[issue13703] Hash collision security issue

2012-01-18 Thread Antoine Pitrou
Antoine Pitrou pit...@free.fr added the comment: I like this, esp. if for old releases the collision counting is on by default and the hash seeding is off by default, while in 3.3 both should be on by default. Different env vars or flags should be used to enable/disable them. I would hope

[issue13703] Hash collision security issue

2012-01-18 Thread Guido van Rossum
Guido van Rossum gu...@python.org added the comment: On Wed, Jan 18, 2012 at 1:05 PM, Antoine Pitrou rep...@bugs.python.orgwrote: Antoine Pitrou pit...@free.fr added the comment: I like this, esp. if for old releases the collision counting is on by default and the hash seeding is off by

[issue13703] Hash collision security issue

2012-01-18 Thread Antoine Pitrou
Antoine Pitrou pit...@free.fr added the comment: Really? I'd expect the difference to be more than 2 nines. The randomized hashing has two problems: (a) change in dict order; (b) hash varies between processes. Personally I don't think the change in dict order is a problem (hashing already

[issue13781] gzip module does the wrong thing with an os.fdopen()'ed fileobj

2012-01-18 Thread Gregory P. Smith
Gregory P. Smith g...@krypto.org added the comment: Looks like you've got commit privs (yay) so i'm assigning this to you to take care of that way for 2.7 as well. I'd add a comment to the fdopen C code where the fdopen constant lives as well as to the gzip.py module around the special case

[issue10278] add time.wallclock() method

2012-01-18 Thread Roundup Robot
Roundup Robot devn...@psf.upfronthosting.co.za added the comment: New changeset 83e8c3a6a81c by Antoine Pitrou in branch 'default': Be more lenient in test_wallclock (issue #10278). http://hg.python.org/cpython/rev/83e8c3a6a81c -- ___ Python tracker

[issue13722] distributions can disable the encodings package

2012-01-18 Thread Roundup Robot
Roundup Robot devn...@psf.upfronthosting.co.za added the comment: New changeset 46b245f03f54 by Antoine Pitrou in branch '3.2': Issue #13722: Avoid silencing ImportErrors when initializing the codecs registry. http://hg.python.org/cpython/rev/46b245f03f54 New changeset f55529aa023d by Antoine

[issue13722] distributions can disable the encodings package

2012-01-18 Thread Antoine Pitrou
Changes by Antoine Pitrou pit...@free.fr: -- resolution: - fixed stage: needs patch - committed/rejected status: open - closed ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue13722 ___

[issue10278] add time.wallclock() method

2012-01-18 Thread Antoine Pitrou
Changes by Antoine Pitrou pit...@free.fr: -- status: open - closed ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue10278 ___ ___ Python-bugs-list

[issue13811] In str.format an incorrect alignment option doesn't make fill char and onself absent

2012-01-18 Thread py.user
py.user port...@yandex.ru added the comment: Eric V. Smith wrote: I'm not sure what you're saying here. Is it that 'xx' should be ignored? yes, the description says they are assumed absent -- ___ Python tracker rep...@bugs.python.org

[issue13781] gzip module does the wrong thing with an os.fdopen()'ed fileobj

2012-01-18 Thread Roundup Robot
Roundup Robot devn...@psf.upfronthosting.co.za added the comment: New changeset a08e9e84f33f by Nadeem Vawda in branch '2.7': Issue #13781: Fix GzipFile to work with os.fdopen()'d file objects. http://hg.python.org/cpython/rev/a08e9e84f33f -- ___

[issue13811] In str.format an incorrect alignment option doesn't make fill char and onself absent

2012-01-18 Thread Eric V. Smith
Eric V. Smith e...@trueblade.com added the comment: The only error is the text of the ValueError. I'll look into fixing that. These characters will not be ignored. -- ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue13811

[issue13703] Hash collision security issue

2012-01-18 Thread STINNER Victor
STINNER Victor victor.stin...@haypocalc.com added the comment: Don't you think that the number of corrections you have to apply in order to get the tests working again shows how much impact such a change would have in real-world applications ? Let see the diffstat: Doc/using/cmdline.rst

[issue10109] itertools.product with infinite iterator cause MemoryError.

2012-01-18 Thread Terry J. Reedy
Terry J. Reedy tjre...@udel.edu added the comment: Proposing an expansion of the definition of product() is a *completely* different issue from the validity of count() as an input. I answered correctly given the current definition of product(): it is not valid input. It is also not valid

[issue13811] In str.format an incorrect alignment option doesn't make fill char and onself absent

2012-01-18 Thread py.user
py.user port...@yandex.ru added the comment: If the second character of format_spec is not a valid alignment option, then it is assumed that both the fill character and the alignment option are absent. what does it mean ? -- ___ Python tracker

[issue13811] In str.format an incorrect alignment option doesn't make fill char and onself absent

2012-01-18 Thread Stefan Krah
Stefan Krah stefan-use...@bytereef.org added the comment: py.user: The format string must always match the grammar, which is just above the paragraph that you quoted: [[fill]align][sign][#][0][width][,][.precision][type] Thus, if fill and align are absent, it does not mean that you can

[issue13811] In str.format, if invalid fill and alignment are specified, the text of the ValueError message is misleading.

2012-01-18 Thread Eric V. Smith
Eric V. Smith e...@trueblade.com added the comment: Changing to 3.3: I don't think applying this to 3.2 would be appropriate. -- assignee: - eric.smith keywords: +easy priority: normal - low stage: - needs patch title: In str.format an incorrect alignment option doesn't make fill char

[issue10109] itertools.product with infinite iterator cause MemoryError.

2012-01-18 Thread Sumudu Fernando
Sumudu Fernando sumu...@gmail.com added the comment: tuple(itertools.cycle(enumerate(it)) for it in itertools.count()) ... TypeError: 'int' object is not iterable That is not what happens in the function, though! That would correspond to doing product(*itertools.count(2010)), but if you

[issue13811] In str.format, if invalid fill and alignment are specified, the text of the ValueError message is misleading.

2012-01-18 Thread py.user
py.user port...@yandex.ru added the comment: Stefan Krah wrote: Thus, if fill and align are absent, it does not mean that you can add arbitrary characters like xx. the descriptions says in other words: if you have used an incorrect alignment option, then the interpreter behaves like you

[issue13781] gzip module does the wrong thing with an os.fdopen()'ed fileobj

2012-01-18 Thread Nadeem Vawda
Nadeem Vawda nadeem.va...@gmail.com added the comment: Done. -- resolution: - fixed stage: - committed/rejected status: open - closed type: - behavior ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue13781

[issue13703] Hash collision security issue

2012-01-18 Thread Terry J. Reedy
Terry J. Reedy tjre...@udel.edu added the comment: A possible advantage of having the 3.3 fix available in earlier versions is that people will be able to turn it on and have that be the *only* change -- just as with __future__ imports done one at a time. --

[issue13703] Hash collision security issue

2012-01-18 Thread Gregory P. Smith
Gregory P. Smith g...@krypto.org added the comment: On Wed, Jan 18, 2012 at 1:10 PM, Guido van Rossum rep...@bugs.python.org wrote: On Wed, Jan 18, 2012 at 1:05 PM, Antoine Pitrou rep...@bugs.python.orgwrote: I would hope 3.3 only gets randomized hashing. Collision counting is a hack to

[issue13703] Hash collision security issue

2012-01-18 Thread Antoine Pitrou
Antoine Pitrou pit...@free.fr added the comment: MvL's suggestion of using AVL trees for hash bucket slots instead of our linear slot finding algorithm is a better way to fix the ultimate problem by never devolving into linear behavior at all. A dict can contain non-orderable keys, I don't

[issue13703] Hash collision security issue

2012-01-18 Thread Gregory P. Smith
Gregory P. Smith g...@krypto.org added the comment: A dict can contain non-orderable keys, I don't know how an AVL tree can fit into that. good point! -- ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue13703

[issue13703] Hash collision security issue

2012-01-18 Thread Terry J. Reedy
Terry J. Reedy tjre...@udel.edu added the comment: As much as the counting idea rubs me wrong, FWIW, the original 2003 paper reported that the url-caching system that they tested used collision-counting to evade attacks. -- ___ Python tracker

[issue13811] In str.format, if invalid fill and alignment are specified, the text of the ValueError message is misleading.

2012-01-18 Thread Stefan Krah
Stefan Krah stefan-use...@bytereef.org added the comment: The text speaks about the regular case of a second character that is not a valid alignment character, e.g.: format(3.222, .2f) Clearly the '2' fulfills this criterion, so the parser knows that the leading '.' is *not* a fill

[issue13811] In str.format, if invalid fill and alignment are specified, the text of the ValueError message is misleading.

2012-01-18 Thread Eric V. Smith
Eric V. Smith e...@trueblade.com added the comment: As I look at it a little closer, I think I'm going to change the message to: Invalid format type specified. The code has determined that instead of a type that's a single character long, it's received xx10d. That's because xx doesn't match

[issue13703] Hash collision security issue

2012-01-18 Thread Guido van Rossum
Guido van Rossum gu...@python.org added the comment: On Wed, Jan 18, 2012 at 3:37 PM, Terry J. Reedy rep...@bugs.python.orgwrote: Terry J. Reedy tjre...@udel.edu added the comment: As much as the counting idea rubs me wrong, FWIW, the original 2003 paper reported that the url-caching

[issue13703] Hash collision security issue

2012-01-18 Thread Antoine Pitrou
Antoine Pitrou pit...@free.fr added the comment: As much as the counting idea rubs me wrong, FWIW, the original 2003 paper reported that the url-caching system that they tested used collision-counting to evade attacks. I think that was DJB's DNS server/cache actually. But deciding to

[issue13811] In str.format, if invalid fill and alignment are specified, the text of the ValueError message is misleading.

2012-01-18 Thread py.user
py.user port...@yandex.ru added the comment: Stefan Krah wrote: After it has been established that [[fill]align] is not present you have to match the *whole string* with the rest of the grammar I think, there should be a text in the documentation: if the alignment optiont is invalid, it

[issue13811] In str.format, if invalid fill and alignment are specified, the text of the ValueError message is misleading.

2012-01-18 Thread Stefan Krah
Stefan Krah stefan-use...@bytereef.org added the comment: Eric V. Smith rep...@bugs.python.org wrote: As I look at it a little closer, I think I'm going to change the message to: Invalid format type specified. The code has determined that instead of a type that's a single character long, it's

[issue13813] sysconfig.py and distutils/util.py redundancy

2012-01-18 Thread Jesús Cea Avión
Jesús Cea Avión j...@jcea.es added the comment: Could you possibly provide some background?. I am afraid I am not familiar with the situation. I want to learn :) -- ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue13813

[issue13811] In str.format, if invalid fill and alignment are specified, the text of the ValueError message is misleading.

2012-01-18 Thread Stefan Krah
Stefan Krah stefan-use...@bytereef.org added the comment: Stefan Krah rep...@bugs.python.org wrote: [xx10d] look at the code now, but would the message also be raised for this spec? format(9, xx10f) Argh, 'd' is of course also a valid type specifier. --

[issue13820] 2.6 is no longer in the future

2012-01-18 Thread Jim Jewett
New submission from Jim Jewett jimjjew...@gmail.com: http://docs.python.org/reference/lexical_analysis.html Changed in version 2.5: Both as and with are only recognized when the with_statement future feature has been enabled. It will always be enabled in Python 2.6. See section The with

[issue13703] Hash collision security issue

2012-01-18 Thread Guido van Rossum
Guido van Rossum gu...@python.org added the comment: On Wed, Jan 18, 2012 at 3:46 PM, Antoine Pitrou rep...@bugs.python.orgwrote: Antoine Pitrou pit...@free.fr added the comment: As much as the counting idea rubs me wrong, FWIW, the original 2003 paper reported that the url-caching

[issue13821] misleading return from isidentifier

2012-01-18 Thread Jim Jewett
New submission from Jim Jewett jimjjew...@gmail.com: Python identifiers are in NFKC form; string method .isidentifier() returns true on strings that are not in that form. In some contexts, these non-canonical strings will be replaced with their NFKC equivalent, but in other contexts (such as

[issue13821] misleading return from isidentifier

2012-01-18 Thread Benjamin Peterson
Benjamin Peterson benja...@python.org added the comment: I don't see why that's invalid. str.isidentifier() returning True means Python will accept it as an identifier. -- nosy: +benjamin.peterson ___ Python tracker rep...@bugs.python.org

[issue13811] In str.format, if invalid fill and alignment are specified, the text of the ValueError message is misleading.

2012-01-18 Thread Eric V. Smith
Eric V. Smith e...@trueblade.com added the comment: The existing exceptions use the text format code for what the documentation calls type: format(9, h) Traceback (most recent call last): File stdin, line 1, in module ValueError: Unknown format code 'h' for object of type 'int' So to be

[issue13821] misleading return from isidentifier

2012-01-18 Thread Jim Jewett
Jim Jewett jimjjew...@gmail.com added the comment: My preference would be for non_NFKC.isidentifier() to return False, but that may be a problem for backwards compatibility. It *may* be worth adding an asidentifier() method that returns either False or the canonicalized string that should be

[issue13821] misleading return from isidentifier

2012-01-18 Thread Benjamin Peterson
Benjamin Peterson benja...@python.org added the comment: 2012/1/18 Jim Jewett rep...@bugs.python.org: Jim Jewett jimjjew...@gmail.com added the comment: My preference would be for non_NFKC.isidentifier() to return False It *is* an identifier, though. Python will happily accept it. It

[issue13821] misleading return from isidentifier

2012-01-18 Thread Jim Jewett
Jim Jewett jimjjew...@gmail.com added the comment: @Benjamin -- the catch is, if it isn't already in NFKC form, then python won't really accept it as an identifier. Sometimes it will silently canonicalize it for you so that it seems to work, but other times it won't. And program calling

[issue13821] misleading return from isidentifier

2012-01-18 Thread Benjamin Peterson
Benjamin Peterson benja...@python.org added the comment: 2012/1/18 Jim Jewett rep...@bugs.python.org: Jim Jewett jimjjew...@gmail.com added the comment: @Benjamin -- the catch is, if it isn't already in NFKC form, then python won't really accept it as an identifier.  Sometimes it will

[issue13703] Hash collision security issue

2012-01-18 Thread Terry J. Reedy
Terry J. Reedy tjre...@udel.edu added the comment: You mean as a fix or that they successfully attacked a collision-counting system? Successful anticipation and blocking of hash attack: after a chain of 100 DNS 'treats the request as a cache miss'. What is somewhat special for this app is

[issue10109] itertools.product with infinite iterator cause MemoryError.

2012-01-18 Thread Terry J. Reedy
Terry J. Reedy tjre...@udel.edu added the comment: A relatively simple change would be to allow the first iterable to be 'infinite', when repeat==1, by not calling tuple() on it. The reason for turning the iterables into concrete sequences is because they might not be reiterable. (cycle()

[issue13822] is(upper/lower/title) are not exactly correct

2012-01-18 Thread Benjamin Peterson
New submission from Benjamin Peterson benja...@python.org: The isupper() and islower() methods currently use the Lowercase and Uppercase derived properties. Technically, they should use the Changes_When_(Lowercased/Uppercased/Titlecased) and Changes_When_Casemapped derived properties to

[issue2134] Add new attribute to TokenInfo to report specific token IDs

2012-01-18 Thread Roundup Robot
Roundup Robot devn...@psf.upfronthosting.co.za added the comment: New changeset 75baef657770 by Meador Inge in branch '2.7': Issue #2134: Clarify token.OP handling rationale in tokenize documentation. http://hg.python.org/cpython/rev/75baef657770 New changeset dfd74d752b0e by Meador Inge in

[issue2134] Add new attribute to TokenInfo to report specific token IDs

2012-01-18 Thread Meador Inge
Meador Inge mead...@gmail.com added the comment: Fixed. Thanks for the reviews everyone. -- resolution: - fixed stage: patch review - committed/rejected status: open - closed ___ Python tracker rep...@bugs.python.org

[issue12705] Make compile('1\n2\n', '', 'single') raise an exception instead of silently truncating?

2012-01-18 Thread Roundup Robot
Roundup Robot devn...@psf.upfronthosting.co.za added the comment: New changeset 2bd7f40108b4 by Meador Inge in branch 'default': Issue #12705: Raise SyntaxError when compiling multiple statements as single interactive statement http://hg.python.org/cpython/rev/2bd7f40108b4 -- nosy:

[issue12705] Make compile('1\n2\n', '', 'single') raise an exception instead of silently truncating?

2012-01-18 Thread Meador Inge
Meador Inge mead...@gmail.com added the comment: Fixed in 3.3. -- resolution: - fixed stage: patch review - committed/rejected status: open - closed ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue12705

[issue7980] time.strptime not thread safe

2012-01-18 Thread Florent Xicluna
Changes by Florent Xicluna florent.xicl...@gmail.com: -- nosy: +flox ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue7980 ___ ___ Python-bugs-list

[issue11108] Intermittent AttributeError when using time.strptime in threads

2012-01-18 Thread Florent Xicluna
Changes by Florent Xicluna florent.xicl...@gmail.com: -- nosy: +flox ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue11108 ___ ___ Python-bugs-list

<    1   2