RetroSearch Browse

Fri Jan 20 17:17:24 CET 2012 · https://mail.python.org/pipermail/python-dev/2012-January/115728.html

> So I still think we should ditch the paranoia about dictionary order changing,
> and fix this without counting.

The randomized hash has other issues:

 - its security is based on its secret, whereas it looks to be easy to
compute it (see more details in the issue)
 - my patch only changes hash(str), whereas other developers asked me
to patch also bytes, int and other types

hash(bytes) can be changed. But changing hash(int) may leak easily the
secret. We may use a different secret for each type, but if it is easy
to compute int hash secret, dictionaries using int are still
vulnerable.

--

There is no perfect solutions, drawbacks of each solution should be compared.

Victor

Home - News ( United States | United Kingdom | Italy | Germany ) - Football scores

Showing content from https://mail.python.org/pipermail/python-dev/2012-January/115728.html below:

[Python-Dev] Counting collisions for the win