7 ms·
JIT and GIL removal are not even my most anticipated Python 3.13 features
- kstrauser 2y agoThe shelve module is nice. Sqlite is nice. Having both of them combined and cross-platform will be brilliant.
- deleted 2y ago[deleted]
- Hendrikto 2y agoSQLite is such a great project. Thanks Richard Hipp. Cool to see it supported ootb as a dbm backend.
- smitty1e 2y agoSQLite and Python are the peanut butter and chocolate of software.
- Dunedan 2y agoMind that shelve, by utilizing pickle, is susceptible for arbitrary code execution when loading untrusted data. Depending on the use case it might be better to just use the dbm module directly.
- john-tells-all 2y agoRaymond Hettinger is a treasure! In addition to shelve-sqlite, he's contributed a pile to the Python ecosystem: - fleshed out modules: functools, itertools -- love them; also bisect, collections, decimal, math, random, and type aliases - enhanced the dictionary and set types, used by 100% of programs His talks are high-energy and very useful. I just found one on "Pro tips for writing Unit Tests" <3 -- https://www.youtube.com/watch?v=jSIsyMd2-RY https://www.youtube.com/watch?v=jSIsyMd2-RY
- ysleepy 2y agoShelve uses pickle, which executes untrusted code without asking. These types of serialisation are a technical debt from day one. There are countless stories of ecosystems doing a very painful migration to get away from it. See java, or recently the ML model files trying to go to safetensors etc.
- OutOfHere 2y agoThere is nothing stopping you from storing just strings or bytes having safe representations.
- ysleepy 2y agoThe same way that it's fine to use `eval()` to parse JSON I assume.
- OutOfHere 2y agoThis thread has bastardized serialization with storage even though the two are orthogonal concepts. If you don't want shelve to unpickle a hazardous object, give it a string or byte representation.
- Dunedan 2y agoAnd that's exactly why it's so dangerous to use pickle, because it doesn't prevent you from executing untrusted code. It doesn't matter if you only pickle strings and bytes, as long as you unpickle any data, an attacker can replace that data with something which results in arbitrary code execution. If you only want to store bytes, the safe way to do so is to use the dbm module directly, which doesn't pickle/unpickle the data you provide.
- OutOfHere 2y agoI find pickle useful for trusted objects that I created myself. pkl.xz is for example a fast way to reproducibly store and read Pandas dataframes. I have also found pickle useful for custom serialization of some objects that needed it.
- bun_terminator 2y agoI can't wait to see what political message the python team choses to run this time in the release notes. It'll be just a month before the election. Stunning and brave probably!
- kstrauser 2y agoIs the person writing that doc on your payroll? If not, and you want to have a say in the contents of their work output, then you might consider fixing that.
- bun_terminator 2y agoI'm just impressed at the increasingly hyperpolitical messaging in my tech release notes. I can't get enough!
- cqqxo4zV46cp 2y agoMost of your HN comments are political in nature. You obviously don’t mind mixing your tech and your politics. This is blatantly manufactured outrage, and you’re using sarcasm to give you an “I never said I was upset” escape hatch when someone inevitably points this out to you.
- bun_terminator 2y agoI am anti-political, big difference. And yes, sarcasm exists
- OKRainbowKid 2y agoIf you we're anti-political, you wouldn't insert your political leanings in your comments. That makes them political.
- bun_terminator 2y ago