> Or that time when Python disallowed string to int conversion of long strings because it is a DoS vulnerability. You're right that applications should have ra

> Or that time when Python disallowed string to int conversion of long strings because it is a DoS vulnerability. You're right that applications should have range checking of course, but the default limit is 4,300 digits, which seems enough for all but the most specialized applications; this number is huge. It makes sense to have a reasonable limit so your server isn't using all the memory and CPU time by accident. It's the same as max recursion limits and the like. Personally I don't think any DoS is a "security problem" though. It can be a problem, just as many bugs are, but "site is unavailable for a bit" or "my desktop application crashed" is just not on the order as "I lost all my money". Last month my bank's website was unavailable for a week, and it was annoying but basically fine with no real serious consequences.