PyCon DE 2012 - Today, June 15, is Deadline for Proposals

2012-06-15 Thread Mike Müller
Dear Pythonistas, Only a few hours left. The deadline to submit a talk or tutorial proposal for PyCon DE 2012 is June 15, 2012, 23:59 (CEST). Don't miss this chance to speak at the largest gathering of the German-speaking Python community. Talks and tutorials in English are welcome if you are

PyCon Australia 2012 Conference Programme Revealed!

2012-06-15 Thread Chris Neugebauer
(Hobart Tasmania, 15 June 2012) With both of our keynotes announced, PyCon Australia is very proud to be able to reveal the programme for the 2012 conference, to be held on Saturday 18 and Sunday 19 August 2012 in Hobart, Tasmania. Following an impressive response to our Call for Proposals the

OpenOpt Suite 0.39

2012-06-15 Thread dmitrey
Hi all, I'm glad to inform you about new OpenOpt release 0.39 (quarterly since 2007). OpenOpt is free, even for commercial purposes, cross-platform software for mahematical modeling and (mainstream) optimization. Our website have reached 259 visitors daily, that is same to tomopt.com and ~ 1/3 of

Re: which one do you prefer? python with C# or java?

2012-06-15 Thread Paul Rubin
Alexander Blinne n...@blinne.net writes: def gen_s(): s = [1] m = skipdups(heapq.merge(*[(lambda j: (k*j for k in s))(n) for n in [2,3,5]])) yield s[0] while True: k = m.next() s.append(k) yield k Nice. I wouldn't have been sure that for k in s worked properly

python's future?

2012-06-15 Thread Yesterday Paid
I'm very new to programing though I learn very little of java,C I love python and have fun to do something with it but some people said python's future perhaps not that bright. I know this question maybe looks like an idiot:( I really hope the python rules long~ time. what do you think about

Re: python's future?

2012-06-15 Thread Chris Angelico
On Fri, Jun 15, 2012 at 5:04 PM, Yesterday Paid howmuchisto...@gmail.com wrote: I'm very new to programing though I learn very little of java,C I love python and have fun to do something with it but some people said python's future perhaps not that bright. I know this question maybe looks like

PyCon Australia 2012 Conference Programme Revealed!

2012-06-15 Thread Chris Neugebauer
(Hobart Tasmania, 15 June 2012) With both of our keynotes announced, PyCon Australia is very proud to be able to reveal the programme for the 2012 conference, to be held on Saturday 18 and Sunday 19 August 2012 in Hobart, Tasmania. Following an impressive response to our Call for Proposals the

Re: python's future?

2012-06-15 Thread Mark Lawrence
On 15/06/2012 08:04, Yesterday Paid wrote: I'm very new to programing though I learn very little of java,C I love python and have fun to do something with it but some people said python's future perhaps not that bright. I know this question maybe looks like an idiot:( I really hope the python

Re: python's future?

2012-06-15 Thread Mark Lawrence
On 15/06/2012 08:30, Chris Angelico wrote: On Fri, Jun 15, 2012 at 5:04 PM, Yesterday Paid howmuchisto...@gmail.com wrote: I'm very new to programing though I learn very little of java,C I love python and have fun to do something with it but some people said python's future perhaps not that

does python have bright future?

2012-06-15 Thread Yesterday Paid
I'm very new to programing though I learn very little of java,C I love python and have fun to do something with it but some people said python's future perhaps not that bright. I know this question maybe looks like an idiot:( I really hope the python rules long~ time. what do you think about

Re: python's future?

2012-06-15 Thread Chris Angelico
On Fri, Jun 15, 2012 at 6:05 PM, Mark Lawrence breamore...@yahoo.co.uk wrote: an active and helpful mailing list/newsgroup (hi!)?  Gmane lists 322 entries under comp.python :) Sorry, should have said: A set of active and helpful mailing lists/newsgroups! You're quite right, there's a lot of

Use of internal ctypes objects

2012-06-15 Thread RICHARD MOSELEY
I have a module which makes use of ctypes to interface to the IBM C-ISAM library under linux. I have created a libpyisam.so library which combines the two official libraries, libifisam.so and libifisamx.so and provides a SONAME for the ctypes module (if that is still required). My main object

PIL for the Python 3.2.3

2012-06-15 Thread Gonzalo de Soto
Dear Python Org, It wanted to know if already PIL's version is available for Python 3.2.3. Thanks. Gonzalo -- http://mail.python.org/mailman/listinfo/python-list

Re: PIL for the Python 3.2.3

2012-06-15 Thread Mark Lawrence
On 15/06/2012 13:18, Gonzalo de Soto wrote: Dear Python Org, It wanted to know if already PIL's version is available for Python 3.2.3. Thanks. Gonzalo Please refer to Matthew 7:7 for a way forward. -- Cheers. Mark Lawrence. --

Re: PIL for the Python 3.2.3

2012-06-15 Thread Emile van Sebille
On 6/15/2012 5:18 AM Gonzalo de Soto said... Dear Python Org, It wanted to know if already PIL's version is available for Python 3.2.3. Not yet. See http://www.pythonware.com/products/pil/ Emile -- http://mail.python.org/mailman/listinfo/python-list

Re: PIL for the Python 3.2.3

2012-06-15 Thread Alec Taylor
On Fri, Jun 15, 2012 at 10:18 PM, Gonzalo de Soto gdes...@adinet.com.uywrote: Dear Python Org, It wanted to know if already PIL's version is available for Python 3.2.3. ** ** Thanks. Gonzalo ** ** *

Threads vs subprocesses

2012-06-15 Thread John O'Hagan
I have a program in which the main thread launches a number of CPU-intensive worker threads. For each worker thread two python subprocesses are started, each of which runs in its own terminal: one displays output received from the worker thread via a socket, the other takes text input to control

PyPyODBC 0.5 alpha released! (A Pure Python ODBC module)

2012-06-15 Thread 江文
PyPyODBC - A Pure Python ctypes ODBC module Features -Pure Python, compatible with PyPy (tested on Win32) -Almost totally same usage as pyodbc You can simply try pypyodbc in your existing pyodbc powered script with the following changes: #import pyodbc        

Re: python's future?

2012-06-15 Thread Michael Torrie
On 06/15/2012 01:04 AM, Yesterday Paid wrote: I'm very new to programing though I learn very little of java,C I love python and have fun to do something with it but some people said python's future perhaps not that bright. I know this question maybe looks like an idiot:( I really hope the

Re: which one do you prefer? python with C# or java?

2012-06-15 Thread Alexander Blinne
On 15.06.2012 09:00, Paul Rubin wrote: Alexander Blinne n...@blinne.net writes: def gen_s(): s = [1] m = skipdups(heapq.merge(*[(lambda j: (k*j for k in s))(n) for n in [2,3,5]])) yield s[0] while True: k = m.next() s.append(k) yield k Nice. I wouldn't have

Hashable object with self references OR how to create a tuple that refers to itself

2012-06-15 Thread Edward C. Jones
I am trying to create a collection of hashable objects, where each object contains references to other objects in the collection. The references may be circular. To simplify, one can define x= list() x.append(x) which satisfies x == [x]. Can I create a similar object for tuples which

Python script for device automatic update.

2012-06-15 Thread LoadWalker
Hi, I am completly new to python. I need to create and script that needs to do the following steps and would apreciate if someone can give me the guidelines to do it as will be my first python script: The script will be in a linux machine. Will wait for a device to conect on the usb. So needs

RE: does python have bright future?

2012-06-15 Thread Prasad, Ramit
I'm very new to programing though I learn very little of java,C I love python and have fun to do something with it but some people said python's future perhaps not that bright. I know this question maybe looks like an idiot:( I really hope the python rules long~ time. what do you think about

Re: Python script for device automatic update.

2012-06-15 Thread Michael Hrivnak
Let udev run your script when the appropriate device is connected. http://www.reactivated.net/writing_udev_rules.html Then you just need to run an ssh command against the correct mount point. Honestly, python might be overkill for this. Consider writing a very small bash script. Michael On

Re: Threads vs subprocesses

2012-06-15 Thread Dave Angel
On 06/15/2012 09:49 AM, John O'Hagan wrote: I have a program in which the main thread launches a number of CPU-intensive worker threads. For each worker thread two python subprocesses are started, each of which runs in its own terminal: one displays output received from the worker thread via a

Re: Pythonic cross-platform GUI desingers à la Interface Builder (Re: what gui designer is everyone using)

2012-06-15 Thread Dietmar Schwertberger
Am 15.06.2012 01:07, schrieb Dennis Lee Bieber: Visual Basic was essentially developed as a unified whole (drop a Sure. I prefer modular approaches. I don't see why this should not be possible (e.g. an IDE like Wing integrates well with other tools and frameworks; I'm sure it could also

tiffany 0.4 released

2012-06-15 Thread Christian Tismer
Tiffany - Read/Write Multipage-Tiff with PIL without PIL Tiffany stands for any tiff. The tiny module solves a large set of problems, has no dependencies and just works wherever Python works. Tiffany was developed in the course of the

Re: Pythonic cross-platform GUI desingers à la Interface Builder (Re: what gui designer is everyone using)

2012-06-15 Thread Dietmar Schwertberger
Am 13.06.2012 18:30, schrieb rdst...@mac.com: about Google's Blockly a drag and drop tool for building apps that outputs Python or Javascript code (among others) and it might be usable along these lines...I'm sure serious programmers would not use it but maybe engineers looking to make web front

Re: which one do you prefer? python with C# or java?

2012-06-15 Thread Tomasz Rola
On Fri, 15 Jun 2012, Alexander Blinne wrote: How do Haskell or Scheme determine when elements are not longer needed? Just like Python, they use garbage collection - in one sentence, if it can be proved the object (not a OO-object, just a piece of data) will no longer be needed, it can be

Re: Threads vs subprocesses

2012-06-15 Thread John O'Hagan
On Fri, 15 Jun 2012 11:51:01 -0400 Dave Angel d...@davea.name wrote: On 06/15/2012 09:49 AM, John O'Hagan wrote: I have a program in which the main thread launches a number of CPU-intensive worker threads. For each worker thread two python subprocesses are started, [...] So far so good,

Re: which one do you prefer? python with C# or java?

2012-06-15 Thread Paul Rubin
Alexander Blinne n...@blinne.net writes: An Element of s could be discarded, after every one of the three (k*j for k in s)-generators went over it. I don't think that this is possible with one deque (at least with the built-in merger of heapq, a self-written one could be adapted). Storing

Re: Hashable object with self references OR how to create a tuple that refers to itself

2012-06-15 Thread Dieter Maurer
Edward C. Jones edcjo...@comcast.net writes: I am trying to create a collection of hashable objects, where each object contains references to other objects in the collection. The references may be circular. To simplify, one can define x= list() x.append(x) which satisfies x ==

RE: Threads vs subprocesses

2012-06-15 Thread Prasad, Ramit
My question is, on a single core machine, what are the pros and cons of threads vs subprocesses in a setup like this? [...] Two key phrases in your message; CPU-intensive, single-core-machine. If these have the conventional meaning, you're better off doing all the processing

Re: Need a Python Developer...

2012-06-15 Thread Chris Withers
On 05/06/2012 19:18, o2kcompliant wrote: Hi Guys, I have a need for a Python Developer... How about using the Python job board rather than spamming the mailing list: http://www.python.org/community/jobs/howto/ cheers, Chris -- Simplistix - Content Management, Batch Processing Python

Re: which one do you prefer? python with C# or java?

2012-06-15 Thread Terry Reedy
On 6/15/2012 1:03 PM, Tomasz Rola wrote: Last time I checked, Python didn't have linked lists - arrayed lists are nice, but their elements can't be automatically GC-ed (or, this requires very nontrivial GC algorithm), the easiest way I can think would be replacing them with None manually. I'm

Re: Use of internal ctypes objects

2012-06-15 Thread Terry Reedy
On 6/15/2012 4:28 AM, RICHARD MOSELEY wrote: To check whether the function has been previously converted, I make use of internal objects within the ctypes module, namely, _SimpleCData and _CFuncPtr. Is this a safe thing to do, bearing in mind that the objects are documentated as internal? It

Re: which one do you prefer? python with C# or java?

2012-06-15 Thread Paul Rubin
Terry Reedy tjre...@udel.edu writes: Python iterators can do lazy evaluation. All the builtin classes come with a corresponding iterator. ... I wouldn't say iterators do lazy evaluation in the Scheme or Haskell sense. Lazy evaluation imho means evaluation is deferred until you actually try to

Installing numpy over an older numpy

2012-06-15 Thread Tom Kacvinsky
I am having problems installing a newer version of numpy over an older installation. The general problem is that the older version's distutils code is being used instead of the distutils code in the newer version, no matter how much I play around with sys.path in setup.py and the like. Any

Re: Installing numpy over an older numpy

2012-06-15 Thread Miki Tebeka
Any ideas on how to install a newer version over an older version? pip uninstall numpy pip install numpy -- http://mail.python.org/mailman/listinfo/python-list

Re: PyDoc - Python Documentation Plugin for Eclipse

2012-06-15 Thread Alexey Gaidamaka
On Sun, 10 Jun 2012 12:14:15 +0300, Alexey Gaidamaka wrote: Greets! Since i'm new to Python, i've decided to create a handy plugin for Elipse SDK which is my primary dev environment. Practically the plugin is a simple html archive from python documentation website running inside Eclipse

Re: PyDoc - Python Documentation Plugin for Eclipse

2012-06-15 Thread Alexey Gaidamaka
On Sun, 10 Jun 2012 15:37:50 +, Alexey Gaidamaka wrote: On Sun, 10 Jun 2012 05:02:35 -0500, Andrew Berg wrote: On 6/10/2012 4:22 AM, Alexey Gaidamaka wrote: Practically the plugin is a simple html archive from python documentation website running inside Eclipse so you can call it

Re: usenet reading

2012-06-15 Thread Albert van der Horst
In article jqfjjc$f5s$1...@dont-email.me, Colin Higwell colinh@somewhere.invalid wrote: On Fri, 25 May 2012 15:38:55 -0700, Jon Clements wrote: Is there a server out there where I can get my news groups? I use to be with an ISP that hosted usenet servers, but alas, it's no longer around...

RE: Hashable object with self references OR how to create a tuple that refers to itself

2012-06-15 Thread Prasad, Ramit
I am trying to create a collection of hashable objects, where each object contains references to other objects in the collection. The references may be circular. To simplify, one can define x= list() x.append(x) which satisfies x == [x]. Can I create a similar object for

Re: Pythonic cross-platform GUI desingers à la Interface Builder (Re: what gui designer is everyone using)

2012-06-15 Thread CM
Dietmar quotes: With Python not having an easy-to-use GUI builder, The point is, that if you want to promote Python as replacement for e.g. VB, Labview etc., then an easy-to-use GUI builder is required. The typical GUI programs will just have an input mask, a button and one or two output

Re: python3 raw strings and \u escapes

2012-06-15 Thread Jason Friedman
This is a related question. I perform an octal dump on a file: $ od -cx file 000 h e l l o w o r l d \n 65686c6c206f6f776c720a64 I want to output the names of those characters: $ python3 Python 3.2.3 (default, May 19 2012, 17:01:30)

Re: python3 raw strings and \u escapes

2012-06-15 Thread MRAB
On 16/06/2012 00:42, Jason Friedman wrote: This is a related question. I perform an octal dump on a file: $ od -cx file 000 h e l l o w o r l d \n 65686c6c206f6f776c720a64 I want to output the names of those characters: $ python3

Re: python3 raw strings and \u escapes

2012-06-15 Thread Jason Friedman
This is a related question. I perform an octal dump on a file: $ od -cx file 000   h   e   l   l   o       w   o   r   l   d  \n            6568    6c6c    206f    6f77    6c72    0a64 I want to output the names of those characters: $ python3 Python 3.2.3 (default, May 19 2012,

Re: which one do you prefer? python with C# or java?

2012-06-15 Thread Terry Reedy
On 6/15/2012 3:04 PM, Paul Rubin wrote: Terry Reedytjre...@udel.edu writes: Python iterators can do lazy evaluation. All the builtin classes come with a corresponding iterator. ... I wouldn't say iterators do lazy evaluation in the Scheme or Haskell sense. Lazy evaluation imho means

Academic citation of Python

2012-06-15 Thread Mark Livingstone
Hello! I wish to properly cite Python in an academic paper I am writing. Is there a preferred document etc to cite? Thanks in advance, MArkL -- http://mail.python.org/mailman/listinfo/python-list

Re: Academic citation of Python

2012-06-15 Thread Alec Taylor
Maybe quote the Programming Python book, since Guido wrote the forward? http://www.python.org/doc/essays/foreword2/ On Sat, Jun 16, 2012 at 1:24 PM, Mark Livingstone livingstonem...@gmail.com wrote: Hello! I wish to properly cite Python in an academic paper I am writing. Is there a

Re: which one do you prefer? python with C# or java?

2012-06-15 Thread Tomasz Rola
On Fri, 15 Jun 2012, Terry Reedy wrote: On 6/15/2012 1:03 PM, Tomasz Rola wrote: Last time I checked, Python didn't have linked lists - arrayed lists are nice, but their elements can't be automatically GC-ed (or, this requires very nontrivial GC algorithm), the easiest way I can think

Re: Academic citation of Python

2012-06-15 Thread Ben Finney
Mark Livingstone livingstonem...@gmail.com writes: I wish to properly cite Python in an academic paper I am writing. Is there a preferred document etc to cite? I think you're best positioned to answer that. Python isn't a document, so what specifically are you citing it as? -- \ “A

Re: Academic citation of Python

2012-06-15 Thread Alec Taylor
I think it's more like when you see articles with a passage like: The C programming language[1] or the C++ programming language[2] are both examples of... Are both easy to find the proper reference for. On Sat, Jun 16, 2012 at 2:13 PM, Ben Finney ben+pyt...@benfinney.id.auwrote: Mark

is the same betweent python3 and python3.2?

2012-06-15 Thread contro opinion
when i download python-3.2.3.tgz extract ./configure prefix=/usr/lib/python-3.2 make make install when ls /usr/lib/python-3.2.3/bin/ /usr/lib/python-3.2.3/bin/python3.2m /usr/lib/python-3.2.3/bin/python3-config /usr/lib/python-3.2.3/bin/python3 /usr/lib/python-3.2.3/bin/python3.2m-config

Komodo, Python

2012-06-15 Thread Isaac@AU
I just started learning python. I have komodo2.5 in my computer. And I installed python2.7. I tried to write python scripts in komodo. But every time I run the code, there's always the error: Traceback (most recent call last): File C:\Program Files\ActiveState Komodo 2.5\callkomodo\kdb.py,

Re: which one do you prefer? python with C# or java?

2012-06-15 Thread Alec Taylor
On Sun, Jun 10, 2012 at 8:44 AM, Yesterday Paid howmuchisto...@gmail.com wrote: I'm planning to learn one more language with my python. Someone recommended to do Lisp or Clojure, but I don't think it's a good idea(do you?) So, I consider C# with ironpython or Java with Jython. It's a hard

[issue15061] hmac.secure_compare() leaks information about length of strings

2012-06-15 Thread Hynek Schlawack
Hynek Schlawack h...@ox.cx added the comment: Secure vs not secure is not a binary state - it's about making attacks progressively more difficult. Something that is secure against a casual script kiddie scatter gunning attacks on various sites with an automated script won't stand up to a

[issue15061] hmac.secure_compare() leaks information about length of strings

2012-06-15 Thread Martin v . Löwis
Martin v. Löwis mar...@v.loewis.de added the comment: On 14.06.2012 14:26, Antoine Pitrou wrote: Antoine Pitrou pit...@free.fr added the comment: It's either secure or it's not. I don't think that's true. By that reasoning, Python is not secure so there's no point in fixing crashes or

[issue15061] hmac.secure_compare() leaks information about length of strings

2012-06-15 Thread Martin v . Löwis
Martin v. Löwis mar...@v.loewis.de added the comment: Being able to tell people using hmac.total_compare will make you less vulnerable to timing attacks than using ordinary short circuiting comparisons is a *good thing*. No, it's not. It's a *bad thing*. The two issues that have been opened

[issue15061] hmac.secure_compare() leaks information about length of strings

2012-06-15 Thread Martin v . Löwis
Martin v. Löwis mar...@v.loewis.de added the comment: Why not write a C function which can be more secure than Python code? For Unicode strings, it's impossible to write a time-independent comparison function even in C I would argue that would be an general asset for the stdlib I would

[issue14377] Modify serializer for xml.etree.ElementTree to allow forcing the use of long tag closing

2012-06-15 Thread Serhiy Storchaka
Serhiy Storchaka storch...@gmail.com added the comment: xml.sax.saxutils.XMLGenerator constructor has a parameter short_empty_elements (False by default). For consistency new ElementTree.write parameter must have the same name (True by default for compatibility). --

[issue15061] hmac.secure_compare() leaks information about length of strings

2012-06-15 Thread Hynek Schlawack
Hynek Schlawack h...@ox.cx added the comment: Why not write a C function which can be more secure than Python code? For Unicode strings, it's impossible to write a time-independent comparison function even in C Really? Some comments sounded different. That's too bad but also what I

[issue1470548] Bugfix for #1470540 (XMLGenerator cannot output UTF-16)

2012-06-15 Thread Serhiy Storchaka
Serhiy Storchaka storch...@gmail.com added the comment: The patch updated to reflect Martin's comments. I hope the old behavior now preserved in the most used in practice cases. Tests converted to work with bytes instead of strings. -- Added file:

[issue14035] behavior of test.support.import_fresh_module

2012-06-15 Thread Nick Coghlan
Changes by Nick Coghlan ncogh...@gmail.com: -- status: open - closed ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue14035 ___ ___ Python-bugs-list

[issue15061] hmac.secure_compare() leaks information about length of strings

2012-06-15 Thread Nick Coghlan
Nick Coghlan ncogh...@gmail.com added the comment: Can people please stop raising a false dichotomy and using that as an excuse not to do anything? The decision is not between leak some information and leak no information. It is between leak more information and leak less information. The

[issue15061] hmac.secure_compare() leaks information about length of strings

2012-06-15 Thread Martin v . Löwis
Martin v. Löwis mar...@v.loewis.de added the comment: Well, one example: https://github.com/mitsuhiko/python-pbkdf2/blob/master/pbkdf2.py It says that it needs that, but I fail to understand why. pbkdf2 is used to generate encryption keys from passwords, where you don't need to compare

[issue15074] Strange behaviour of python cmd module. (Ignores slash)

2012-06-15 Thread jsevilleja
New submission from jsevilleja j...@jsevilleja.org: I've used the code from here: http://stackoverflow.com/questions/5637124/tab-completion-in-pythons-raw-input/5638688#5638688 and it works. But I've used the same code in a class which inherits from cmd.Cmd, and the code doesn't works. Doing

[issue15061] hmac.secure_compare() leaks information about length of strings

2012-06-15 Thread Nick Coghlan
Nick Coghlan ncogh...@gmail.com added the comment: To repeat, the specific feature being proposed for retention is: * a function called hmac.total_compare() that is clearly documented as being still vulnerable to timing analysis given a sufficiently sophisticated attacker, while still being

[issue15061] hmac.secure_compare() leaks information about length of strings

2012-06-15 Thread Martin v . Löwis
Martin v. Löwis mar...@v.loewis.de added the comment: The timing variations with standard comparison are relatively massive and relatively easy to analyse (if the time taken goes up, you got the previous digit correct). If you have an application that is vulnerable to such an attack, you

[issue15061] hmac.secure_compare() leaks information about length of strings

2012-06-15 Thread Martin v . Löwis
Martin v. Löwis mar...@v.loewis.de added the comment: To repeat, the specific feature being proposed for retention is: To repeat, no use case has been demonstrated for that function. It has been added because it was fun to write, not because it is useful. --

[issue15061] hmac.secure_compare() leaks information about length of strings

2012-06-15 Thread Maciej Fijalkowski
Maciej Fijalkowski fij...@gmail.com added the comment: On Fri, Jun 15, 2012 at 9:41 AM, Nick Coghlan rep...@bugs.python.orgwrote: Nick Coghlan ncogh...@gmail.com added the comment: To repeat, the specific feature being proposed for retention is: * a function called hmac.total_compare()

[issue15061] hmac.secure_compare() leaks information about length of strings

2012-06-15 Thread Maciej Fijalkowski
Maciej Fijalkowski fij...@gmail.com added the comment: On Fri, Jun 15, 2012 at 9:47 AM, Martin v. Löwis rep...@bugs.python.orgwrote: Martin v. Löwis mar...@v.loewis.de added the comment: To repeat, the specific feature being proposed for retention is: To repeat, no use case has been

[issue15061] hmac.secure_compare() leaks information about length of strings

2012-06-15 Thread Hynek Schlawack
Hynek Schlawack h...@ox.cx added the comment: and any other place that compares passwords, tokens, … No no no. Any sensible place to compare passwords would use some sort of one-way function (password hash) before the comparison, so that someone breaking into the machine will not gain the

[issue15061] hmac.secure_compare() leaks information about length of strings

2012-06-15 Thread Nick Coghlan
Nick Coghlan ncogh...@gmail.com added the comment: I'm not really opposed to writing it in C - I just don't think rewriting it in C should be a requirement for keeping it. Even in pure Python, it still leaks less information than the standard comparison operator. --

[issue15061] hmac.secure_compare() leaks information about length of strings

2012-06-15 Thread Maciej Fijalkowski
Maciej Fijalkowski fij...@gmail.com added the comment: On Fri, Jun 15, 2012 at 9:55 AM, Hynek Schlawack rep...@bugs.python.orgwrote: Hynek Schlawack h...@ox.cx added the comment: and any other place that compares passwords, tokens, … No no no. Any sensible place to compare passwords

[issue15061] hmac.secure_compare() leaks information about length of strings

2012-06-15 Thread Martin v . Löwis
Martin v. Löwis mar...@v.loewis.de added the comment: Is comparing passwords against a secure one not useful? I claim that this use case doesn't occur in practice. Everybody uses hashed passwords. If they do compare against a plain-text password, and they want to change something about it,

[issue15061] hmac.secure_compare() leaks information about length of strings

2012-06-15 Thread Nick Coghlan
Nick Coghlan ncogh...@gmail.com added the comment: This point was discussed in #14532 when the new API was added. From http://bugs.python.org/issue14532#msg158045: Given that this issue has affected a lot of security-sensitive third-party code (keyczar, openid providers, almost every python

[issue14991] Option for regex groupdict() to show only matching names

2012-06-15 Thread Ezio Melotti
Changes by Ezio Melotti ezio.melo...@gmail.com: -- components: +Regular Expressions nosy: +ezio.melotti, mrabarnett stage: - needs patch ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue14991

[issue15061] hmac.secure_compare() leaks information about length of strings

2012-06-15 Thread Martin v . Löwis
Martin v. Löwis mar...@v.loewis.de added the comment: I see your point that adding such a function would leverage bad security behavior and thus may be a bad thing. The usefulness of such a function to some(?) people is IMHO not disputable though. I think this entire issue is out of scale.

[issue15007] Unittest CLI does not support test packages very well

2012-06-15 Thread Ezio Melotti
Changes by Ezio Melotti ezio.melo...@gmail.com: -- nosy: +ezio.melotti ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue15007 ___ ___

[issue15019] String termination on Linux

2012-06-15 Thread Ezio Melotti
Changes by Ezio Melotti ezio.melo...@gmail.com: -- nosy: +ezio.melotti ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue15019 ___ ___

[issue15034] tutorial should use best practices in user defined exceptions section

2012-06-15 Thread Ezio Melotti
Changes by Ezio Melotti ezio.melo...@gmail.com: -- nosy: +ezio.melotti ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue15034 ___ ___

[issue14998] pprint._safe_key is not always safe enough

2012-06-15 Thread Ezio Melotti
Changes by Ezio Melotti ezio.melo...@gmail.com: -- nosy: +ezio.melotti stage: needs patch - patch review ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue14998 ___

[issue15009] urlsplit can't round-trip relative-host urls.

2012-06-15 Thread Ezio Melotti
Changes by Ezio Melotti ezio.melo...@gmail.com: -- nosy: +ezio.melotti stage: - needs patch type: - behavior versions: +Python 3.3 -Python 2.6 ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue15009

[issue15061] hmac.secure_compare() leaks information about length of strings

2012-06-15 Thread Martin v . Löwis
Martin v. Löwis mar...@v.loewis.de added the comment: Note that this does not relief you from using a time-independent comparison function. If you call some hash function (which time is known to the attacker), then you compare it against a stored hashed version. If you use a normal compare

[issue15061] hmac.secure_compare() leaks information about length of strings

2012-06-15 Thread Maciej Fijalkowski
Maciej Fijalkowski fij...@gmail.com added the comment: On Fri, Jun 15, 2012 at 10:09 AM, Martin v. Löwis rep...@bugs.python.orgwrote: Martin v. Löwis mar...@v.loewis.de added the comment: Note that this does not relief you from using a time-independent comparison function. If you call

[issue15061] hmac.secure_compare() leaks information about length of strings

2012-06-15 Thread Martin v . Löwis
Martin v. Löwis mar...@v.loewis.de added the comment: For password hashing, the attacker is unlikely to be able to provide the digest directly, but for signature checking it's far more likely to be the case. Can you elaborate? What is the application, where is the digest checking, and what

[issue11600] PY_CFLAGS and PY_CPPFLAGS inconsistent

2012-06-15 Thread Serhiy Storchaka
Serhiy Storchaka storch...@gmail.com added the comment: PY_CFLAGS (C compiler flags) always used with PY_CPPFLAGS (C preprocessor flags). The include directories need for #include, so it is logical that PY_CPPFLAGS did contain them. This may be useful if you use C preprocessor without C

[issue15075] XincludeTest failure in test_xml_etree

2012-06-15 Thread Eli Bendersky
New submission from Eli Bendersky eli...@gmail.com: The XincludeTest test-case in test_xml_etree is now skipped, because it fails in an intermittent manner. I can reproduce the failure when running full regrtest with -j1, but not -j8, and not when run individually. The failure is most likely

[issue15061] hmac.secure_compare() leaks information about length of strings

2012-06-15 Thread Martin v . Löwis
Martin v. Löwis mar...@v.loewis.de added the comment: Martin, you fail to understand how this works. You don't do 2**32 tries to leak the 4 charaters, you need 4 * 256, that's why this attack is so bad, because the time needed for the next character is brute force, but then you can move on

[issue15061] hmac.secure_compare() leaks information about length of strings

2012-06-15 Thread Nick Coghlan
Nick Coghlan ncogh...@gmail.com added the comment: That's why the vulnerable cases are far more likely to be related to *signature* checking. In those you can generally provide both the hash input (the message) and the hash target (the purported signature). If the signature check uses a

[issue15075] XincludeTest failure in test_xml_etree

2012-06-15 Thread Nick Coghlan
Changes by Nick Coghlan ncogh...@gmail.com: -- nosy: +ncoghlan ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue15075 ___ ___ Python-bugs-list

[issue15061] hmac.secure_compare() leaks information about length of strings

2012-06-15 Thread Petri Lehtinen
Petri Lehtinen pe...@digip.org added the comment: For example, Django uses time independent comparison to compare signatures of signed cookies. A signed cookie consists of a plain-text value followed by a signature. An attacker wants to construct a cookie that has a malformed value and a

[issue15073] commands.getoutput() is broken

2012-06-15 Thread Amaury Forgeot d'Arc
Amaury Forgeot d'Arc amaur...@gmail.com added the comment: The documentation http://docs.python.org/library/commands.html prominently says Platforms: Unix. This module does not work on Windows. You should really use the subprocess module: import subprocess output =

[issue15061] hmac.secure_compare() leaks information about length of strings

2012-06-15 Thread Nick Coghlan
Nick Coghlan ncogh...@gmail.com added the comment: FWIW, Petri's example also explains why leaking the expected length of the string is considered an acceptable optimisation in most reimplementations of this signature check comparison: the attacker is assumed to already know the expected

[issue12508] Codecs Anomaly

2012-06-15 Thread Serhiy Storchaka
Changes by Serhiy Storchaka storch...@gmail.com: -- versions: +Python 2.7, Python 3.3 Added file: http://bugs.python.org/file26013/fffd-2.py ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue12508

[issue1598083] Top-level exception handler writes to stdout unsafely

2012-06-15 Thread Serhiy Storchaka
Serhiy Storchaka storch...@gmail.com added the comment: It looks like another reason to replace codecs.open on io.open. -- nosy: +storchaka ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue1598083

[issue15061] hmac.secure_compare() leaks information about length of strings

2012-06-15 Thread Martin v . Löwis
Martin v. Löwis mar...@v.loewis.de added the comment: That's why the vulnerable cases are far more likely to be related to *signature* checking. In those you can generally provide both the hash input (the message) and the hash target (the purported signature). I see. I wonder how feasible

[issue5067] Error msg from using wrong quotes in JSON is unhelpful

2012-06-15 Thread Serhiy Storchaka
Serhiy Storchaka storch...@gmail.com added the comment: Patch adapted for Python 3.3. Consistently changed messages in C code, docs and docstrings. -- components: +Documentation nosy: +storchaka versions: +Python 2.7, Python 3.2, Python 3.3 -Python 2.6 Added file:

[issue15061] hmac.secure_compare() leaks information about length of strings

2012-06-15 Thread Armin Rigo
Changes by Armin Rigo ar...@users.sourceforge.net: -- nosy: -arigo ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue15061 ___ ___ Python-bugs-list

  1   2   >