Re: [Python-Dev] PEP 551: Security transparency in the Python runtime

2017-08-28 Thread Steve Dower
On 28Aug2017 1926, Chris Angelico wrote: On Tue, Aug 29, 2017 at 12:23 PM, Steve Dower wrote: Check your line lengths, I think they may be too long? (Or maybe my mail client is set too short?) Yeah, not sure what's happened here. Are PEPs supposed to be 80? Or 72? According to the emacs st

Re: [Python-Dev] PEP 551: Security transparency in the Python runtime

2017-08-28 Thread Steve Dower
On 28Aug2017 1834, Gregory P. Smith wrote: My gut feeling says that there are N interpreters available on just about every bloated system image out there. Multiple pythons are often among them, other we do not control will also continue to exist. I expect a small initial payload can be created th

Re: [Python-Dev] PEP 551: Security transparency in the Python runtime

2017-08-28 Thread Chris Angelico
On Tue, Aug 29, 2017 at 12:23 PM, Steve Dower wrote: >> Check your line lengths, I think they may be too long? (Or maybe my mail >> client is set too short?) > > > Yeah, not sure what's happened here. Are PEPs supposed to be 80? Or 72? According to the emacs stanza at the end, 70. I don't know of

Re: [Python-Dev] PEP 551: Security transparency in the Python runtime

2017-08-28 Thread Steve Dower
On 28Aug2017 1815, Steven D'Aprano wrote: Very nicely written. A few comments below. On Mon, Aug 28, 2017 at 04:55:19PM -0700, Steve Dower wrote: [...] This PEP describes additions to the Python API and specific behaviors for the CPython implementation that make actions taken by the Python run

Re: [Python-Dev] PEP 551: Security transparency in the Python runtime

2017-08-28 Thread Gregory P. Smith
My gut feeling says that there are N interpreters available on just about every bloated system image out there. Multiple pythons are often among them, other we do not control will also continue to exist. I expect a small initial payload can be created that when executed will binary patch the interp

Re: [Python-Dev] PEP 551: Security transparency in the Python runtime

2017-08-28 Thread Steven D'Aprano
Very nicely written. A few comments below. On Mon, Aug 28, 2017 at 04:55:19PM -0700, Steve Dower wrote: [...] > This PEP describes additions to the Python API and specific behaviors > for the > CPython implementation that make actions taken by the Python runtime > visible to > security and audi

[Python-Dev] PEP 551: Security transparency in the Python runtime

2017-08-28 Thread Steve Dower
Hi python-dev, Those of you who were at the PyCon US language summit this year (or who saw the coverage at https://lwn.net/Articles/723823/) may recall that I talked briefly about the ways Python is used by attackers to gain and/or retain access to systems on local networks. I present here P