[Python-Dev] plugging the hash attack

2012-02-16 Thread Jim J. Jewett
In http://mail.python.org/pipermail/python-dev/2012-January/116003.html >> > Benjamin Peterson wrote: >> >> 2. It will be off by default in stable releases ... This will >> >> prevent code breakage ... >> 2012/1/27 Steven D'Aprano : >> > ... it will become on by default in some future release?

Re: [Python-Dev] plugging the hash attack

2012-01-30 Thread Nick Coghlan
On Tue, Jan 31, 2012 at 3:03 AM, Brett Cannon wrote: > I think that would be good. And I would  even argue we remove support for > turning it off to force people to no longer lean on dict ordering as a > crutch (in 3.3 obviously). On-by-default should be enough to cover that. Just as we allow peo

Re: [Python-Dev] plugging the hash attack

2012-01-30 Thread Barry Warsaw
On Jan 30, 2012, at 12:03 PM, Brett Cannon wrote: >I think that would be good. And I would even argue we remove support for >turning it off to force people to no longer lean on dict ordering as a >crutch (in 3.3 obviously). Yes, please! -Barry ___ Pyt

Re: [Python-Dev] plugging the hash attack

2012-01-30 Thread Brett Cannon
On Fri, Jan 27, 2012 at 21:33, Benjamin Peterson wrote: > 2012/1/27 Steven D'Aprano : > > Benjamin Peterson wrote: > >> > >> Hello everyone, > >> In effort to get a fix out before Perl 6 goes mainstream, Barry and I > >> have decided to pronounce on what we want for our stable releases. > >> What

Re: [Python-Dev] plugging the hash attack

2012-01-29 Thread Gregory P. Smith
On Fri, Jan 27, 2012 at 6:33 PM, Benjamin Peterson wrote: > 2012/1/27 Steven D'Aprano : >> Benjamin Peterson wrote: >>> >>> Hello everyone, >>> In effort to get a fix out before Perl 6 goes mainstream, Barry and I >>> have decided to pronounce on what we want for our stable releases. >>> What we h

Re: [Python-Dev] plugging the hash attack

2012-01-28 Thread Georg Brandl
Am 28.01.2012 02:19, schrieb Benjamin Peterson: > Hello everyone, > In effort to get a fix out before Perl 6 goes mainstream, Barry and I > have decided to pronounce on what we want for our stable releases. > What we have decided is that > 1. Simple hash randomization is the way to go. We think thi

Re: [Python-Dev] plugging the hash attack

2012-01-27 Thread Guido van Rossum
On Fri, Jan 27, 2012 at 5:19 PM, Benjamin Peterson wrote: > Hello everyone, > In effort to get a fix out before Perl 6 goes mainstream, Barry and I > have decided to pronounce on what we want for our stable releases. > What we have decided is that > 1. Simple hash randomization is the way to go. W

Re: [Python-Dev] plugging the hash attack

2012-01-27 Thread Benjamin Peterson
2012/1/27 Steven D'Aprano : > Benjamin Peterson wrote: >> >> Hello everyone, >> In effort to get a fix out before Perl 6 goes mainstream, Barry and I >> have decided to pronounce on what we want for our stable releases. >> What we have decided is that >> 1. Simple hash randomization is the way to g

Re: [Python-Dev] plugging the hash attack

2012-01-27 Thread Steven D'Aprano
Benjamin Peterson wrote: Hello everyone, In effort to get a fix out before Perl 6 goes mainstream, Barry and I have decided to pronounce on what we want for our stable releases. What we have decided is that 1. Simple hash randomization is the way to go. We think this has the best chance of actual

Re: [Python-Dev] plugging the hash attack

2012-01-27 Thread martin
1. Simple hash randomization is the way to go. We think this has the best chance of actually fixing the problem while being fairly straightforward such that we're comfortable putting it in a stable release. 2. It will be off by default in stable releases and enabled by an envar at runtime. This wi

[Python-Dev] plugging the hash attack

2012-01-27 Thread Benjamin Peterson
Hello everyone, In effort to get a fix out before Perl 6 goes mainstream, Barry and I have decided to pronounce on what we want for our stable releases. What we have decided is that 1. Simple hash randomization is the way to go. We think this has the best chance of actually fixing the problem while