Path: csiph.com!x330-a1.tempe.blueboxinc.net!usenet.pasdenom.info!aioe.org!news.stack.nl!newsfeed.xs4all.nl!newsfeed5.news.xs4all.nl!xs4all!newsgate.cistron.nl!newsgate.news.xs4all.nl!post.news.xs4all.nl!not-for-mail
Return-Path: <python-python-list@m.gmane.org>
X-Original-To: python-list@python.org
Delivered-To: python-list@mail.python.org
X-Spam-Status: OK 0.002
X-Spam-Evidence: '*H*': 1.00; '*S*': 0.00; 'subject:Python': 0.05; 'happily': 0.07; 'subject:missing': 0.07; 'python': 0.08; 'intern': 0.09; 'received:80.91': 0.09; 'received:80.91.229': 0.09; 'received:80.91.229.12': 0.09; 'received:gmane.org': 0.09; 'received:list': 0.09; 'received:lo.gmane.org': 0.09; 'sure,': 0.09; '*any*': 0.16; 'arbitrarily': 0.16; 'from:addr:behnel.de': 0.16; 'from:addr:stefan_ml': 0.16; 'from:name:stefan behnel': 0.16; 'randomize': 0.16; 'subject:String': 0.16; 'memory': 0.20; 'header:In-Reply-To:1': 0.22; 'figure': 0.23; 'stefan': 0.24; 'explicitly': 0.28; 'hash': 0.30; 'solved': 0.30; 'chris': 0.30; 'subject:?': 0.30; 'quite': 0.31; 'certainly': 0.32; 'it.': 0.33; 'header:User-Agent:1': 0.33; 'to:addr:python-list': 0.33; 'anything': 0.34; 'then.': 0.34; 'header:X-Complaints-To:1': 0.34; 'received:org': 0.37; "there's": 0.37; 'enough': 0.37; 'used,': 0.38; 'first.': 0.38; 'received:de': 0.39; 'subject:: ': 0.39; 'to:addr:python.org': 0.40; 'data': 0.40; 'bring': 0.60; 'order': 0.60; 'worth': 0.61; 'your': 0.61; 'provided': 0.61; 'same,': 0.67; '(based': 0.84; 'subject:moved': 0.84; 'attacks': 0.93; 'presumably': 0.93
X-Injected-Via-Gmane: http://gmane.org/
To: python-list@python.org
From: Stefan Behnel <stefan_ml@behnel.de>
Subject: Re: String interning in Python 3 - missing or moved?
Date: Tue, 24 Jan 2012 09:17:00 +0100
References: <CAPTjJmr5=8H9pmWMQ1Q==O1DFGe31ykOBXNzQ9YhS+W8aaAxfw@mail.gmail.com> <CAMZYqRQXfLTrwzqma=ryVKmJByzPtfQqQRa8OjGG7d+qZ7KNGA@mail.gmail.com> <jflbf2$l09$1@dough.gmane.org> <CAPTjJmrYgnYXstkdiN9T1ReV9KxjWN+wsmNita_oz4W_KzX78A@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
X-Gmane-NNTP-Posting-Host: fw-snc-frn5-de01.fw.telefonica.de
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:9.0) Gecko/20111220 Thunderbird/9.0
In-Reply-To: <CAPTjJmrYgnYXstkdiN9T1ReV9KxjWN+wsmNita_oz4W_KzX78A@mail.gmail.com>
X-BeenThere: python-list@python.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: General discussion list for the Python programming language <python-list.python.org>
List-Unsubscribe: <http://mail.python.org/mailman/options/python-list>, <mailto:python-list-request@python.org?subject=unsubscribe>
List-Archive: <http://mail.python.org/pipermail/python-list>
List-Post: <mailto:python-list@python.org>
List-Help: <mailto:python-list-request@python.org?subject=help>
List-Subscribe: <http://mail.python.org/mailman/listinfo/python-list>, <mailto:python-list-request@python.org?subject=subscribe>
Newsgroups: comp.lang.python
Message-ID: <mailman.5015.1327393037.27778.python-list@python.org>
Lines: 15
NNTP-Posting-Host: 2001:888:2000:d::a6
X-Trace: 1327393037 news.xs4all.nl 6922 [2001:888:2000:d::a6]:46753
X-Complaints-To: abuse@xs4all.nl
Xref: x330-a1.tempe.blueboxinc.net comp.lang.python:19326

Chris Angelico, 24.01.2012 05:47:
> Lua and Pike both quite happily solved hash collision attacks in their
> interning of strings by randomizing the hash used, because there's no
> way to rely on it. Presumably (based on the intern() docs) Python can
> do the same, if you explicitly intern your strings first. Is it worth
> recommending that people do this with anything that is
> client-provided, and then simply randomize the intern() hash?

If you want to encourage them to fill up their memory with user provided
data in a non-erasable way, then sure, that would certainly keep an
attacker from having to figure out hash collisions in order to bring down a
system. Sending *any* arbitrarily varied data would be enough then.

Stefan