Path: csiph.com!usenet.pasdenom.info!goblin2!goblin.stu.neva.ru!newsfeed.xs4all.nl!newsfeed3a.news.xs4all.nl!xs4all!post.news.xs4all.nl!not-for-mail Return-Path: X-Original-To: python-list@python.org Delivered-To: python-list@mail.python.org X-Spam-Status: OK 0.049 X-Spam-Evidence: '*H*': 0.90; '*S*': 0.00; 'subject:Python': 0.06; 'automate': 0.07; 'debugging': 0.07; "subject:' ": 0.07; 'augmented': 0.09; 'feature,': 0.09; 'cc:addr:python-list': 0.11; '23,': 0.16; 'dict': 0.16; 'symbols': 0.16; 'think.': 0.16; 'subject:python': 0.16; 'wrote:': 0.18; 'app': 0.19; 'basically': 0.19; 'patrick': 0.19; 'separate': 0.22; 'cc:addr:python.org': 0.22; 'stick': 0.24; 'cc:2**0': 0.24; 'script': 0.25; 'push': 0.26; 'header:In-Reply-To:1': 0.27; 'chris': 0.29; 'feature': 0.29; 'am,': 0.29; 'url:mailman': 0.30; 'reply.': 0.31; 'too.': 0.31; 'url:python': 0.33; 'guess': 0.33; 'could': 0.34; 'but': 0.35; 'received:google.com': 0.35; 'there': 0.35; 'really': 0.36; 'url:listinfo': 0.36; 'thanks': 0.36; 'possible': 0.36; 'url:org': 0.36; 'message-id:@gmail.com': 0.38; 'nov': 0.38; 'process,': 0.38; 'pm,': 0.38; 'anything': 0.39; 'skip:p 20': 0.39; 'users': 0.40; 'url:mail': 0.40; 'even': 0.60; 'break': 0.61; 'no.': 0.61; 'simply': 0.61; 'header:Message-Id:1': 0.63; 'hear': 0.63; 'pick': 0.64; 'more': 0.64; 'great': 0.65; 'to:addr:gmail.com': 0.65; 'effectively': 0.66; 'secure': 0.71; 'lack': 0.78; '2014,': 0.84; 'dict.': 0.84; 'embrace': 0.84; 'i\xe2\x80\x99ll': 0.84; 'clearing': 0.91 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=tN2pKHyPJXkO4mk/UjkzzGVTx0jtOtxFrHWufxfe8Q0=; b=gNtjsYaw9SOQXQjxBcwJKvH0wn08XeBNMoL3u7fGEQBQi+GBerj2amlTa+caiOdc8D 2JzwNw2TgD1O38rTqxZf8+/VRglwbxYM1nKAVHaKaacEkja30dhmbqARACpqMNwCERSD z14WuFmkJsOIRunB54iVe/gIMXBfOaPDJcuvkfouQnA7G1UcCRKSwjDMEK7NYYZhh/VB g8C5lFCVA53xNRG/680BpTg5cv+WMmTTm2gmO/Zl2Q4FHMMJoiPkj8ygfjpsQr8wcRJ7 7WBzLhGMbPOhompFoea6b8FS3XULXle8DvTovIjAvdFrMPxTqJMQGoaWkXg9U2uazb5p bzlw== X-Received: by 10.68.235.70 with SMTP id uk6mr23561712pbc.152.1416748806476; Sun, 23 Nov 2014 05:20:06 -0800 (PST) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 8.1 \(1993\)) Subject: Re: Embedded python 'scripting engine' inside Python app From: Patrick Stinson In-Reply-To: Date: Sun, 23 Nov 2014 04:20:03 -0900 Content-Transfer-Encoding: quoted-printable References: <05D7659F-9D0B-466B-833E-8454DCF0F57A@gmail.com> <0B2C4A0D-401C-446E-9EE6-C04791F904DB@gmail.com> To: Chris Angelico X-Mailer: Apple Mail (2.1993) X-Mailman-Approved-At: Mon, 24 Nov 2014 09:16:01 +0100 Cc: "python-list@python.org" X-BeenThere: python-list@python.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: General discussion list for the Python programming language List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Newsgroups: comp.lang.python Message-ID: Lines: 32 NNTP-Posting-Host: 2001:888:2000:d::a6 X-Trace: 1416816962 news.xs4all.nl 2872 [2001:888:2000:d::a6]:57330 X-Complaints-To: abuse@xs4all.nl Xref: csiph.com comp.lang.python:81444 I think this is the way I=E2=80=99ll take it, and for all the same = reasons. The only way they can break it is if they really want to. I = guess anything other Franken-apps would be interesting to hear about = too. And I=E2=80=99ll still stick it on the app store. > On Nov 23, 2014, at 1:35 AM, Chris Angelico wrote: >=20 > On Sun, Nov 23, 2014 at 9:28 PM, Patrick Stinson = wrote: >> Thanks for your great reply. I even augmented the reloading with the = same >> dict by clearing all of the non-standard symbols from the dict. This >> effectively resets the dict: >=20 > You may as well start with an empty dict and then pick up the few > things you want, I think. >=20 >> Is there a better and more secure way to do the python-within-python = in >> order allow users to automate your app? >=20 > More secure? Basically no. You could push the inner script into a > separate process, but I would recommend simply acknowledging the > insecurity. Embrace the lack of security and call it a debugging > feature - make it possible to introspect, control, manipulate internal > structures. Feature, not flaw. :) >=20 > ChrisA > --=20 > https://mail.python.org/mailman/listinfo/python-list