaning roughly "we're probably not going to fix this anytime soon, but we won't mind someone stepping up"? On Thu, Sep 6, 2018, 10:04 AM Guido van Rossum wrote: > FWIW I'm with Antoine here -- XML is still important and I'd like us to go > the

Re: [Python-Dev] We cannot fix all issues: let's close XML security issues (not fix them)

2018-09-06 Thread Guido van Rossum
FWIW I'm with Antoine here -- XML is still important and I'd like us to go the extra mile here, not just give up because the issues have been inactive for a long time. We can't control what PyYAML does, but for the stdlib XML code, the buck stops here, and we should do the responsible thing. On Th

Re: [Python-Dev] We cannot fix all issues: let's close XML security issues (not fix them)

2018-09-06 Thread Victor Stinner
Are you volunteer to fix the XML modules? Victor Le jeu. 6 sept. 2018 à 16:50, Antoine Pitrou a écrit : > > > Le 06/09/2018 à 16:40, Victor Stinner a écrit : > > Le jeu. 6 sept. 2018 à 16:33, Antoine Pitrou a écrit : > >> If we consider fixing these issues to be desirable, then the issues > >> s

Re: [Python-Dev] We cannot fix all issues: let's close XML security issues (not fix them)

2018-09-06 Thread Antoine Pitrou
Le 06/09/2018 à 16:58, Victor Stinner a écrit : > Are you volunteer to fix the XML modules? No. That doesn't mean nobody else will be. Regards Antoine. > > Victor > Le jeu. 6 sept. 2018 à 16:50, Antoine Pitrou a écrit : >> >> >> Le 06/09/2018 à 16:40, Victor Stinner a écrit : >>> Le jeu. 6

Re: [Python-Dev] We cannot fix all issues: let's close XML security issues (not fix them)

2018-09-06 Thread Antoine Pitrou
Le 06/09/2018 à 16:40, Victor Stinner a écrit : > Le jeu. 6 sept. 2018 à 16:33, Antoine Pitrou a écrit : >> If we consider fixing these issues to be desirable, then the issues >> should be kept open. Closing issues because no-one is working on them >> sounds a bit silly to me. > > I forgot to m

Re: [Python-Dev] We cannot fix all issues: let's close XML security issues (not fix them)

2018-09-06 Thread Victor Stinner
Le jeu. 6 sept. 2018 à 16:33, Antoine Pitrou a écrit : > If we consider fixing these issues to be desirable, then the issues > should be kept open. Closing issues because no-one is working on them > sounds a bit silly to me. I forgot to mention that closing these issues is my reply to Larry's ca

Re: [Python-Dev] We cannot fix all issues: let's close XML security issues (not fix them)

2018-09-06 Thread Antoine Pitrou
On Thu, 6 Sep 2018 16:18:33 +0200 Victor Stinner wrote: > > It seems like XML is getting less popular because of JSON becoming > more popular (even if JSON obviously comes with its own set of > security issues...). It seems like less core developers care about XML > (today than 3 years ago). > >

[Python-Dev] We cannot fix all issues: let's close XML security issues (not fix them)

2018-09-06 Thread Victor Stinner
Hi, The Python bug tracker is full of bugs, and sadly we don't have enough people to take care of all of them. There are 3 open bugs about security issues in XML and I simply propose to close it: https://bugs.python.org/issue17318 https://bugs.python.org/issue17239 https://bugs.python.or