Re: Removing pickle from cookie-based session storage

2011-11-11 Thread Donald Stufft
Can we provide a setting that lets you switch between the two? Then you can let developers choose their poison? On Friday, November 11, 2011 at 6:25 PM, hcarvalhoalves wrote: > On 10 nov, 18:05, Paul McMillan wrote: > > > There's no reason to not use JSON by default since it's adequate for > >

Re: Anyone have ideas on #16550 - custom SQL before/after syncdb?

2013-05-18 Thread Donald Stufft
send an > email to django-developers+unsubscr...@googlegroups.com. > To post to this group, send email to django-developers@googlegroups.com. > Visit this group at http://groups.google.com/group/django-developers?hl=en. > For more options, visit https://groups.google.com/groups/opt_out. > > - Donald Stufft PGP: 0x6E3CBCE93372DCFA // 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA signature.asc Description: Message signed with OpenPGP using GPGMail

Re: Anyone have ideas on #16550 - custom SQL before/after syncdb?

2013-05-21 Thread Donald Stufft
t the end for every model you think you touched). >> >> However, the patch Donald linked would be a lot easier to emulate, so I'm >> not that against it. >> >> Andrew >> >> >> On Sat, May 18, 2013 at 7:15 PM, Donald Stufft wrote: >>&g

Re: Combine localflavor apps again

2013-05-21 Thread Donald Stufft
an > email to django-developers+unsubscr...@googlegroups.com. > To post to this group, send email to django-developers@googlegroups.com. > Visit this group at http://groups.google.com/group/django-developers?hl=en. > For more options, visit https://groups.google.com/groups/opt_out. > > This sounds ok to me. - Donald Stufft PGP: 0x6E3CBCE93372DCFA // 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA signature.asc Description: Message signed with OpenPGP using GPGMail

Re: Proposal: implement Postgres CLUSTER USING by default for MtM tables

2013-05-22 Thread Donald Stufft
. > Visit this group at http://groups.google.com/group/django-developers?hl=en. > For more options, visit https://groups.google.com/groups/opt_out. > > What do you mean by "clustering by default". CLUSTER is a one time operation. You use to to arrange the orders of the row in a tabl

Re: Anyone have ideas on #16550 - custom SQL before/after syncdb?

2013-05-22 Thread Donald Stufft
On May 21, 2013, at 12:11 PM, peter wrote: > +1 on pre_syncdb > > On Tuesday, May 21, 2013 8:29:49 AM UTC-7, Shai Berger wrote: > On Tuesday 21 May 2013, Donald Stufft wrote: > > I run migrations in test. How else will you know your db reflects reality > > :/ >

Re: Migrations, commands and syncdb

2013-05-30 Thread Donald Stufft
from this group and stop receiving emails from it, send an > email to django-developers+unsubscr...@googlegroups.com. > To post to this group, send email to django-developers@googlegroups.com. > Visit this group at http://groups.google.com/group/django-developers?hl=en. > For more options, visit https://groups.google.com/groups/opt_out. > > I vote #3. - Donald Stufft PGP: 0x6E3CBCE93372DCFA // 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA signature.asc Description: Message signed with OpenPGP using GPGMail

Re: Meta-Proposal: Write *above* quotations in mailing list replies

2013-06-04 Thread Donald Stufft
opers?hl=en. > For more options, visit https://groups.google.com/groups/opt_out. > > I think trying to get anyone to change their posting habit is a futile effort. - Donald Stufft PGP: 0x6E3CBCE93372DCFA // 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA signature.asc Description: Message signed with OpenPGP using GPGMail

Re: RFC: "universal" view decorators

2013-06-08 Thread Donald Stufft
gt; Part of the reasoning of my original Change to make decorators classes was that it enabled much easier customization of them. Currently you basically either hope there was an option for doing what you wanted, or you copy/paste the entire thing and modify it. Using a class lets yo

Re: Question about password salt and encryption

2013-06-15 Thread Donald Stufft
elopers@googlegroups.com. > Visit this group at http://groups.google.com/group/django-developers. > For more options, visit https://groups.google.com/groups/opt_out. > > Backwards compatibility is easy. Just add a new hasher. - Donald Stufft PGP: 0x6E3CBCE93372DCFA // 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA signature.asc Description: Message signed with OpenPGP using GPGMail

Re: Security Advisory: BREACH and Django

2013-08-06 Thread Donald Stufft
email to django-developers+unsubscr...@googlegroups.com. > To post to this group, send email to django-developers@googlegroups.com. > Visit this group at http://groups.google.com/group/django-developers. > For more options, visit https://groups.google.com/groups/opt_out. > > --

Re: Security Advisory: BREACH and Django

2013-08-06 Thread Donald Stufft
essage because you are subscribed to the Google Groups > "Django developers" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to django-developers+unsubscr...@googlegroups.com. > To post to this group, send email to django-developers@googlegroups.co

Re: Security Advisory: BREACH and Django

2013-08-06 Thread Donald Stufft
can be > set in location. Yes, any response which does not include secret data can be compressed. ----- Donald Stufft PGP: 0x6E3CBCE93372DCFA // 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA signature.asc Description: Message signed with OpenPGP using GPGMail

Re: GZipMiddleWare documentation

2013-08-09 Thread Donald Stufft
el is going to be important. The application knows what *kind* of data exists in a response body and wether or not it is safe to compress it. The web server does not (except by crude heuristics such as path). - Donald Stufft PGP: 0x6E3CBCE93372DCFA // 7C6B 7C5D 5E2B 6356 A926 F04

Re: Deprecation a little harsh?

2013-08-13 Thread Donald Stufft
is probably going to be one of the biggest blockers. Without CI it's up to the merging developers to run the tests on all the combinations of stuff we support which isn't the easiest or the quickest thing to setup and maintain. - Donald Stufft PGP: 0x6E3CBCE93372DCFA /

Re: Idiot makes mistake

2013-08-20 Thread Donald Stufft
. If anyone made any commits in the last hour you should probably double check to make sure they are there. I'm pretty sure we got it restored but doesn't hurt to double check. - Donald Stufft PGP: 0x6E3CBCE93372DCFA // 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA signature.asc Description: Message signed with OpenPGP using GPGMail

Re: Idea about authentication

2013-09-15 Thread Donald Stufft
t; "Django developers" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to django-developers+unsubscr...@googlegroups.com. > To post to this group, send email to django-developers@googlegroups.com. > Visit this group at http://groups.google.com/group/django-developers. > For more options, visit https://groups.google.com/groups/opt_out. - Donald Stufft PGP: 0x6E3CBCE93372DCFA // 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA signature.asc Description: Message signed with OpenPGP using GPGMail

Re: Idea about authentication

2013-09-15 Thread Donald Stufft
ely, but who knows). According to Thomas Porin in the context of bcrypt pre-hashing the password is fine (and we already do this in Django 1.6). I see no reason the same wouldn't hold true for PBKDF2. - Donald Stufft PGP: 0x6E3CBCE93372DCFA // 7C6B 7C5D 5E2B 6356 A926 F04F

Re: Default session data serializer doesn't support extended data types

2013-09-20 Thread Donald Stufft
em. Moving away from pickle as the default serialization engine ensures this property for the storage of session data. - Donald Stufft PGP: 0x6E3CBCE93372DCFA // 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA signature.asc Description: Message signed with OpenPGP using GPGMail

Re: Performance Docs

2013-09-20 Thread Donald Stufft
group. > To unsubscribe from this group and stop receiving emails from it, send an > email to django-developers+unsubscr...@googlegroups.com. > To post to this group, send email to django-developers@googlegroups.com. > Visit this group at http://groups.google.com/group/django-deve

Re: BCrypt and PBKDF2 Password Hash Caching

2013-11-19 Thread Donald Stufft
7;s fast enough that it doesn't negatively impact your site but as slow as possible otherwise. The higher the work factor/iterations the harder it is to brute force, but the more negative impact each login has. I would tune bcrypt or PBKDF2 down before I implemented this custom scheme. --

Re: Using setuptools to make django-admin.py runnable on Windows (#21340)

2013-11-24 Thread Donald Stufft
The recommended build tool at the moment is setuptools. It's up to the individual project to decide if they think the install story for setutpools pre 3.4 is appropriate for them. This'll get better in general in the future with MSI installers for setuptools and pip > On Nov 24, 2013, at 2:37

Re: Using setuptools to make django-admin.py runnable on Windows (#21340)

2013-12-04 Thread Donald Stufft
ail to django-developers+unsubscr...@googlegroups.com. > To post to this group, send email to django-developers@googlegroups.com. > Visit this group at http://groups.google.com/group/django-developers. > To view this discussion on the web visit > https://groups.google.com/d/msg

Re: Using setuptools to make django-admin.py runnable on Windows (#21340)

2013-12-04 Thread Donald Stufft
On Dec 4, 2013, at 5:51 PM, Florian Apolloner wrote: > On Wednesday, December 4, 2013 11:20:39 PM UTC+1, Donald Stufft wrote: > entry points are kinda wonky with pip 1.4, pip 1.5 makes them sane. You would > not need a Windows specific Wheel with pip 1.5 > > Is there a test-pyp

Re: [GSoC] Switching to Jinja2 proposal

2014-02-12 Thread Donald Stufft
st to this group, send email to django-developers@googlegroups.com. > Visit this group at http://groups.google.com/group/django-developers. > To view this discussion on the web visit > https://groups.google.com/d/msgid/django-developers/CAG_XiSBmOU%3D4orZnW13bw-ZLT_O416unynhtnQ9%3DhgPtL9Bbtw%40mail.gmail.com. > For more options, visit https://groups.google.com/groups/opt_out. - Donald Stufft PGP: 0x6E3CBCE93372DCFA // 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA signature.asc Description: Message signed with OpenPGP using GPGMail

Re: [GSoC] Switching to Jinja2 proposal

2014-02-15 Thread Donald Stufft
from it, send an > email to django-developers+unsubscr...@googlegroups.com. > To post to this group, send email to django-developers@googlegroups.com. > Visit this group at http://groups.google.com/group/django-developers. > To view this discussion on the web visit > https://groups.googl

Re: [GSoC] Switching to Jinja2 proposal

2014-02-16 Thread Donald Stufft
rt 3.2? > > Donald might be able to offer better hard numbers based on e.g. PyPI > usage, but my impression is that usage of 3.2 is very low, and dropping > it for 1.8 would not be a major problem. These numbers are about a month old, but https://gist.github.com/dstufft/8455306 >

Re: DEPs: Django Enhancement Proposals

2014-04-14 Thread Donald Stufft
Accepted and it stays that way until it gets implemented and committed. Then it changes from accepted to final and the PEP process is done. One thing i’m not sure of, how is DEPs going to work without a BDFL? Generally they are used to get feedback and provide a clear concise argument to the BDFL

Re: use semantic versioning after 2.0?

2014-07-14 Thread Donald Stufft
googlegroups.com. > To post to this group, send email to django-developers@googlegroups.com. > Visit this group at http://groups.google.com/group/django-developers. > To view this discussion on the web visit > https://groups.google.com/d/msgid/django-developers/5fab23be-1411-4813-bfbe-e

Re: Pull django-registration into contrib?

2014-08-01 Thread Donald Stufft
or the registration system since generally most pieces of a site do not interact with the registration system, especially not at the level as they would for the generic concept of users or database migrations. -- Donald Stufft PGP: 0x6E3CBCE93372DCFA // 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9

Re: FR: Setting for CSRF Header (pull-request included)

2014-08-04 Thread Donald Stufft
ipt would break with this setting although i’m inclined to say you shouldn’t change the setting in that case. -- Donald Stufft PGP: 0x6E3CBCE93372DCFA // 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA -- You received this message because you are subscribed to the Google Groups "Django de

Re: Django and BREACH (remember that?)

2014-08-04 Thread Donald Stufft
On August 3, 2014 at 9:48:53 PM, Adam Brenecki (adambrene...@gmail.com) wrote: > The patch I've written implements this mitigation, with one difference: > instead of using xor, it uses a Vigenère cipher (as suggested by FunkyBob), > as xor was creating non-printable characters which caused problems

Re: Requiring GitHub login for actions on Trac

2014-08-07 Thread Donald Stufft
I think we could just pull permissions from GitHub? --- Donald Stufft PGP: 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA -- You received this message because you are subscribed to the Google Groups "Django developers" group. To unsubscribe from this group and stop receiving

Re: integrating django-secure

2014-09-01 Thread Donald Stufft
d/django-developers/2d66a232-1f19-4bcc-8178-7e1e060f497b%40googlegroups.com?utm_medium=email&utm_source=footer>. >> For more options, visit https://groups.google.com/d/optout >> <https://groups.google.com/d/optout>. > > > -- > You received this message be

Re: remove support for unsalted password hashers?

2016-02-02 Thread Donald Stufft
ible lower case alpha numeric of 6 characters or less in under a minute on a single regular desktop/server.. I don’t believe the distinction is useful. --------- Donald Stufft PGP: 0x6E3CBCE93372DCFA // 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA -- You received this message

Re: remove support for unsalted password hashers?

2016-02-05 Thread Donald Stufft
s happen to use md5(md5(pass) + md5(pass)) for passwords? You can implement them still sure, there’s nothing stopping you. You can also do bcrypt(md5(md5(pass) + md5(pass)) and then you’ve fixed the issue without needing to issue a password reset. - Donald Stufft PGP: 0x6E3

Re: remove support for unsalted password hashers?

2016-02-05 Thread Donald Stufft
vial to migrate the database to make the hashed password conform to the format. - Donald Stufft PGP: 0x6E3CBCE93372DCFA // 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA -- You received this message because you are subscribed to the Google Groups "Django developers (Cont

Re: Feedback on Django Channels

2016-03-22 Thread Donald Stufft
, at least from Python, it’s not any harder to connect to a TLS’d Redis server. ----- Donald Stufft PGP: 0x6E3CBCE93372DCFA // 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA -- You received this message because you are subscribed to the Google Groups "Django developers (Co

Re: Vendoring multipledispatch

2016-04-04 Thread Donald Stufft
g at this specific thing too closely, maybe it’s time for Django to gain a required dependency instead of bundling or reinventing everything? - Donald Stufft PGP: 0x6E3CBCE93372DCFA // 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA -- You received this message because you

Re: Vendoring multipledispatch

2016-04-07 Thread Donald Stufft
n ImageField, or bcrypt, etc. Having ``pip install Django`` work but not ``pip install Django psycopg2`` when you’re running a site that uses PostgreSQL doesn’t get you anything extra there. - Donald Stufft PGP: 0x6E3CBCE93372DCFA // 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 D

Re: Vendoring multipledispatch

2016-04-07 Thread Donald Stufft
but nice quality of life things are: * Massively reduced verbosity on install. * Nicer progress bars. > Anyway as long as Django is installed in a virtualenv this shouldn't be too > much of an issue, but I think we should expect some issues from the users and > these should

Thoughts on ASGI or Why I don't see myself ever wanting to use ASGI

2016-05-06 Thread Donald Stufft
P/Websocket and you don't have to go and teach say, Erlang how to ASGI. [1] This gets exposed in a variety of ways in different servers. In gunicorn it shows up as a SystemExit exception, in uWSGI I believe it shows up as an IOError. In something like Twisted or AsyncIO it would

Re: Thoughts on ASGI or Why I don't see myself ever wanting to use ASGI

2016-05-06 Thread Donald Stufft
> On May 6, 2016, at 1:45 PM, Andrew Godwin wrote: > > Want to just cover a few more things I didn't in my reply to Aymeric. > > On Fri, May 6, 2016 at 9:11 AM, Donald Stufft <mailto:don...@stufft.io>> wrote: > > In short, I think that the message bus add

Re: Thoughts on ASGI or Why I don't see myself ever wanting to use ASGI

2016-05-06 Thread Donald Stufft
d a queue to allow calling sync user code from an async process, you just use the primitives provided by the async framework. ----- Donald Stufft PGP: 0x6E3CBCE93372DCFA // 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA -- You received this message because you are subscribed to the Goog

Re: Should we require pytz for timezone support in Django?

2016-06-04 Thread Donald Stufft
l to install as a pure python library like pytz. [1] Using the now public metrics database. — Donald Stufft -- You received this message because you are subscribed to the Google Groups "Django developers (Contributions to Django itself)" group. To unsubscribe from this group and s

Re: Extend support for long surnames in Django Auth

2016-07-30 Thread Donald Stufft
contains more than > 100 characters and that isn’t a joke. How would it fit on a passport? See #6 of https://www.kalzumeus.com/2010/06/17/falsehoods-programmers-believe-about-names/ — Donald Stufft -- You received this message because you are subscribed to the Google Groups "Django

<    1   2