Re: HMAC and timing based attacks - ticket #14445

2010-10-11 Thread Nick Phillips
On Mon, 2010-10-11 at 23:38 +0100, Luke Plant wrote: > Hi all > > For a while this has been on my TODO list, but I've finally got round to > it: > > * Use HMAC where appropriate in Django > * Fix timing based attacks. Cool. I'd been wondering about this for a while. > - is the new method (using

HMAC and timing based attacks - ticket #14445

2010-10-11 Thread Luke Plant
Hi all For a while this has been on my TODO list, but I've finally got round to it: * Use HMAC where appropriate in Django * Fix timing based attacks. http://code.djangoproject.com/ticket/14445 The only difficulty is with the first due to backwards compatibility - the tokens/hashes generated by

Re: Pylibmc Support: Part 2

2010-10-11 Thread Jacob Burch
On Oct 8, 12:36 am, Russell Keith-Magee wrote: > > * Pylibmc 1.1 doesn't play that nice with mod_wsgi due to it's use of > > the Simplified GIL API > > (see:http://www.dctrwatson.com/2010/09/beware-of-using-pylibmc-1-1-and-mod...). > > Probably just need to make note of it in the documentation, b

Re: Field localize useless

2010-10-11 Thread Michel Thadeu Sabchuk
Hi Russel! > > While I digging to find the bug, I see that the DecimalField (and even > > the Field class) uses a "localize" attribute. I think this localize > > attribute is useless and I not alone: > > Well, no - it isn't useless. It was introduced for a very specific reason. > > Even if you are

Re: Ticket #5416 -- assertNumQueries

2010-10-11 Thread Alex Gaynor
On Mon, Oct 11, 2010 at 2:05 PM, Jacob Kaplan-Moss wrote: > On Mon, Oct 11, 2010 at 12:29 PM, Alex Gaynor wrote: >> I've uploaded a new patch [...] > > Looks pretty good to me. > > I must say, though, that I'm not completely happy with the API. I find > ``assertNumQueries(number, callable)`` a bi

Re: Ticket #5416 -- assertNumQueries

2010-10-11 Thread Jacob Kaplan-Moss
On Mon, Oct 11, 2010 at 12:29 PM, Alex Gaynor wrote: > I've uploaded a new patch [...] Looks pretty good to me. I must say, though, that I'm not completely happy with the API. I find ``assertNumQueries(number, callable)`` a bit non-obvious. The context manager helps quite a bit, but I'd really p

Re: Migrating doctests to unittests

2010-10-11 Thread Alex Gaynor
On Mon, Oct 11, 2010 at 12:55 AM, Russell Keith-Magee wrote: > On Mon, Oct 11, 2010 at 12:43 PM, Alex Gaynor wrote: >> On Mon, Oct 11, 2010 at 12:41 AM, Henrique Bastos >> wrote: >>> Alex, >>> Is there any specific branch on unit testing migration? It would be useful >>> to understand the work

Re: Ticket #5416 -- assertNumQueries

2010-10-11 Thread Alex Gaynor
On Mon, Oct 11, 2010 at 4:47 AM, Russell Keith-Magee wrote: > On Mon, Oct 11, 2010 at 4:35 PM, Andrew Godwin wrote: >> On 11/10/10 07:05, Alex Gaynor wrote: >>> >>> I think the solution there is something like: >>> >>> @skipUnless(sys.version>= (2, 5)) >>> def test(self): >>>     exec """ >>>    

Re: Possible thread-safety regression for sitemaps in r13980

2010-10-11 Thread Luke Plant
On Sun, 2010-10-10 at 15:17 -0700, Gabriel Hurley wrote: > I believe you are correct, since sitemaps are global objects, this > would not be thread-safe. Fixing it should be fairly easy, however. > > Setting self.request was only necessary for two reasons: > > 1. Sitemap.get_urls() uses it, but

Re: Ticket #5416 -- assertNumQueries

2010-10-11 Thread Russell Keith-Magee
On Mon, Oct 11, 2010 at 4:35 PM, Andrew Godwin wrote: > On 11/10/10 07:05, Alex Gaynor wrote: >> >> I think the solution there is something like: >> >> @skipUnless(sys.version>= (2, 5)) >> def test(self): >>     exec """ >>        from __future__ import with_statement >>        with self.assertNum

Re: Ticket #5416 -- assertNumQueries

2010-10-11 Thread Andrew Godwin
On 11/10/10 07:05, Alex Gaynor wrote: I think the solution there is something like: @skipUnless(sys.version>= (2, 5)) def test(self): exec """ from __future__ import with_statement with self.assertNumQueries(1): Model.objects.get(pk=2) """ Not exactly beau