Re: [Python-Dev] We cannot fix all issues: let's close XML security issues (not fix them)

2018-09-07 Thread Terry Reedy
On 9/6/2018 11:05 AM, Ryan Gonzalez wrote: Thought: what if there's a label on the bug tracker meaning roughly "we're probably not going to fix this anytime soon, but we won't mind someone stepping up"? Not needed. Good patches are always welcome. And if there is no current PR or other infor

Re: [Python-Dev] Fwd: We cannot fix all issues: let's close XML security issues (not fix them)

2018-09-07 Thread Christian Heimes
On 2018-09-07 17:46, Victor Stinner wrote: > Le ven. 7 sept. 2018 à 17:02, PMS PMS a écrit : >> XML support in Python is critical and desired for many sectors like banking >> or telecoms, >> and code base based on XML is still on rise in such world. > > Would it be possible to send money to the

[Python-Dev] Summary of Python tracker Issues

2018-09-07 Thread Python tracker
ACTIVITY SUMMARY (2018-08-31 - 2018-09-07) Python tracker at https://bugs.python.org/ To view or respond to any of the issues listed below, click on the issue. Do NOT respond to this message. Issues counts and deltas: open6841 (+13) closed 39517 (+38) total 46358 (+51) Open issues w

Re: [Python-Dev] Fwd: We cannot fix all issues: let's close XML security issues (not fix them)

2018-09-07 Thread Abdur-Rahmaan Janhangeer
@VictorStinner snif, que dire? il me semble que cet issue ait pris une nouvelle dimension @appinv Abdur-Rahmaan Janhangeer https://github.com/Abdur-rahmaanJ Mauritius ___ Python-Dev mailing list Python-Dev@python.org https://mail.python.org/mailman/lis

Re: [Python-Dev] Fwd: We cannot fix all issues: let's close XML security issues (not fix them)

2018-09-07 Thread Victor Stinner
Le ven. 7 sept. 2018 à 17:02, PMS PMS a écrit : > XML support in Python is critical and desired for many sectors like banking > or telecoms, > and code base based on XML is still on rise in such world. Would it be possible to send money to the PSF? I'm sure that the PSF will be able to find you

[Python-Dev] Fwd: We cannot fix all issues: let's close XML security issues (not fix them)

2018-09-07 Thread PMS PMS
Thank you Victor. XML support in Python is critical and desired for many sectors like banking or telecoms, and code base based on XML is still on rise in such world. That's why keeping such bugs open is important, as it is not impossible that someone (banks, telecoms, google camps, government g

Re: [Python-Dev] We cannot fix all issues: let's close XML security issues (not fix them)

2018-09-07 Thread Jakub Wilk
* Victor Stinner , 2018-09-06, 16:40: I'm also dubious about PyYAML which allows to run arbitrary Python code in a configuration *by default*. But well, it seems like nobody stepped in to change the default. PyYAML maintainers intend to change the default soon: https://github.com/yaml/pyyaml/i

Re: [Python-Dev] We cannot fix all issues: let's close XML security issues (not fix them)

2018-09-07 Thread Victor Stinner
Le ven. 7 sept. 2018 à 10:23, Christian Heimes a écrit : > Back in the days, I didn't push hard for the necessary fixes, because > all fixes were breaking changes. After all I'd have to disable some > features that people may have relied upon. The XML security stuff was my > first major security t

Re: [Python-Dev] We cannot fix all issues: let's close XML security issues (not fix them)

2018-09-07 Thread Christian Heimes
On 2018-09-06 17:03, Guido van Rossum wrote: > FWIW I'm with Antoine here -- XML is still important and I'd like us to > go the extra mile here, not just give up because the issues have been > inactive for a long time. We can't control what PyYAML does, but for the > stdlib XML code, the buck stops

Re: [Python-Dev] We cannot fix all issues: let's close XML security issues (not fix them)

2018-09-07 Thread Victor Stinner
Le jeu. 6 sept. 2018 à 21:10, Steve Dower a écrit : > If Christian is not able to keep maintaining the defused* packages, then > I may take a look at this next week at the sprints. The built-in XML > packages actually don't meet Microsoft's internal security requirements, > so I have some business