[issue26839] Python 3.5 running on Linux kernel 3.17+ can block at startup or on importing the random module on getrandom()

2016-06-07 Thread Colm Buckley
Colm Buckley added the comment: ... the script is /lib/systemd/system-generators/systemd-crontab-generator, although that's not hugely germane to the discussion. Arranging for PYTHONHASHSEED to be set while it's called wouldn't be impossible of course, although a command-line flag would be eas

[issue26839] Python 3.5 running on Linux kernel 3.17+ can block at startup or on importing the random module on getrandom()

2016-06-07 Thread Larry Hastings
Larry Hastings added the comment: > PSRT VETO! This is an amusing concept, but membership in the PSRT does not empower you with a "veto". On the other hand, being Release Manager does give me some say here. > You wouldn't add a workaround for broken CPU instructions to math.c or > semi-fun

[issue26839] Python 3.5 running on Linux kernel 3.17+ can block at startup or on importing the random module on getrandom()

2016-06-07 Thread Donald Stufft
Donald Stufft added the comment: > Please note: this is *not* just a VM/cloud issue. This is observed on > physical standalone systems. But it should only occur on initial boot I believe? AFAIK all of the major linux vendors have stored a seed file once the machine has been booted and the poo

[issue26839] Python 3.5 running on Linux kernel 3.17+ can block at startup or on importing the random module on getrandom()

2016-06-07 Thread Donald Stufft
Donald Stufft added the comment: > ISTM that the happy middle ground would be: > * seed the random module with non-cryptographically-secure random bits > * lazily seed hashlib I don't think it was actually hashlib that was causing the problem, but rather the initialization of SipHash, it just

[issue26556] Update expat to 2.2.1

2016-06-07 Thread Christian Heimes
Christian Heimes added the comment: There is another security release for expat planned, but we can skip it for now. I'll provide a patch for Python 2 and 3 with 2.1.1 by tomorrow. -- ___ Python tracker __

[issue27251] TypeError in logging.HTTPHandler.emit; possible python 2 to 3 conversion issue

2016-06-07 Thread Théo Bueno
New submission from Théo Bueno: When trying to log a message with a registered HTTPHandler, using http authentication (by specifying a credentials tuple when constructing an HTTPHandler): logging/handlers.py, in HTTPHandler.emit: if self.credentials: import base64 s = ('u%s:%s' % se

[issue26839] Python 3.5 running on Linux kernel 3.17+ can block at startup or on importing the random module on getrandom()

2016-06-07 Thread Colm Buckley
Colm Buckley added the comment: Donald - To be clear - no import of random or of hashlib is required to trigger this issue. The null script alone triggers the issue; the Python hash secret is initialized at startup regardless of script contents. Yes, there is a race condition at system boot w

[issue21470] Better seeding for the random module

2016-06-07 Thread Christian Heimes
Changes by Christian Heimes : -- nosy: +christian.heimes ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe: https:

[issue21130] equivalent functools.partial instances should compare equal

2016-06-07 Thread shakur shams Mullick
shakur shams Mullick added the comment: Submitted a new patch addressing the review comments. -- Added file: http://bugs.python.org/file43279/issue_21130_2.patch ___ Python tracker _

[issue27251] TypeError in logging.HTTPHandler.emit; possible python 2 to 3 conversion issue

2016-06-07 Thread SilentGhost
Changes by SilentGhost : -- nosy: +vinay.sajip stage: -> test needed type: -> behavior versions: +Python 3.6 ___ Python tracker ___

[issue27252] Make dict views copyable

2016-06-07 Thread Serhiy Storchaka
New submission from Serhiy Storchaka: Proposed patch adds support of dict views in the copy module. Since dict views are immutable, copy.copy() just returns the same object. copy.deepcopy() returns a frozenset for the dict_keys object, a tuple for the dict_values object, and a dict_items objec

[issue23401] Add pickle support of Mapping views

2016-06-07 Thread Serhiy Storchaka
Serhiy Storchaka added the comment: OK, then I withdraw my proposition. Thank you for your attention Raymond and Guido. -- ___ Python tracker ___ ___

[issue27252] Make dict views copyable

2016-06-07 Thread Guido van Rossum
Guido van Rossum added the comment: I'm still not clear about the use case -- have you heard from people who had to work around the current situation? Use of the copy module is often a code smell in my experience, so I don't want to encourage it. -- __

[issue25548] Show the address in the repr for class objects

2016-06-07 Thread Matthias Bussonnier
Matthias Bussonnier added the comment: Hi guys, the title of the issues is "show address in the **repR**", but the NEWS file says[1] in the **repL*, which are 2 different things ! :-) And this patch change the repR so it also affect scripts and unittests. [1] since https://hg.python.org/cpyth

[issue26839] Python 3.5 running on Linux kernel 3.17+ can block at startup or on importing the random module on getrandom()

2016-06-07 Thread Colm Buckley
Colm Buckley added the comment: Larry - I see at least two issues here, although they are related: * blocking initialization of the hash secret. This occurs regardless of script contents; at present Python simply can't be used at all in low-entropy situations. I feel that this issue is a rele

[issue27253] More efficient deepcopying of Mapping

2016-06-07 Thread Serhiy Storchaka
New submission from Serhiy Storchaka: Mapping views supports copying and deepcopying by default (using pickle protocol). But copy.deepcopy() is not efficient for KeysView and ValuesView. It copies all keys and values, while KeysView needs copying only keys and ValuesView needs copying only val

[issue26839] Python 3.5 running on Linux kernel 3.17+ can block at startup or on importing the random module on getrandom()

2016-06-07 Thread Donald Stufft
Donald Stufft added the comment: > Possible resolutions: > * accept possible low-entropy initialization of the hash secret; using the > patches supplied here by myself and Victor. > * add a command-line flag to disable "strong" initialization of the hash > secret (or revive the old -R flag).

[issue23670] Modifications to support iOS as a cross-compilation target

2016-06-07 Thread Chris Rebert
Changes by Chris Rebert : -- nosy: +cvrebert ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.pytho

[issue26839] Python 3.5 running on Linux kernel 3.17+ can block at startup or on importing the random module on getrandom()

2016-06-07 Thread Larry Hastings
Larry Hastings added the comment: Thank you for summarizing the debate. It made it a lot easier to > * blocking initialization of the hash secret. This occurs regardless of > script contents; at present Python simply can't be used at all in low-entropy > situations. I feel that this issue is

[issue27180] Doc/pathlib: Please describe the behaviour of Path().rename() is depends on the platform (same as os.rename())

2016-06-07 Thread Evelyn Mitchell
Evelyn Mitchell added the comment: *** cpythonmod/Doc/library/pathlib.rst 2016-06-07 11:29:07.200774979 -0600 --- cpython/Doc/library/pathlib.rst 2016-06-07 11:29:59.372777817 -0600 *** *** 887,896 .. method:: Path.rename(target) !Rename this file or directory to

[issue23496] Steps for Android Native Build of Python 3.4.2

2016-06-07 Thread Chris Rebert
Changes by Chris Rebert : -- nosy: +cvrebert ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.pytho

[issue26839] Python 3.5 running on Linux kernel 3.17+ can block at startup or on importing the random module on getrandom()

2016-06-07 Thread Donald Stufft
Donald Stufft added the comment: > I don't follow whose patch does what. But here's what I find acceptable, > from a high level. > > * The semantics as presented by the documentation must be preserved. > os.urandom() and other operations that declare they're safe for cryptographic > use mus

[issue26839] Python 3.5 running on Linux kernel 3.17+ can block at startup or on importing the random module on getrandom()

2016-06-07 Thread Christian Heimes
Christian Heimes added the comment: On 2016-06-07 19:46, Larry Hastings wrote: > > Larry Hastings added the comment: > > Thank you for summarizing the debate. It made it a lot easier to > >> * blocking initialization of the hash secret. This occurs regardless of >> script contents; at presen

[issue26839] Python 3.5 running on Linux kernel 3.17+ can block at startup or on importing the random module on getrandom()

2016-06-07 Thread Christian Heimes
Christian Heimes added the comment: On 2016-06-07 19:36, Donald Stufft wrote: > > Donald Stufft added the comment: > >> Possible resolutions: >> * accept possible low-entropy initialization of the hash secret; using the >> patches supplied here by myself and Victor. >> * add a command-line f

[issue27252] Make dict views copyable

2016-06-07 Thread Serhiy Storchaka
Serhiy Storchaka added the comment: I didn't encounter this. -- ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue27254] heap overflow in Tkinter module

2016-06-07 Thread Emin Ghuliev
New submission from Emin Ghuliev: /* This is used to get the application class for Tk 4.1 and up */ argv0 = (char*)attemptckalloc(strlen(className) + 1); //<=== classname allocated if (!argv0) { PyErr_NoMemory(); Py_DECREF(v); return NULL; } strcpy(argv0,

[issue26839] Python 3.5 running on Linux kernel 3.17+ can block at startup or on importing the random module on getrandom()

2016-06-07 Thread Donald Stufft
Donald Stufft added the comment: I've attached a minimal patch for making it so ``import random`` does not block, it does this by changing what the default instance of Random() is seeded with, from os.urandom() to the time based fallback it currently employs. It does not change the behavior of

[issue26839] Python 3.5 running on Linux kernel 3.17+ can block at startup or on importing the random module on getrandom()

2016-06-07 Thread Larry Hastings
Larry Hastings added the comment: Everybody: let's drop discussing "hashlib" unless someone says it actually is a problem. I think it was always, as we say in English, a "red herring". > The secret for SipHash is composed of two 64bit integers. The entire > _Py_HashSecret_t struct is 24 byte

[issue27252] Make dict views copyable

2016-06-07 Thread Raymond Hettinger
Raymond Hettinger added the comment: I think we should stop adding features like this without actual user requests and real use cases to show necessity and to inform the design. -- ___ Python tracker _

[issue27255] More opcode predictions

2016-06-07 Thread Serhiy Storchaka
Changes by Serhiy Storchaka : -- priority: normal -> low ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe: https:

[issue26839] Python 3.5 running on Linux kernel 3.17+ can block at startup or on importing the random module on getrandom()

2016-06-07 Thread Donald Stufft
Donald Stufft added the comment: > As a final note, let me steer you towards this comment in Python/random.c: > > /* Issue #25003: Don' use getentropy() on Solaris (available since > * Solaris 11.3), it is blocking whereas os.urandom() should not block. */ > > Yes: we already had this discussion

[issue27255] More opcode predictions

2016-06-07 Thread Serhiy Storchaka
New submission from Serhiy Storchaka: Currently the PREDICT() macros is used for predicticting following pair of opcodes in the ceval loop: LIST_APPEND JUMP_ABSOLUTE SET_ADD JUMP_ABSOLUTE MAP_ADD JUMP_ABSOLUTE COMPARE_OP POP_JUMP_IF_FALSE COMPARE_OP POP_JUMP_IF_TRUE GET_ITER FOR_ITER FOR_ITER S

[issue26839] Python 3.5 running on Linux kernel 3.17+ can block at startup or on importing the random module on getrandom()

2016-06-07 Thread Colm Buckley
Colm Buckley added the comment: Larry - To the first point: The combination of Victor's changeset 9de508dc4837 (based on my patch) and my most recent nonblocking_urandom_noraise patch (which is on top of 9de508dc4837) will do what you suggest for the hash secret initialization - ie: it is all

[issue26839] Python 3.5 running on Linux kernel 3.17+ can block at startup or on importing the random module on getrandom()

2016-06-07 Thread Larry Hastings
Larry Hastings added the comment: That reminds me. I want to be clear: I think it's preferable that os.urandom() blocks when insufficient entropy is available. If Victor's patch changed that, it should be backed out. (Since non-blocking urandom is useful, perhaps in 3.6 os.urandom() should t

[issue27127] Never have GET_ITER not followed by FOR_ITER

2016-06-07 Thread Raymond Hettinger
Raymond Hettinger added the comment: I don't think this should go forward. The current FOR_ITER and JUMP_ABSOLUTE combination is very efficient and shouldn't be changed lightly. It is the inside of the loop that matters -- the GET_ITER step is outside of the loop and isn't expensive. Also,

[issue26839] Python 3.5 running on Linux kernel 3.17+ can block at startup or on importing the random module on getrandom()

2016-06-07 Thread Matthias Klose
Matthias Klose added the comment: On 07.06.2016 16:47, Christian Heimes wrote: > > Christian Heimes added the comment: > > PSRT VETO! > > In the light of the upcoming release 3.5.2 I'm now putting on my PSRT hat > (Python Security Response Team) and proclaim a veto against any and all > chan

[issue27242] Make the docs for NotImplemented & NotImplementedError unambigous

2016-06-07 Thread Emanuel Barry
Emanuel Barry added the comment: More tweaks after Ethan's comments. This is starting to get way outside of the realm of NotImplemented, but it still makes for a good reference to point confused users at. -- Added file: http://bugs.python.org/file43284/NotImplemented_exceptions_wordin

[issue26839] Python 3.5 running on Linux kernel 3.17+ can block at startup or on importing the random module on getrandom()

2016-06-07 Thread Colm Buckley
Colm Buckley added the comment: To clarify what the various patches do: 3.5.1 as released: os.urandom and hash secret initialization both attempt getrandom() in preference to reading /dev/urandom. Under certain circumstances, this will block, possibly indefinitely. Changeset 9de508dc4837: bot

[issue26839] Python 3.5 running on Linux kernel 3.17+ can block at startup or on importing the random module on getrandom()

2016-06-07 Thread Donald Stufft
Donald Stufft added the comment: > specifically, early in the boot process, although not I think just on the > first boot of a system; Debian at least by default does not attempt to > preserve its entropy pool across a reboot.) Look at /etc/init.d/urandom in the initscripts package in Jessie

[issue25958] Implicit ABCs have no means of "anti-registration"

2016-06-07 Thread Ethan Furman
Changes by Ethan Furman : -- nosy: +ethan.furman ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.p

[issue27254] heap overflow in Tkinter module

2016-06-07 Thread Serhiy Storchaka
Serhiy Storchaka added the comment: Minimal reproducer: from tkinter import Tk Tk(className='A'*0xf) This looks as Tcl/Tk problem. -- nosy: +serhiy.storchaka type: security -> crash versions: +Python 3.5, Python 3.6 -Python 3.3, Python 3.4 ___ P

[issue26839] Python 3.5 running on Linux kernel 3.17+ can block at startup or on importing the random module on getrandom()

2016-06-07 Thread Colm Buckley
Colm Buckley added the comment: Donald - Oh, that's interesting; thank you. I guess that system-crontab-generator is being called before that in the boot process. The most common trigger case, I guess, will then be cloud containers and VMs which are spun up for single applications. I think La

[issue26839] Python 3.5 running on Linux kernel 3.17+ can block at startup or on importing the random module on getrandom()

2016-06-07 Thread Cory Benfield
Cory Benfield added the comment: > So you are intentionally accepting a new vector for DoS attacks, and calling this non-reduced security? This is only a DoS vector if you can hit the server so early in the boot process that it doesn't have enough entropy. The *second* enough entropy has been

[issue26839] Python 3.5 running on Linux kernel 3.17+ can block at startup or on importing the random module on getrandom()

2016-06-07 Thread Larry Hastings
Larry Hastings added the comment: > This is only a DoS vector if you can hit the server so early in the boot > process that it doesn't have enough entropy. Python hash randomization only happens once. So it's not a matter of how early we try the attack, it's a matter of how early we seed Pyth

[issue26839] Python 3.5 running on Linux kernel 3.17+ can block at startup or on importing the random module on getrandom()

2016-06-07 Thread Cory Benfield
Cory Benfield added the comment: > Python hash randomization only happens once. So it's not a matter of how > early we try the attack, it's a matter of how early we seed Python hash > randomization. Sorry Larry, I was insufficiently clear (relying on context from earlier). I totally agree th

[issue27256] header indentation destroyed

2016-06-07 Thread Hans-Peter Jansen
New submission from Hans-Peter Jansen: In the course of replacing an old Python 2.7 email filter tool with a rewritten Python3 version, I stumbled across a ugly case, where such an header: X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtCTDJQUjAyTUI1MTQ7MjM6bEtRRlNaUHQvVTk5WCttdktlOUVrUGQvVFBH?

[issue27256] header indentation destroyed

2016-06-07 Thread Hans-Peter Jansen
Changes by Hans-Peter Jansen : Added file: http://bugs.python.org/file43286/mf.9__mi0bf.out ___ Python tracker ___ ___ Python-bugs-list mailin

[issue27081] Cannot capture sys.stderr output from an uncaught exception in a multiprocessing Process using a multiprocessing Queue

2016-06-07 Thread ppperry
Changes by ppperry : -- title: Multiprocessing is not robust against sys.stderr changes involving queues -> Cannot capture sys.stderr output from an uncaught exception in a multiprocessing Process using a multiprocessing Queue ___ Python tracker

[issue27257] get_addresses results in traceback with a valid? header

2016-06-07 Thread Hans-Peter Jansen
New submission from Hans-Peter Jansen: In the course of replacing an old Python 2.7 email filter tool with a rewritten Python3 version, I stumbled across a ugly case, where such an header: To: unlisted-recipients: ;, ""@pop.kundenserver.de (no To-header on input) results in a Traceback

[issue26632] @public - an __all__ decorator

2016-06-07 Thread Barry A. Warsaw
Barry A. Warsaw added the comment: On Jun 04, 2016, at 07:47 PM, Zachary Ware wrote: >So, +1 anyway. I think this would be rather worthwhile, especially in the >stdlib. Thanks! I still like it and plan on continuing to use it in my code. I would recommend you playing with the third party mod

[issue26839] Python 3.5 running on Linux kernel 3.17+ can block at startup or on importing the random module on getrandom()

2016-06-07 Thread Larry Hastings
Larry Hastings added the comment: I fear I may be changing my mind a little bit. However, I skipped breakfast--and now it's looking like a late lunch--so I simply have to step away for a while. Expect me to post in about two hours when I get some calories down and finally make up my tiny min

[issue26839] Python 3.5 running on Linux kernel 3.17+ can block at startup or on importing the random module on getrandom()

2016-06-07 Thread Donald Stufft
Donald Stufft added the comment: Colm, Great, then I think there's general agreement, we just need someone to review the nonblocking_urandom_noraise.patch (which my C is not strong enough to feel comfortable doing). That still leaves the `import random` issue, but I think we can reopen #25420

[issue27259] Possible missing deprecation warnings?

2016-06-07 Thread Mark Summerfield
New submission from Mark Summerfield: In the docs for the array module: https://docs.python.org/dev/library/array.html#module-array Note 1 in the table of type codes says that the 'u' type is deprecated and will go in Python 4.0. Since the array.fromunicode() and array.tounicode() methods depen

[issue26839] Python 3.5 running on Linux kernel 3.17+ can block at startup or on importing the random module on getrandom()

2016-06-07 Thread Marc-Andre Lemburg
Marc-Andre Lemburg added the comment: On 07.06.2016 21:12, Cory Benfield wrote: > >> Python hash randomization only happens once. So it's not a matter of how >> early we try the attack, it's a matter of how early we seed Python hash >> randomization. > > Sorry Larry, I was insufficiently cle

[issue27258] Exception in BytesGenerator.flatten

2016-06-07 Thread Hans-Peter Jansen
New submission from Hans-Peter Jansen: Attached mail, parsed with email.message_from_binary_file results in: Traceback (most recent call last): File "./mail_filter.py", line 616, in ret = main.run() File "./mail_filter.py", line 605, in run self.process(fp) File "./mail_filter.py"

[issue26839] Python 3.5 running on Linux kernel 3.17+ can block at startup or on importing the random module on getrandom()

2016-06-07 Thread Christian Heimes
Changes by Christian Heimes : -- nosy: -christian.heimes ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe: https

[issue26839] Python 3.5 running on Linux kernel 3.17+ can block at startup or on importing the random module on getrandom()

2016-06-07 Thread Donald Stufft
Donald Stufft added the comment: > Once this has been done, it will never block again, and happily send you poor > random data if the entropy pool has been completely wiped of any entropy data > - without telling you. This doesn't actually happen in real life, once urandom has been initialized

[issue26839] Python 3.5 running on Linux kernel 3.17+ can block at startup or on importing the random module on getrandom()

2016-06-07 Thread Colm Buckley
Colm Buckley added the comment: I've spoken with Ted Ts'o (one advantage of working for Google) and taken a look in the Linux kernel source, and things are actually better than we'd feared. Firstly, calling getrandom() with GRND_NONBLOCK and a buffer size of less than or equal to 32 bytes wil

[issue27251] TypeError in logging.HTTPHandler.emit; possible python 2 to 3 conversion issue

2016-06-07 Thread Roundup Robot
Roundup Robot added the comment: New changeset 11ebd14076b4 by Vinay Sajip in branch '3.5': Fixed #27251: corrected string/bytes handling in credentials. https://hg.python.org/cpython/rev/11ebd14076b4 New changeset 12d939477b4f by Vinay Sajip in branch 'default': Fixed #27251: merged fix from 3.

[issue27251] TypeError in logging.HTTPHandler.emit; possible python 2 to 3 conversion issue

2016-06-07 Thread Vinay Sajip
Changes by Vinay Sajip : -- resolution: -> fixed status: open -> closed ___ Python tracker ___ ___ Python-bugs-list mailing list Unsu

[issue27187] Relax __all__ location requirement in PEP 8

2016-06-07 Thread Roundup Robot
Roundup Robot added the comment: New changeset cf8e888b9555 by Barry Warsaw in branch 'default': Relax __all__ location. https://hg.python.org/peps/rev/cf8e888b9555 -- nosy: +python-dev resolution: -> fixed stage: -> resolved status: open -> closed

[issue27187] Relax __all__ location requirement in PEP 8

2016-06-07 Thread Barry A. Warsaw
Barry A. Warsaw added the comment: Thanks for the patch! -- ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe: htt

[issue26839] Python 3.5 running on Linux kernel 3.17+ can block at startup or on importing the random module on getrandom()

2016-06-07 Thread Theodore Tso
Theodore Tso added the comment: Hi. Colm alerted me to this bug, so I thought I would chime in as the author of Linux's getrandom(2) function. First of all, if you are OK with reading from /dev/urandom, then you might as well use getrandom's GRND_NONBLOCK flag. They are logically equivalent

[issue26839] Python 3.5 running on Linux kernel 3.17+ can block at startup or on importing the random module on getrandom()

2016-06-07 Thread Donald Stufft
Donald Stufft added the comment: Thanks for weighing in Theodore, I think that matches what Colm's last suggestion was, and what I was personally OK with. To seed our SipHash function using GRND_NONBLOCK since it's likely that will be fine, and worst case we're just using it for some hash tabl

[issue27260] Missing equality check for super objects

2016-06-07 Thread Jelle Zijlstra
New submission from Jelle Zijlstra: >>> class Foo: pass ... >>> super(Foo) == super(Foo) False Will submit a patch later -- assignee: Jelle Zijlstra components: Library (Lib) messages: 267747 nosy: Jelle Zijlstra priority: normal severity: normal status: open title: Missing equality ch

[issue27261] io.BytesIO.truncate does not work as advertised

2016-06-07 Thread Justus Winter
New submission from Justus Winter: % python3.6 -c "import io; b=io.BytesIO(); assert b.truncate(42) == 42; assert len(b.getbuffer()) == 42, 'expected length 42, got {}'.format(len(b.getbuffer()))" Traceback (most recent call last): File "", line 1, in AssertionError: expected length 42, got

[issue26839] Python 3.5 running on Linux kernel 3.17+ can block at startup or on importing the random module on getrandom()

2016-06-07 Thread Colm Buckley
Colm Buckley added the comment: Ted - I'd suggest the following to test. Boot an arbitrary Linux system with init=/usr/bin/python3 (assuming filesystems mounted etc). Python 3.5.1 (on Linux) will call getrandom() in blocking mode very early in its startup; if this happens before the pool is i

Re: [issue26839] Python 3.5 running on Linux kernel 3.17+ can block at startup or on importing the random module on getrandom()

2016-06-07 Thread M.-A. Lemburg
On 07.06.2016 22:27, Theodore Tso wrote: > > Secondly, when I decided to add this behavior to getrandom(2), it was because > people were really worried that people would be using /dev/urandom for > security-critical things (e.g., initializing ssh host session keys, when > they'd _really_ rather

[issue26839] Python 3.5 running on Linux kernel 3.17+ can block at startup or on importing the random module on getrandom()

2016-06-07 Thread Theodore Tso
Theodore Tso added the comment: I ran the experiment Colm asked me to run --- and yes, if you boot a system with Python 3.5.1 with the boot options "init=/usr/bin/python3", you're going to have a bad time. The problem is that in a KVM environment where things are very quiet, especially if yo

[issue26839] Python 3.5 running on Linux kernel 3.17+ can block at startup or on importing the random module on getrandom()

2016-06-07 Thread Christian Heimes
Christian Heimes added the comment: Thanks Theodore! Your analysis was exactly what I was aiming for when I requested a thorough security analysis in form of a PEP. The correct choice of CPRNG is important for the overall security. I'm mostly concerned with the behavior of os.urandom(), which

[issue27260] Missing equality check for super objects

2016-06-07 Thread Raymond Hettinger
Raymond Hettinger added the comment: Why would you need this? Also, would it interfere with super's ability to use the __eq__ method for a parent class? class A: def __eq__(self, other): return True class B(A): def __eq__(self, other): return

[issue27255] More opcode predictions

2016-06-07 Thread Raymond Hettinger
Changes by Raymond Hettinger : -- assignee: -> rhettinger ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe: http

[issue27255] More opcode predictions

2016-06-07 Thread Raymond Hettinger
Raymond Hettinger added the comment: Serhiy, please slow down and stop rewriting every single thing you see. Your rate of patches is prolific and hard to digest. Please give some consideration that the people who came before you (lots of them) put a lot of thought into what was done and were

[issue27253] More efficient deepcopying of Mapping

2016-06-07 Thread Raymond Hettinger
Raymond Hettinger added the comment: Is this ever needed? I'm not sure whether all these patches are being driven by reasonable use cases or whether it is just something that could be done. I thought the whole point of the views was to avoid copying. If so, there is a design principle that s

[issue27252] Make dict views copyable

2016-06-07 Thread Raymond Hettinger
Raymond Hettinger added the comment: See also: http://bugs.python.org/issue27253 -- ___ Python tracker ___ ___ Python-bugs-list maili

[issue27187] Relax __all__ location requirement in PEP 8

2016-06-07 Thread John Mark Vandenberg
John Mark Vandenberg added the comment: The revised text says __dunder__ should appear before any imports, however __future__ imports must appear first for obvious reasons. Does this need to be mentioned in the pep? -- ___ Python tracker

[issue27261] io.BytesIO.truncate does not work as advertised

2016-06-07 Thread Martin Panter
Martin Panter added the comment: BytesIO is supposed to implement IOBase. I would treat this as a bug in existing versions too. -- nosy: +martin.panter stage: -> needs patch versions: +Python 2.7, Python 3.5 ___ Python tracker

[issue27180] Doc/pathlib: Please describe the behaviour of Path().rename() is depends on the platform (same as os.rename())

2016-06-07 Thread Berker Peksag
Berker Peksag added the comment: Could you please send your patch in unified diff format? See https://docs.python.org/devguide/patch.html for details. -- nosy: +berker.peksag stage: needs patch -> patch review ___ Python tracker

[issue27251] TypeError in logging.HTTPHandler.emit; possible python 2 to 3 conversion issue

2016-06-07 Thread Berker Peksag
Changes by Berker Peksag : -- stage: test needed -> resolved ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe: ht

[issue27180] Doc/pathlib: Please describe the behaviour of Path().rename() is depends on the platform (same as os.rename())

2016-06-07 Thread Evelyn Mitchell
Changes by Evelyn Mitchell : Added file: http://bugs.python.org/file43289/patch27180 ___ Python tracker ___ ___ Python-bugs-list mailing list

[issue27262] IDLE: move Aqua context menu code to maxosx

2016-06-07 Thread Terry J. Reedy
New submission from Terry J. Reedy: Put the AquaTk code added to pyshell.main in #24801 where it should have gone originally. (My fault, ultimately.) See aqua_context.diff. This is a step in factoring main (currently about 170 lines) into a manageable number of function calls. I will try to

[issue27263] IDLE sets the HOME environment variable breaking scripts

2016-06-07 Thread Jarrod Petz
New submission from Jarrod Petz: It seems IDEL is setting the environment variable 'HOME' on windows. Specifically I am on windows 8.1 This is extremly annoying and bad as according the code and doco, os.path.expanduser will preference this variable above others such as USERPROFILE. https://d

[issue27263] IDLE sets the HOME environment variable breaking scripts

2016-06-07 Thread Jarrod Petz
Jarrod Petz added the comment: It also makes things none deterministic. As when I am off the domain or my network drive H:\ is unavailable it works and uses USERPROFILE. -- ___ Python tracker _

[issue25738] http.server doesn't handle RESET CONTENT status correctly

2016-06-07 Thread Martin Panter
Martin Panter added the comment: Patch 07 looks fine. I presume you still want to do the porting to 3.5 and 2.7. -- ___ Python tracker ___ ___

[issue25738] http.server doesn't handle RESET CONTENT status correctly

2016-06-07 Thread Susumu Koshiba
Susumu Koshiba added the comment: Great, thanks for checking. Attaching patch for 2.7. 3.5 will follow. -- Added file: http://bugs.python.org/file43291/issue25738_http_reset_content_2.7_02.patch ___ Python tracker

[issue27261] io.BytesIO.truncate does not work as advertised

2016-06-07 Thread Xiang Zhang
Changes by Xiang Zhang : -- nosy: +alexandre.vassalotti, serhiy.storchaka ___ Python tracker ___ ___ Python-bugs-list mailing list Uns

[issue27261] io.BytesIO.truncate does not work as advertised

2016-06-07 Thread Xiang Zhang
Xiang Zhang added the comment: Is this a bug or a documentation matter? Inspecting BytesIO.truncate's code, it does resizing similar to list, this seems to be a designed feature, which conflicts with the documented behaviour. -- nosy: +xiang.zhang _

[issue25738] http.server doesn't handle RESET CONTENT status correctly

2016-06-07 Thread Susumu Koshiba
Susumu Koshiba added the comment: A patch for 3.5 attached. -- Added file: http://bugs.python.org/file43292/issue25738_http_reset_content_3.5_02.patch ___ Python tracker ___ ___

[issue8491] Need readline command and keybinding information

2016-06-07 Thread Evelyn Mitchell
Changes by Evelyn Mitchell : Added file: http://bugs.python.org/file43293/patch8491 ___ Python tracker ___ ___ Python-bugs-list mailing list Un

[issue26446] Mention in the devguide that core dev stuff falls under the PSF CoC

2016-06-07 Thread Evelyn Mitchell
Changes by Evelyn Mitchell : Added file: http://bugs.python.org/file43294/patchCoreCoC ___ Python tracker ___ ___ Python-bugs-list mailing lis

[issue26446] Mention in the devguide that core dev stuff falls under the PSF CoC

2016-06-07 Thread Berker Peksag
Berker Peksag added the comment: Thanks for the patch Evelyn. The patch looks good to me. I have a couple of suggestions: 1. It seems like https://docs.python.org/devguide/coredev.html#responsibilities is a better place to put this 2. Core committers -> Core developers 3. PSF CoC -> PSF Code

[issue27127] Never have GET_ITER not followed by FOR_ITER

2016-06-07 Thread Demur Rumed
Demur Rumed added the comment: Attaching forbegin3.patch. It reintroduces GET_ITER for the sole purpose of eagerly throwing. I decided to reuse GET_ITER over something like TEST_ITER as this way we can have GET_ITER flow into FOR_BEGIN & rely on the fast path of iter(iter(x)) GET_ITER/JUMP_FO

[issue27127] Never have GET_ITER not followed by FOR_ITER

2016-06-07 Thread Demur Rumed
Demur Rumed added the comment: Didn't see Raymond's response before posting, forbegin3 at least exists as a completion of the experiment to a passes-tests state. The tracing hacks to support an instruction corresponding to two separate lines support rejecting this idea -- ___

[issue27263] IDLE sets the HOME environment variable breaking scripts

2016-06-07 Thread Jarrod Petz
Jarrod Petz added the comment: Worked around this by setting HOME to be USERPROFILE before IDLE starts Rather then change the system/user environment permanently. I edited the Idle script which the windows shortcut seems to run below. C:\Python35\Lib\idlelib\idle.pyw At the top of the script

[issue27187] Relax __all__ location requirement in PEP 8

2016-06-07 Thread Ian Lee
Ian Lee added the comment: Good catch. I'm uploading a new patch that addresses ``from __future__`` imports issue explicitly. -- ___ Python tracker ___

[issue27187] Relax __all__ location requirement in PEP 8

2016-06-07 Thread Ian Lee
Changes by Ian Lee : Added file: http://bugs.python.org/file43296/issue-27187-patch3.txt ___ Python tracker ___ ___ Python-bugs-list mailing l

[issue26446] Mention in the devguide that core dev stuff falls under the PSF CoC

2016-06-07 Thread Evelyn Mitchell
Evelyn Mitchell added the comment: Thank you for your help Berker. -- nosy: +Evelyn Mitchell Added file: http://bugs.python.org/file43297/patchCoreDevCoC ___ Python tracker ___ _

[issue15476] Index "code object" and link to code object definition

2016-06-07 Thread Tommy Beadle
Tommy Beadle added the comment: Martin, thanks for the suggestion that worked. I believe this patch should have all of the issues addressed. -- Added file: http://bugs.python.org/file43298/0001-Issue-15476-Make-code-object-its-own-entry-in-the-do.patch ___

[issue8491] Need readline command and keybinding information

2016-06-07 Thread Martin Panter
Martin Panter added the comment: Thanks for the patch. I left a couple review comments. Also, this new paragraph should be outside the “Note” box, which is specifically about libedit aka Editline, not Gnu Readline. -- stage: needs patch -> patch review

[issue27262] IDLE: move Aqua context menu code to maxosx

2016-06-07 Thread Serhiy Storchaka
Serhiy Storchaka added the comment: "bindtag" is an arbitrary string. Usually this is a name of Tk widget class of or "all". bindtags() allows to retrieve or set a list of bindtags associated with a widget. By default they are: full path of a widget, name of Tk class of widgets, full path of a

<    1   2   3   >