RetroSearch Browse

Thu Jan 17 12:35:37 CET 2008 · https://mail.python.org/pipermail/python-dev/2008-January/076243.html

On Thu, 17 Jan 2008 08:55:51 +0100, Christian Heimes <lists at cheimes.de> wrote:
>
>* Should the site package directory also be ignored if process
>  gid != effective gid?

If it should, I think the PEP should explain the attack this defends
against in more detail.  The current brief mention of "security issues"
is a bit hand-wavey.  For example, what is the relationship between
security, this feature, and the PYTHONPATH environment variable?  Isn't
the attack of putting malicious code into a user site-packages directory
the same as the attack of putting it into a directory in PYTHONPATH?

Jean-Paul

Home - News ( United States | United Kingdom | Italy | Germany ) - Football scores

Showing content from https://mail.python.org/pipermail/python-dev/2008-January/076243.html below:

[Python-Dev] PEP 370, open questions