7 ms·

Is this GitHub issue typical of the Python community nowadays? A two-year old CVE is picked up by gpshead as suddenly urgent enough to justify a fairly signifi

by jhugo 4y ago

Is this GitHub issue typical of the Python community nowadays? A two-year old CVE is picked up by gpshead as suddenly urgent enough to justify a fairly significant breaking change in a patch release, despite another issue (#90716) already tracking better solutions to the same problem. gpshead submits a PR which doesn't solve the issue (the DoS still happens, and then a ValueError comes afterwards!), so mdickinson submits a PR which works around the problem in the first PR. Nobody else is apparently involved in discussing whether this change should even be made, and whether the fixed fix genuinely eliminates the DoS. mdickinson then has to fight for several comments to convince gpshead to make an obviously-correct and zero-cost change to the integer type, with gpshead dropping a passive-aggressive "pedantically correct" when they finally fix it. Then when other people finally notice the issue and start to question the need for the change, especially in the context of another issue discussing a better solution, they are ignored and the discussion is shut down with a reference to the Code of Conduct. Why would anyone want to participate in a community this toxic?

nas 4y ago
I'm pretty sure the decision on how to address the bug (and the determination of even if it's a bug) was not done by one dev. Other devs were involved and the determination was made as a team to make the change. Having a better fix, e.g. something like what is suggested in #90716 is not precluded. As yet, no one has actually stepped up with a better int-to-str implementation. I.e. something that can be reviewed, tested and then maintained in the long term As discussed in #90716, there is not much point in trying to do something similar to what GMP does. People can just install that library and use it. I'm not sure why people are so excited about this issue. It's not much different than sys.setrecursionlimit(). We know how to implement tail recursion. Python doesn't do it though and so there is a limit, set high enough that most people don't care. It seems a perfectly practical approach to me.
- adgjlsfhk1 4y ago
  It's a breaking change in a patch release that fixes the "Security Vulnerability" that python is sometimes slow.
  - pclmulqdq 4y ago
    If you are writing a server in python, you should expect these sorts of "vulnerabilites" (ie performance problems) in exchange for the convenient abstractions that you get.
  - cuteboy19 4y ago
    The vulnerability is int-ing untrusted inputs.
    - adgjlsfhk1 4y ago
      but it's not a vulnerability in the traditional sense. No information gets leaked, no invalid memory is accessed. It's just slow. If being slow is a vulnerability, all python code is a vulnerability.
      - viraptor 4y ago
        This is a bad take. The operation is not slow as in "takes longer", but as in "effectively never finishes". (that's what taking minutes on a single request means) That makes it trivial to DoS a service if you know it's running on a standard python runtime. And availability related to untrusted input is very much a vulnerability in a traditional sense. As traditional as it gets really: https://www.cvedetails.com/vulnerability-list/opdos-1/denial-of-service.html https://www.cvedetails.com/vulnerability-list/opdos-1/denial... It also has a financial impact definitely something security people are interested in.
        adgjlsfhk1 4y ago
        They set the limit at (on my computer) 0.1ms. Also, their implementation is roughly 100x slower than it should be. Should python also error out on loops that run for more than 1000 iterations? The problem isn't that int parsing is broken, the problem is that web-servers aren't validating their inputs.
        viraptor 4y ago
svnpenn 4y ago
> Why would anyone want to participate in a community this toxic? gpshead is Google: https://github.com/gpshead https://github.com/gpshead thats all you need to know. Google makes some great stuff (Go language), but their community has plenty of arrogant members that have no concept or interest in nuanced discussions.
- googlryas 4y ago
  I think you mean a googler. He isn't Google.
  - svnpenn 4y ago
    sorry, I don't use made up words.
    - googlryas 4y ago
      All words are made up.
      - svnpenn 4y ago
        googlryas 4y ago
        It's a quote from, at the very least, a recent movie. And really, my original post was "Google is a made up word", yet you used it. Even if you were okay using "google", but not "googler", saying the person "is google" is wrong - I actually clicked on the link expecting to see a corporate Google account, not just some random "person who works at Google".
        svnpenn 4y ago
    - 4y ago
ehhthing 4y ago
I was the one who reported this originally in 2020. Christian said it wasn't a vulnerability because it was intended that people who used standard library functions should validate user input. A day later I get another email saying that a CVE had been assigned, and that it was now suddenly a vulnerability. I wait a few months, follow up and nothing. Pretty much dropped it for 2 years and now I see that they finally fixed it and never let me know. I asked a few days ago whether I'd be credited in the CVE, still no reply... Why do I feel as if there are serious communication issues here?
- zelphirkalt 4y ago
  Maybe it is not in their code of conduct to let you know or reply in a timely manner.
- gpshead 4y ago
  Because there are. Digging through our history, a person who reported the same thing earlier than you never got a response at all. Like I said, we've identified organizational issues to be addressed. (I honestly don't know who should be "credited" on the CVE nor do I have control over that, sorry)
devwastaken 4y ago
Yep, that's how orgs work. Any org older than a certain number of years must delete itself and allow others to form another entity - or else it will amass warm bodies that collect titles and dont do anything useful. Unfortunately orgs will do everything to continue to exist, despite becoming irrelevant, inefficient, and losing their merit. Code of conduct is apart of this, it is designed to prevent strong dissenting opinion by claiming its offensive/improper. You cannot call out the true bad actors, because culturally we view offense as wrong and authority to be correct. COC is basically an HR document, it's to protect the org, not to do the right thing. History repeats itself.
tonto 4y ago
says the person posting in a fairly toxic manner
- jhugo 4y ago
  Could you point me to which part of my comment you found toxic? I thought I was careful to make sure it was only recounting facts, and the question I posed is genuine — as someone who used to contribute to Python (but hasn't worked with Python in a long time) I'd love to understand how things got to this point.
  - tonto 4y ago
    for what it's worth, I think you summarized the situation fairly accurately, but it's unclear what feeling you intend to convey with your comment other than to inflame readers emotionally
account42 4y ago
Linking the Code of Conduct instead actually pointing out anything specific ist such a shitty approach to this. We're used to this kind of ToS-pointing from SV tech corportations but it's sad that it seems to be getting more common in open source communities too.
gpshead 4y ago
If you don't understand why I cited the code of conduct and redirected discussion to a more appropriate forum for constructive discussion, go read our code of conduct vs the language that was being directed at us and what being linked from this toxic site was about to bring. There was no fighting. As soon as Mark piped up I was extremely pleased to see that he had found something that should've been obvious that we'd overlooked in the process of doing everything spread over time. Mark wasn't able to review the PR code before it was made public due to the current processes (lack of...) we're working to improve for the Python security response team. "pedantically correct" was not intended to be read as passive aggressive. I use that term to mean exact vs almost when it comes to computations. I didn't need convincing. I wanted the reasoning to be made understandable to everyone else in the future (future selves included) who was going to read this code later. I still think there is room for better explanation of the math but that is true for large parts of Objects/longobject.c anyways. I find your interpretation of events... amusing. :P
- jhugo 4y ago
  I went back and read the last comments before the CoC was invoked, and I read the CoC as well. Having done that, I don't understand which part of the CoC the comments were in violation of. Could you expand on why you think it was appropriate to shut the discussion down without even responding to those comments?

by jhugo 4y ago

nas 4y ago

I'm pretty sure the decision on how to address the bug (and the determination of even if it's a bug) was not done by one dev. Other devs were involved and the determination was made as a team to make the change. Having a better fix, e.g. something like what is suggested in #90716 is not precluded. As yet, no one has actually stepped up with a better int-to-str implementation. I.e. something that can be reviewed, tested and then maintained in the long term As discussed in #90716, there is not much point in trying to do something similar to what GMP does. People can just install that library and use it. I'm not sure why people are so excited about this issue. It's not much different than sys.setrecursionlimit(). We know how to implement tail recursion. Python doesn't do it though and so there is a limit, set high enough that most people don't care. It seems a perfectly practical approach to me.

adgjlsfhk1 4y ago
It's a breaking change in a patch release that fixes the "Security Vulnerability" that python is sometimes slow.
- pclmulqdq 4y ago
  If you are writing a server in python, you should expect these sorts of "vulnerabilites" (ie performance problems) in exchange for the convenient abstractions that you get.
- cuteboy19 4y ago
  The vulnerability is int-ing untrusted inputs.
  - adgjlsfhk1 4y ago
    but it's not a vulnerability in the traditional sense. No information gets leaked, no invalid memory is accessed. It's just slow. If being slow is a vulnerability, all python code is a vulnerability.
    - viraptor 4y ago
      This is a bad take. The operation is not slow as in "takes longer", but as in "effectively never finishes". (that's what taking minutes on a single request means) That makes it trivial to DoS a service if you know it's running on a standard python runtime. And availability related to untrusted input is very much a vulnerability in a traditional sense. As traditional as it gets really: https://www.cvedetails.com/vulnerability-list/opdos-1/denial-of-service.html https://www.cvedetails.com/vulnerability-list/opdos-1/denial... It also has a financial impact definitely something security people are interested in.
      - adgjlsfhk1 4y ago
        They set the limit at (on my computer) 0.1ms. Also, their implementation is roughly 100x slower than it should be. Should python also error out on loops that run for more than 1000 iterations? The problem isn't that int parsing is broken, the problem is that web-servers aren't validating their inputs.
        viraptor 4y ago

svnpenn 4y ago

> Why would anyone want to participate in a community this toxic? gpshead is Google: https://github.com/gpshead https://github.com/gpshead thats all you need to know. Google makes some great stuff (Go language), but their community has plenty of arrogant members that have no concept or interest in nuanced discussions.

googlryas 4y ago
I think you mean a googler. He isn't Google.
- svnpenn 4y ago
  sorry, I don't use made up words.
  - googlryas 4y ago
    All words are made up.
    - svnpenn 4y ago
      - googlryas 4y ago
        It's a quote from, at the very least, a recent movie. And really, my original post was "Google is a made up word", yet you used it. Even if you were okay using "google", but not "googler", saying the person "is google" is wrong - I actually clicked on the link expecting to see a corporate Google account, not just some random "person who works at Google".
        svnpenn 4y ago
  - 4y ago

ehhthing 4y ago

I was the one who reported this originally in 2020. Christian said it wasn't a vulnerability because it was intended that people who used standard library functions should validate user input. A day later I get another email saying that a CVE had been assigned, and that it was now suddenly a vulnerability. I wait a few months, follow up and nothing. Pretty much dropped it for 2 years and now I see that they finally fixed it and never let me know. I asked a few days ago whether I'd be credited in the CVE, still no reply... Why do I feel as if there are serious communication issues here?

zelphirkalt 4y ago
Maybe it is not in their code of conduct to let you know or reply in a timely manner.
gpshead 4y ago
Because there are. Digging through our history, a person who reported the same thing earlier than you never got a response at all. Like I said, we've identified organizational issues to be addressed. (I honestly don't know who should be "credited" on the CVE nor do I have control over that, sorry)

devwastaken 4y ago

Yep, that's how orgs work. Any org older than a certain number of years must delete itself and allow others to form another entity - or else it will amass warm bodies that collect titles and dont do anything useful. Unfortunately orgs will do everything to continue to exist, despite becoming irrelevant, inefficient, and losing their merit. Code of conduct is apart of this, it is designed to prevent strong dissenting opinion by claiming its offensive/improper. You cannot call out the true bad actors, because culturally we view offense as wrong and authority to be correct. COC is basically an HR document, it's to protect the org, not to do the right thing. History repeats itself.

tonto 4y ago

says the person posting in a fairly toxic manner

jhugo 4y ago
Could you point me to which part of my comment you found toxic? I thought I was careful to make sure it was only recounting facts, and the question I posed is genuine — as someone who used to contribute to Python (but hasn't worked with Python in a long time) I'd love to understand how things got to this point.
- tonto 4y ago
  for what it's worth, I think you summarized the situation fairly accurately, but it's unclear what feeling you intend to convey with your comment other than to inflame readers emotionally

account42 4y ago

Linking the Code of Conduct instead actually pointing out anything specific ist such a shitty approach to this. We're used to this kind of ToS-pointing from SV tech corportations but it's sad that it seems to be getting more common in open source communities too.

gpshead 4y ago

If you don't understand why I cited the code of conduct and redirected discussion to a more appropriate forum for constructive discussion, go read our code of conduct vs the language that was being directed at us and what being linked from this toxic site was about to bring. There was no fighting. As soon as Mark piped up I was extremely pleased to see that he had found something that should've been obvious that we'd overlooked in the process of doing everything spread over time. Mark wasn't able to review the PR code before it was made public due to the current processes (lack of...) we're working to improve for the Python security response team. "pedantically correct" was not intended to be read as passive aggressive. I use that term to mean exact vs almost when it comes to computations. I didn't need convincing. I wanted the reasoning to be made understandable to everyone else in the future (future selves included) who was going to read this code later. I still think there is room for better explanation of the math but that is true for large parts of Objects/longobject.c anyways. I find your interpretation of events... amusing. :P

jhugo 4y ago
I went back and read the last comments before the CoC was invoked, and I read the CoC as well. Having done that, I don't understand which part of the CoC the comments were in violation of. Could you expand on why you think it was appropriate to shut the discussion down without even responding to those comments?