A RetroSearch Logo

Home - News ( United States | United Kingdom | Italy | Germany ) - Football scores

Search Query:

Showing content from https://mail.python.org/pipermail/python-dev/2012-January/115339.html below:

[Python-Dev] Hash collision security issue (now public)

[Python-Dev] Hash collision security issue (now public) [Python-Dev] Hash collision security issue (now public)Nick Coghlan ncoghlan at gmail.com
Fri Jan 6 02:33:50 CET 2012
On Fri, Jan 6, 2012 at 10:59 AM, Benjamin Peterson <benjamin at python.org> wrote:
> What exactly is the disadvantage of a sys attribute? That would seem
> preferable to an obscure incarnation like that.

Adding sys attributes in maintenance (or security) releases makes me nervous.

However, Victor and Christian are right about the need for a special
case to avoid leaking information, so my particular suggested check
won't work.

The most robust check would be to run sys.executable in a subprocess
and check if it gives the same hash for a non-empty string as the
current process.

Cheers,
Nick.

-- 
Nick Coghlan   |   ncoghlan at gmail.com   |   Brisbane, Australia
More information about the Python-Dev mailing list

RetroSearch is an open source project built by @garambo | Open a GitHub Issue

Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo

HTML: 3.2 | Encoding: UTF-8 | Version: 0.7.4