Re: [Python-Dev] Security implications of pep 383

2011-03-29 Thread Lennart Regebro
On Tue, Mar 29, 2011 at 23:17, "Martin v. Löwis" wrote: > I think the whole blacklist example is artificial. The string in the > blacklist is actually a Chinese "hello" greeting, so it surely isn't > the string being blacklisted. For proper blacklisting, you would likely > use substring searches,

Re: [Python-Dev] Security implications of pep 383

2011-03-29 Thread Lennart Regebro
On Wed, Mar 30, 2011 at 07:54, Toshio Kuratomi wrote: > Lennart is missing that you just need to use the same encoding > + surrogateescape (or stick with bytes) for decoding the byte strings that > you are comparing. You lost me here. I need to do this for what? //Lennart ___

Re: [Python-Dev] Security implications of pep 383

2011-03-29 Thread Toshio Kuratomi
On Tue, Mar 29, 2011 at 10:55:47PM +0200, Victor Stinner wrote: > Le mardi 29 mars 2011 à 22:40 +0200, Lennart Regebro a écrit : > > The lesson here seems to be "if you have to use blacklists, and you > > use unicode strings for those blacklists, also make sure the string > > you compare with doesn

Re: [Python-Dev] Information about how cpython in benchmarked

2011-03-29 Thread Nick Stinemates
This is really great to hear and something I would be hugely interested in contributing to. Lurking has paid off :) Nick On Tue, Mar 29, 2011 at 4:00 AM, Nick Coghlan wrote: > On Tue, Mar 29, 2011 at 8:01 PM, Tennessee Leeuwenburg > wrote: > > PyPy maintains http://speed.pypy.org/, which prov

Re: [Python-Dev] .hgignore including site-packages and scripts directories?

2011-03-29 Thread Mark Hammond
On 30/03/2011 1:37 PM, R. David Murray wrote: On Wed, 30 Mar 2011 12:17:05 +1100, Mark Hammond wrote: On 30/03/2011 12:09 PM, R. David Murray wrote: The solution is to add such directories and/or files to your personal ignore list See the 'ignore' entry under 'ui' in the hgrc documentation.

Re: [Python-Dev] .hgignore including site-packages and scripts directories?

2011-03-29 Thread R. David Murray
On Wed, 30 Mar 2011 12:17:05 +1100, Mark Hammond wrote: > On 30/03/2011 12:09 PM, R. David Murray wrote: > > The solution is to add such > > directories and/or files to your personal ignore list See the 'ignore' > > entry under 'ui' in the hgrc documentation. > > Yeah - but I was wondering if it

Re: [Python-Dev] .hgignore including site-packages and scripts directories?

2011-03-29 Thread Mark Hammond
On 30/03/2011 12:09 PM, R. David Murray wrote: On Wed, 30 Mar 2011 11:11:45 +1100, Mark Hammond wrote: I'm wondering if it is a reasonable idea to have .hgignore exclude all files from 'Lib/site-packages' and 'Scripts'? As I install packages into my source builds, a 'hg status' lists *many* f

Re: [Python-Dev] .hgignore including site-packages and scripts directories?

2011-03-29 Thread R. David Murray
On Wed, 30 Mar 2011 11:11:45 +1100, Mark Hammond wrote: > I'm wondering if it is a reasonable idea to have .hgignore exclude all > files from 'Lib/site-packages' and 'Scripts'? As I install packages > into my source builds, a 'hg status' lists *many* files in both those > directories forcing

Re: [Python-Dev] Information about how cpython in benchmarked

2011-03-29 Thread Tennessee Leeuwenburg
Hi Nick, Jesse, Thanks both for your responses, it's much appreciated! It's very useful to have a clear pointer to the right place to begin looking. Regards, -Tennessee On Tue, Mar 29, 2011 at 10:47 PM, Jesse Noller wrote: > On Tue, Mar 29, 2011 at 7:00 AM, Nick Coghlan wrote: > > On Tue, Mar

[Python-Dev] .hgignore including site-packages and scripts directories?

2011-03-29 Thread Mark Hammond
I'm wondering if it is a reasonable idea to have .hgignore exclude all files from 'Lib/site-packages' and 'Scripts'? As I install packages into my source builds, a 'hg status' lists *many* files in both those directories forcing me to scroll up a number of pages to see files which have actuall

Re: [Python-Dev] Security implications of pep 383

2011-03-29 Thread Terry Reedy
On 3/29/2011 2:23 PM, Michael Foord wrote: Not sure how real the security risk is here: http://blog.omega-prime.co.uk/?p=107 Basically he is saying that if you store a list of blacklisted files with names encoded in big-5 (or some other non-utf8 compatible encoding) if those names are passed a

[Python-Dev] cmp= & key= (Re: Proposed change to logging.basicConfig)

2011-03-29 Thread Terry Reedy
On 3/29/2011 4:02 PM, Matthew Woodcraft wrote: Terry Reedy wrote: # Experiment with 2.7 shows that cmp wins. Though too late to change, I consider this the worst choice of three. I think an exception should be raised. Failing that, I think key should win on the basis that if one adds a 'new-fan

Re: [Python-Dev] Differences among Emacsen (was: utf-8 encoding in checkins?)

2011-03-29 Thread Barry Warsaw
On Mar 30, 2011, at 09:20 AM, Ben Finney wrote: >The ‘vc’ package (I'm using Debian's GNU Emacs 23.2.1) now recognises >DVCS-controlled *files*, and works well with them. It's still unaware >that modern VCS deals with project *trees*, so works only at an >individual file level. Still quite useful

[Python-Dev] Differences among Emacsen (was: utf-8 encoding in checkins?)

2011-03-29 Thread Ben Finney
s...@pobox.com writes: > My only issues now are: > > * make sure the ediff and vc packages recognize version-controlled files >(It seems they do, but I haven't put them through their paces) The ‘vc’ package (I'm using Debian's GNU Emacs 23.2.1) now recognises DVCS-controlled *files*, and wor

Re: [Python-Dev] Security implications of pep 383

2011-03-29 Thread Martin v. Löwis
> '\N{LATIN SMALL LETTER O}\N{COMBINING DIAERESIS}' != '\N{LATIN SMALL > LETTER O WITH DIAERESIS}' > > I guess the filesystem shouldn't treat these as the same (even though > they are), but what if some webservice does? I suspect you should > normalize both strings before comparing them in any bla

Re: [Python-Dev] Proposed change to logging.basicConfig

2011-03-29 Thread Vinay Sajip
Antoine Pitrou pitrou.net> writes: > I'm not a logging expert, but the fact that your description above > mentions at least two instances of special-casing make it sound like > the API has an usability (or learnability) problem. Well, basicConfig() was provided to make it as easy as possible to

Re: [Python-Dev] Security implications of pep 383

2011-03-29 Thread Victor Stinner
Le mardi 29 mars 2011 à 22:45 +0200, Lennart Regebro a écrit : > On Tue, Mar 29, 2011 at 22:40, Lennart Regebro wrote: > > The lesson here seems to be "if you have to use blacklists, and you > > use unicode strings for those blacklists, also make sure the string > > you compare with doesn't have s

Re: [Python-Dev] Security implications of pep 383

2011-03-29 Thread Antoine Pitrou
On Tue, 29 Mar 2011 22:40:01 +0200 Lennart Regebro wrote: > The lesson here seems to be "if you have to use blacklists, and you > use unicode strings for those blacklists, also make sure the string > you compare with doesn't have surrogates". Not really. As everyone said, this can happen even wit

Re: [Python-Dev] Security implications of pep 383

2011-03-29 Thread Victor Stinner
Le mardi 29 mars 2011 à 22:40 +0200, Lennart Regebro a écrit : > The lesson here seems to be "if you have to use blacklists, and you > use unicode strings for those blacklists, also make sure the string > you compare with doesn't have surrogates". No. '\u4f60\u597d'.encode('big5').decode('latin1')

Re: [Python-Dev] Security implications of pep 383

2011-03-29 Thread Lennart Regebro
The lesson here seems to be "if you have to use blacklists, and you use unicode strings for those blacklists, also make sure the string you compare with doesn't have surrogates". //Lennart ___ Python-Dev mailing list Python-Dev@python.org http://mail.pyt

Re: [Python-Dev] Security implications of pep 383

2011-03-29 Thread Lennart Regebro
On Tue, Mar 29, 2011 at 22:40, Lennart Regebro wrote: > The lesson here seems to be "if you have to use blacklists, and you > use unicode strings for those blacklists, also make sure the string > you compare with doesn't have surrogates". > For that matter, what happens with combining characters?

Re: [Python-Dev] Security implications of pep 383

2011-03-29 Thread Victor Stinner
Le mardi 29 mars 2011 à 19:23 +0100, Michael Foord a écrit : > Hey all, > > Not sure how real the security risk is here: > > http://blog.omega-prime.co.uk/?p=107 > > Basically he is saying that if you store a list of blacklisted files > with names encoded in big-5 (or some other non-utf8

[Python-Dev] Failed issue tracker submission

2011-03-29 Thread Python tracker
The node specified by the designator in the subject of your message ("22663") does not exist. Subject was: "[issue22663]" Mail Gateway Help = Incoming messages are examined for multiple parts: . In a multipart/mixed message or part, each subpart is extracted and examined.

Re: [Python-Dev] Proposed change to logging.basicConfig

2011-03-29 Thread Matthew Woodcraft
Terry Reedy wrote: > I am bothered by mutually exclusive parameters. This is one reason I was > glad to see cmp eliminated from list.sort. Quick: what happens if one > passes both cmp and key to list.sort? There are three reasonable > possibilities. As far as I can read, the answer is not documen

Re: [Python-Dev] Security implications of pep 383

2011-03-29 Thread Toshio Kuratomi
On Tue, Mar 29, 2011 at 07:23:25PM +0100, Michael Foord wrote: > Hey all, > > Not sure how real the security risk is here: > > http://blog.omega-prime.co.uk/?p=107 > > Basically he is saying that if you store a list of blacklisted files > with names encoded in big-5 (or some other non-utf8

Re: [Python-Dev] Security implications of pep 383

2011-03-29 Thread Laura Creighton
In a message of Tue, 29 Mar 2011 19:23:25 BST, Michael Foord writes: >Hey all, > >Not sure how real the security risk is here: > > http://blog.omega-prime.co.uk/?p=107 > >Basically he is saying that if you store a list of blacklisted files >with names encoded in big-5 (or some other non-utf8

Re: [Python-Dev] [Python-checkins] cpython (2.6): Issue #11639: Configuration function documentation referred to logging.XXX

2011-03-29 Thread Éric Araujo
Le 29/03/2011 02:16, vinay.sajip a écrit : > http://hg.python.org/cpython/rev/bfa2a8d91859 > changeset: 69034:bfa2a8d91859 > branch: 2.6 > parent: 68802:b99c94261225 > user:Vinay Sajip > date:Tue Mar 29 01:07:50 2011 +0100 > summary: > Issue #11639: Configuration func

Re: [Python-Dev] Security implications of pep 383

2011-03-29 Thread Martin v. Löwis
> Not sure how real the security risk is here: > > http://blog.omega-prime.co.uk/?p=107 > > Basically he is saying that if you store a list of blacklisted files > with names encoded in big-5 (or some other non-utf8 compatible encoding) > if those names are passed at the command line, or othe

Re: [Python-Dev] Security implications of pep 383

2011-03-29 Thread Antoine Pitrou
On Tue, 29 Mar 2011 19:23:25 +0100 Michael Foord wrote: > Hey all, > > Not sure how real the security risk is here: > > http://blog.omega-prime.co.uk/?p=107 > > Basically he is saying that if you store a list of blacklisted files > with names encoded in big-5 (or some other non-utf8 comp

Re: [Python-Dev] Proposed change to logging.basicConfig

2011-03-29 Thread Terry Reedy
On 3/29/2011 12:35 PM, Vinay Sajip wrote: I'm planning a change to logging.basicConfig to add an optional "handlers" keyword argument which defaults to None. If specified, this should be an iterable of already created handlers, which will be added to the root logger (if it doesn't already have a

[Python-Dev] Security implications of pep 383

2011-03-29 Thread Michael Foord
Hey all, Not sure how real the security risk is here: http://blog.omega-prime.co.uk/?p=107 Basically he is saying that if you store a list of blacklisted files with names encoded in big-5 (or some other non-utf8 compatible encoding) if those names are passed at the command line, or other

Re: [Python-Dev] Proposed change to logging.basicConfig

2011-03-29 Thread Antoine Pitrou
On Tue, 29 Mar 2011 16:35:08 + (UTC) Vinay Sajip wrote: > I'm planning a change to logging.basicConfig to add an optional "handlers" > keyword argument which defaults to None. > > If specified, this should be an iterable of already created handlers, which > will > be added to the root logger

[Python-Dev] Proposed change to logging.basicConfig

2011-03-29 Thread Vinay Sajip
I'm planning a change to logging.basicConfig to add an optional "handlers" keyword argument which defaults to None. If specified, this should be an iterable of already created handlers, which will be added to the root logger (if it doesn't already have any handlers). Any handler in the iterable wh

Re: [Python-Dev] utf-8 encoding in checkins?

2011-03-29 Thread Anders J. Munch
s...@pobox.com wrote: I guess I have my work cut out for me. It appears my preferred mail reader, VM, is not supported out-of-the-box by GNU Emacs (they still use Rmail and Babyl for some reason), and I'm not sure the investment trying to get XEmacs built with MULE is worth the effort. Use a 2

Re: [Python-Dev] utf-8 encoding in checkins?

2011-03-29 Thread skip
>> I guess I have my work cut out for me. It appears my preferred mail >> reader, VM, is not supported out-of-the-box by GNU Emacs (they still >> use Rmail and Babyl for some reason), and I'm not sure the investment >> trying to get XEmacs built with MULE is worth the effort.

Re: [Python-Dev] Information about how cpython in benchmarked

2011-03-29 Thread Jesse Noller
On Tue, Mar 29, 2011 at 7:00 AM, Nick Coghlan wrote: > On Tue, Mar 29, 2011 at 8:01 PM, Tennessee Leeuwenburg > wrote: >> PyPy maintains http://speed.pypy.org/, which provides very clear information >> about the relative performance of PyPy trunk against some version of cpython >> (presumably 2.6

Re: [Python-Dev] Information about how cpython in benchmarked

2011-03-29 Thread Nick Coghlan
On Tue, Mar 29, 2011 at 8:01 PM, Tennessee Leeuwenburg wrote: > PyPy maintains http://speed.pypy.org/, which provides very clear information > about the relative performance of PyPy trunk against some version of cpython > (presumably 2.6 or 2.7). I'm not aware of a similar site for cpython, but >

[Python-Dev] Information about how cpython in benchmarked

2011-03-29 Thread Tennessee Leeuwenburg
Hi all, Apologies for emailing this list with such an apparently trivial question. Is there some source of documentation or information on how Python is benchmarked? I am aware of the Python regression testing module, regrtest.py, which I presume, if profiled, would good be a good baseline test.