Re: Django and BREACH (remember that?)

2014-08-03 Thread Justin Holmes
Thanks for much for this contribution. I don't feel particularly qualified to review it, but there's are particular bits where general django knowledge (or even just a second pair of eyes) will help, let the know. On Aug 3, 2014 9:48 PM, "Adam Brenecki" wrote: > Hi all, > > So, a while ago, BREA

Django and BREACH (remember that?)

2014-08-03 Thread Adam Brenecki
Hi all, So, a while ago, BREACH happened, and Django's CSRF implementation was vulnerable, as was Rails'. The paper that discussed it described a mitigation (and a Rails patch had already been made), so I implemented that same mitigation in a Django patch. Discussion on the Trac ticket has sta

Re: [GSOC] Weekly update

2014-08-03 Thread Daniel Pyrathon
Hi Aymeric, Thanks for writing back On Sunday, August 3, 2014 4:24:27 PM UTC+2, Aymeric Augustin wrote: > > On 3 août 2014, at 15:11, Daniel Pyrathon > > wrote: > > *1) get_fields should return a list instead of a tuple* > Previously, get_fields would return a tuple. The main reason was related

Re: [GSOC] Weekly update

2014-08-03 Thread Aymeric Augustin
On 3 août 2014, at 15:11, Daniel Pyrathon wrote: > 1) get_fields should return a list instead of a tuple > Previously, get_fields would return a tuple. The main reason was related to > memory and immutability. After discussing with Russell, we decided this > endpoint should actually return a li

Re: [GSOC] Weekly update

2014-08-03 Thread Daniel Pyrathon
Hi All, First of all Thank you SO MUCH for your comments. It's really nice to hear great feedback from the community. These last two weeks I have been working on improving the existing API implementation and terminology. Here is an overview of the 3 main tasks: *1) get_fields should return a li