Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.python > #67612 > unrolled thread

Re: How security holes happen

Back to article view | Back to comp.lang.python

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: How security holes happen Chris Kaynor <ckaynor@zindagigames.com> - 2014-03-03 14:55 -0800
    Re: How security holes happen sffjunkie@gmail.com - 2014-03-04 08:41 -0800
      Re: How security holes happen Chris Angelico <rosuav@gmail.com> - 2014-03-05 04:07 +1100
      Re: How security holes happen Skip Montanaro <skip@pobox.com> - 2014-03-04 11:16 -0600
      Re: How security holes happen Ned Batchelder <ned@nedbatchelder.com> - 2014-03-04 15:47 -0500
      Re: How security holes happen Ethan Furman <ethan@stoneleaf.us> - 2014-03-04 13:49 -0800
        Re: How security holes happen Marko Rauhamaa <marko@pacujo.net> - 2014-03-05 00:48 +0200
          Re: How security holes happen Chris Angelico <rosuav@gmail.com> - 2014-03-05 09:57 +1100
            Re: How security holes happen Roy Smith <roy@panix.com> - 2014-03-04 17:59 -0500
              Re: How security holes happen Mark Lawrence <breamoreboy@yahoo.co.uk> - 2014-03-04 23:16 +0000
              Re: How security holes happen Chris Angelico <rosuav@gmail.com> - 2014-03-05 10:22 +1100
              Re: How security holes happen Mark Lawrence <breamoreboy@yahoo.co.uk> - 2014-03-04 23:40 +0000
          Re: How security holes happen Dennis Lee Bieber <wlfraed@ix.netcom.com> - 2014-03-04 19:31 -0500
          Re: How security holes happen Dennis Lee Bieber <wlfraed@ix.netcom.com> - 2014-03-04 19:30 -0500
            Re: How security holes happen Roy Smith <roy@panix.com> - 2014-03-04 20:57 -0500
              Re: How security holes happen MRAB <python@mrabarnett.plus.com> - 2014-03-05 04:11 +0000
                Re: How security holes happen Marko Rauhamaa <marko@pacujo.net> - 2014-03-05 08:37 +0200
                  Re: How security holes happen Steven D'Aprano <steve@pearwood.info> - 2014-03-05 08:26 +0000
                    Re: How security holes happen Ben Finney <ben+python@benfinney.id.au> - 2014-03-05 19:57 +1100
                    Re: How security holes happen Marko Rauhamaa <marko@pacujo.net> - 2014-03-05 11:01 +0200
                    Re: How security holes happen "Mark H. Harris" <harrismh777@gmail.com> - 2014-03-05 06:11 -0800
                      Re: How security holes happen Chris Angelico <rosuav@gmail.com> - 2014-03-06 02:16 +1100
                      Re: How security holes happen Dennis Lee Bieber <wlfraed@ix.netcom.com> - 2014-03-05 19:24 -0500
                        Re: How security holes happen "Mark H. Harris" <harrismh777@gmail.com> - 2014-03-05 17:24 -0800
                          Re: How security holes happen MRAB <python@mrabarnett.plus.com> - 2014-03-06 01:40 +0000
                            Re: How security holes happen "Mark H. Harris" <harrismh777@gmail.com> - 2014-03-05 18:07 -0800
                          Re: How security holes happen Dennis Lee Bieber <wlfraed@ix.netcom.com> - 2014-03-06 19:28 -0500
                            Re: How security holes happen "Mark H. Harris" <harrismh777@gmail.com> - 2014-03-06 17:53 -0800
                              Re: How security holes happen MRAB <python@mrabarnett.plus.com> - 2014-03-07 02:13 +0000
                                Re: How security holes happen "Mark H. Harris" <harrismh777@gmail.com> - 2014-03-06 18:39 -0800
                                  Re: How security holes happen Dennis Lee Bieber <wlfraed@ix.netcom.com> - 2014-03-07 19:46 -0500
                              Re: How security holes happen Dennis Lee Bieber <wlfraed@ix.netcom.com> - 2014-03-07 19:43 -0500
          Re: How security holes happen Neil Cerutti <neilc@norwich.edu> - 2014-03-05 14:19 +0000
            Re: How security holes happen Marko Rauhamaa <marko@pacujo.net> - 2014-03-05 16:54 +0200
              Re: How security holes happen Steven D'Aprano <steve+comp.lang.python@pearwood.info> - 2014-03-05 18:42 +0000
                Re: How security holes happen Chris Angelico <rosuav@gmail.com> - 2014-03-06 06:00 +1100
          Re: How security holes happen Grant Edwards <invalid@invalid.invalid> - 2014-03-05 15:28 +0000
          Re: How security holes happen Steven D'Aprano <steve+comp.lang.python@pearwood.info> - 2014-03-05 15:47 +0000
            Re: How security holes happen "Mark H. Harris" <harrismh777@gmail.com> - 2014-03-05 08:37 -0800

Page 1 of 2  [1] 2  Next page →

#67612 — Re: How security holes happen

[Multipart message — attachments visible in raw view] — view raw

On Mon, Mar 3, 2014 at 2:25 PM, Chris Angelico <rosuav@gmail.com> wrote:

> On Tue, Mar 4, 2014 at 9:19 AM, Cameron Simpson <cs@zip.com.au> wrote:
> > On 03Mar2014 09:17, Neal Becker <ndbecker2@gmail.com> wrote:
> >>  Charles R Harris <charlesr.harris@gmail.com> Wrote in message:
> >> >
> >>
> >> Imo the lesson here is never write in low level c. Use modern
> >>  languages with well designed exception handling.
> >
> > What, and rely on someone else's low level C?
>
> Someone needs to port Python to LISP.
>
> And then write a LISP interpreter in JavaScript.
>
> And an ECMAScript engine in Pike.
>
> And a Pike interpreter in Java.
>
> And a Java run-time written in ActionScript.
>
> It's turtles all the way down...
>

You can go much simpler than that. Merely port Python to LISP, then write a
LISP interpreter in Python. Done.

Now, bootstrapping those interpreters might pose a bit of a challenge...


>
> ChrisA
> --
> https://mail.python.org/mailman/listinfo/python-list
>

[toc] | [next] | [standalone]

#67703

On Monday, 3 March 2014 22:55:32 UTC, Chris Kaynor  wrote:
> You can go much simpler than that. Merely port Python to LISP, then write a LISP interpreter in Python. Done.

http://blog.pault.ag/post/46982895940/heres-my-talk-from-pycon-2013-i-tried-to-queue

[toc] | [prev] | [next] | [standalone]

#67706

On Wed, Mar 5, 2014 at 3:41 AM,  <sffjunkie@gmail.com> wrote:
> On Monday, 3 March 2014 22:55:32 UTC, Chris Kaynor  wrote:
>> You can go much simpler than that. Merely port Python to LISP, then write a LISP interpreter in Python. Done.
>
> http://blog.pault.ag/post/46982895940/heres-my-talk-from-pycon-2013-i-tried-to-queue

I don't have time to watch an hour-long video... what'd he do, exactly that?

ChrisA

[toc] | [prev] | [next] | [standalone]

#67709

On Tue, Mar 4, 2014 at 11:07 AM, Chris Angelico <rosuav@gmail.com> wrote:
> I don't have time to watch an hour-long video... what'd he do, exactly that?

If you fast forward to 16:14, his talk is about five minutes long. He
wrote a Lisp compiler whose backend is Python.

Skip

[toc] | [prev] | [next] | [standalone]

#67716

On 3/4/14 12:16 PM, Skip Montanaro wrote:
> On Tue, Mar 4, 2014 at 11:07 AM, Chris Angelico <rosuav@gmail.com> wrote:
>> I don't have time to watch an hour-long video... what'd he do, exactly that?
>
> If you fast forward to 16:14, his talk is about five minutes long. He
> wrote a Lisp compiler whose backend is Python.
>
> Skip
>

It's Hy: http://hylang.org

-- 
Ned Batchelder, http://nedbatchelder.com

[toc] | [prev] | [next] | [standalone]

#67742

On 03/04/2014 12:47 PM, Ned Batchelder wrote:
> On 3/4/14 12:16 PM, Skip Montanaro wrote:
>> On Tue, Mar 4, 2014 at 11:07 AM, Chris Angelico <rosuav@gmail.com> wrote:
>>> I don't have time to watch an hour-long video... what'd he do,
>>> exactly that?
>>
>> If you fast forward to 16:14, his talk is about five minutes long. He
>> wrote a Lisp compiler whose backend is Python.
>>
>> Skip
>>
>
> It's Hy: http://hylang.org

Okay, that looks totally cool.  Maybe I'll finally get a handle on LISP!  :)

--
~Ethan~

[toc] | [prev] | [next] | [standalone]

#67745

Ethan Furman <ethan@stoneleaf.us>:

> Okay, that looks totally cool. Maybe I'll finally get a handle on
> LISP! :)

Lisp is conceptually simpler than Python, but awe-inspiring. One day, it
will overtake Python, I believe.

Once you have Lisp down pat, you'll be able to appreciate <URL:
http://en.wikipedia.org/wiki/Combinatory_logic>.

The final Nirvana is reached with <URL:
http://semarch.linguistics.fas.nyu.edu/barker/Iota/>.


Marko

[toc] | [prev] | [next] | [standalone]

#67747

On Wed, Mar 5, 2014 at 9:48 AM, Marko Rauhamaa <marko@pacujo.net> wrote:
> Lisp is conceptually simpler than Python, but awe-inspiring. One day, it
> will overtake Python, I believe.
>
> The final Nirvana is reached with...

No no no. The final Nirvana is achieved when you no longer write text
at all, but simply edit an empty file. When you are done, the file is
still empty, and you have truly reached nirvana.

Either that, or you code in
http://en.wikipedia.org/wiki/Whitespace_(programming_language) ...

ChrisA

[toc] | [prev] | [next] | [standalone]

#67748

In article <mailman.7763.1393973842.18130.python-list@python.org>,
 Chris Angelico <rosuav@gmail.com> wrote:

> On Wed, Mar 5, 2014 at 9:48 AM, Marko Rauhamaa <marko@pacujo.net> wrote:
> > Lisp is conceptually simpler than Python, but awe-inspiring. One day, it
> > will overtake Python, I believe.
> >
> > The final Nirvana is reached with...
> 
> No no no. The final Nirvana is achieved when you no longer write text
> at all, but simply edit an empty file. When you are done, the file is
> still empty, and you have truly reached nirvana.
> 
> Either that, or you code in
> http://en.wikipedia.org/wiki/Whitespace_(programming_language) ...
> 
> ChrisA

Man, imagine what you could do with a Unicode version of Whitespace?

[toc] | [prev] | [next] | [standalone]

#67755

On 04/03/2014 22:59, Roy Smith wrote:
> In article <mailman.7763.1393973842.18130.python-list@python.org>,
>   Chris Angelico <rosuav@gmail.com> wrote:
>
>> On Wed, Mar 5, 2014 at 9:48 AM, Marko Rauhamaa <marko@pacujo.net> wrote:
>>> Lisp is conceptually simpler than Python, but awe-inspiring. One day, it
>>> will overtake Python, I believe.
>>>
>>> The final Nirvana is reached with...
>>
>> No no no. The final Nirvana is achieved when you no longer write text
>> at all, but simply edit an empty file. When you are done, the file is
>> still empty, and you have truly reached nirvana.
>>
>> Either that, or you code in
>> http://en.wikipedia.org/wiki/Whitespace_(programming_language) ...
>>
>> ChrisA
>
> Man, imagine what you could do with a Unicode version of Whitespace?
>

Yes, but how do we pursuade the Python core devs to give us a decent 
implementation?  Let's face it, according to our resident unicode 
expert, they can't get anything right about unicode.

-- 
My fellow Pythonistas, ask not what our language can do for you, ask 
what you can do for our language.

Mark Lawrence

---
This email is free from viruses and malware because avast! Antivirus protection is active.
http://www.avast.com

[toc] | [prev] | [next] | [standalone]

#67756

On Wed, Mar 5, 2014 at 10:16 AM, Mark Lawrence <breamoreboy@yahoo.co.uk> wrote:
>> Man, imagine what you could do with a Unicode version of Whitespace?
>>
>
> Yes, but how do we pursuade the Python core devs to give us a decent
> implementation?  Let's face it, according to our resident unicode expert,
> they can't get anything right about unicode.

Easy. We get him to implement it.

ChrisA

[toc] | [prev] | [next] | [standalone]

#67758

On 04/03/2014 23:22, Chris Angelico wrote:
> On Wed, Mar 5, 2014 at 10:16 AM, Mark Lawrence <breamoreboy@yahoo.co.uk> wrote:
>>> Man, imagine what you could do with a Unicode version of Whitespace?
>>>
>>
>> Yes, but how do we pursuade the Python core devs to give us a decent
>> implementation?  Let's face it, according to our resident unicode expert,
>> they can't get anything right about unicode.
>
> Easy. We get him to implement it.
>
> ChrisA
>

Bingo, nail struck firmly on head with steam roller :)

-- 
My fellow Pythonistas, ask not what our language can do for you, ask 
what you can do for our language.

Mark Lawrence

---
This email is free from viruses and malware because avast! Antivirus protection is active.
http://www.avast.com

[toc] | [prev] | [next] | [standalone]

#67767

On Wed, 5 Mar 2014 09:57:20 +1100, Chris Angelico <rosuav@gmail.com>
declaimed the following:

>On Wed, Mar 5, 2014 at 9:48 AM, Marko Rauhamaa <marko@pacujo.net> wrote:
>> Lisp is conceptually simpler than Python, but awe-inspiring. One day, it
>> will overtake Python, I believe.
>>
>> The final Nirvana is reached with...
>
>No no no. The final Nirvana is achieved when you no longer write text
>at all, but simply edit an empty file. When you are done, the file is
>still empty, and you have truly reached nirvana.
>
	Forget Nirvana... http://ldworen.net/fun/osvu.html
-- 
	Wulfraed                 Dennis Lee Bieber         AF6VN
    wlfraed@ix.netcom.com    HTTP://wlfraed.home.netcom.com/

[toc] | [prev] | [next] | [standalone]

#67768

On Wed, 05 Mar 2014 00:48:40 +0200, Marko Rauhamaa <marko@pacujo.net>
declaimed the following:

>Ethan Furman <ethan@stoneleaf.us>:
>
>> Okay, that looks totally cool. Maybe I'll finally get a handle on
>> LISP! :)
>
>Lisp is conceptually simpler than Python, but awe-inspiring. One day, it
>will overtake Python, I believe.
>

	It's already had 54 years to become a major language...

	Instead it has schismed into Common Lisp and Scheme (and a few other
dialects)

	Granted, my experience was toying with /cassette-based/ SuperSoft LISP
on a TRS-80 Model III
-- 
	Wulfraed                 Dennis Lee Bieber         AF6VN
    wlfraed@ix.netcom.com    HTTP://wlfraed.home.netcom.com/

[toc] | [prev] | [next] | [standalone]

#67773

In article <mailman.7777.1393980007.18130.python-list@python.org>,
 Dennis Lee Bieber <wlfraed@ix.netcom.com> wrote:

> On Wed, 05 Mar 2014 00:48:40 +0200, Marko Rauhamaa <marko@pacujo.net>
> declaimed the following:
> 
> >Ethan Furman <ethan@stoneleaf.us>:
> >
> >> Okay, that looks totally cool. Maybe I'll finally get a handle on
> >> LISP! :)
> >
> >Lisp is conceptually simpler than Python, but awe-inspiring. One day, it
> >will overtake Python, I believe.

I first played with Lisp in 1976.  The only time I ever used it for 
anything serious was an A/I course I took in the mid 80's.  At the end 
of the semester, I was just starting to write things in Lisp (as opposed 
to writing C transliterated to Lisp syntax and keywords).

>  It's already had 54 years to become a major language...
> 
>  Instead it has schismed into Common Lisp and Scheme (and a few other
> dialects)

Python has had 23 years to become a major language...

Instead it has schismed into Python 2.x and Python 3.x.

[holding hands over ears to avoid the howls of derision, while ducking 
and running]

[toc] | [prev] | [next] | [standalone]

#67794

On 2014-03-05 01:57, Roy Smith wrote:
> In article <mailman.7777.1393980007.18130.python-list@python.org>,
>   Dennis Lee Bieber <wlfraed@ix.netcom.com> wrote:
>
>> On Wed, 05 Mar 2014 00:48:40 +0200, Marko Rauhamaa <marko@pacujo.net>
>> declaimed the following:
>>
>> >Ethan Furman <ethan@stoneleaf.us>:
>> >
>> >> Okay, that looks totally cool. Maybe I'll finally get a handle on
>> >> LISP! :)
>> >
>> >Lisp is conceptually simpler than Python, but awe-inspiring. One day, it
>> >will overtake Python, I believe.
>
> I first played with Lisp in 1976.  The only time I ever used it for
> anything serious was an A/I course I took in the mid 80's.  At the end
> of the semester, I was just starting to write things in Lisp (as opposed
> to writing C transliterated to Lisp syntax and keywords).
>
>>  It's already had 54 years to become a major language...
>>
>>  Instead it has schismed into Common Lisp and Scheme (and a few other
>> dialects)
>
> Python has had 23 years to become a major language...
>
> Instead it has schismed into Python 2.x and Python 3.x.
>
Into how many versions did Lisp split in its first 23 years? :-)

> [holding hands over ears to avoid the howls of derision, while ducking
> and running]
>

[toc] | [prev] | [next] | [standalone]

#67816

MRAB <python@mrabarnett.plus.com>:

> Into how many versions did Lisp split in its first 23 years? :-)

I'm partial to Scheme, but I'll take any version.

If you had tried Python 30 years ago, you'd give it up for any serious
work because it would be so slow and consume so much memory. C++ virtual
functions used to be avoided because of performance reasons. These are
truly amazing times for computing: Java, C#, Python etc are now
mainstream, and advanced programming concepts like closures are
available to and expected from run-of-the-mill code pushers.

Java programmers were afflicted by XML and didn't know of anything
better. They are now being exposed to Clojure.

Python programmers are starting to see glimpses of a better world with
ast.literal_eval().

So we are getting there. Give it a few more decades.


Marko

[toc] | [prev] | [next] | [standalone]

#67823

On Wed, 05 Mar 2014 08:37:42 +0200, Marko Rauhamaa wrote:

> MRAB <python@mrabarnett.plus.com>:
> 
>> Into how many versions did Lisp split in its first 23 years? :-)
> 
> I'm partial to Scheme, but I'll take any version.
> 
> If you had tried Python 30 years ago, you'd give it up for any serious
> work because it would be so slow and consume so much memory.

/facepalm

Python is only 23 years old, so it would have been a good trick to have 
tried it 30 years ago. While it was slow back then, it used LESS memory, 
not more. (Trading off more memory for speed is one of the ways that 
Python has gotten faster.) Nevertheless, people did use it for serious 
work, at least by the time it got to version 1.4 and quite likely much 
earlier.



-- 
Steven

[toc] | [prev] | [next] | [standalone]

#67825

Steven D'Aprano <steve@pearwood.info> writes:

> On Wed, 05 Mar 2014 08:37:42 +0200, Marko Rauhamaa wrote:
>
> > If you had tried Python 30 years ago, you'd give it up for any
> > serious work because it would be so slow and consume so much memory.
>
> /facepalm
>
> Python is only 23 years old, so it would have been a good trick to have 
> tried it 30 years ago. While it was slow back then, it used LESS memory, 
> not more.

Moreover, this is not an issue of Python the language as much as
*implementations* (the CPython implementation has improved markedly in
the intervening decades), and of *resources* very different then and
now.

The available CPU and memory resources for a language implementation is
vastly greater today than 30 years ago. You could re-implement exactly
the same compiler today as was run 30 years ago, and have its speed and
memory performance remarkably better without any change in the language.

If you'd run an implementation of *any* language of the time 30 years
ago, it would have been far slower than implementations on today's
hardware, and doubless improvements in the implementation (if the
community was motivated to improve it for that long) would account for
even greater speed differences.

None of this is argument in favour of the changing applicability of the
*language*, which is what Marko apparently wants to imply.

-- 
 \          “I got an answering machine for my phone. Now when someone |
  `\      calls me up and I'm not home, they get a recording of a busy |
_o__)                                          signal.” —Steven Wright |
Ben Finney

[toc] | [prev] | [next] | [standalone]

#67828

Steven D'Aprano <steve@pearwood.info>:

> On Wed, 05 Mar 2014 08:37:42 +0200, Marko Rauhamaa wrote:
>> If you had tried Python 30 years ago, you'd give it up for any
>> serious work because it would be so slow and consume so much memory.
>
> /facepalm
>
> Python is only 23 years old,

Some explorers roamed in Siberia around 1900 and encountered small
nations with undocumented languages. They stayed with the people for
some time and tried to record the basic vocabulary and grammar. The
dialog sometimes went like this:

  - In your language, is it correct to say, "I went fishing yesterday."

  - No.

  - What's wrong with it?

  - I didn't go fishing yesterday.


Marko

[toc] | [prev] | [next] | [standalone]

Page 1 of 2  [1] 2  Next page →

Back to top | Article view | comp.lang.python

csiph-web