3 ms·

Nice - although I wish they would fix the bugs in those libraries, too.

danielweber 13y ago
Many of the man pages for the function say "don't use them." OpenBSD let you link against "strcpy" but screams at you if you do. Also, what's pickle? PS: don't type "man pickle" into the google, you won't like it.
- PhantomGremlin 13y ago
  Googling for "python pickle" will provide more benign search results.
- Piskvorrr 13y ago
  https://wiki.python.org/moin/UsingPickle https://wiki.python.org/moin/UsingPickle
- anonymoushn 13y ago
  Pickle is Python's native object serialization. Unpickling user inputs is executing arbitrary code.
  - pekk 13y ago
    Not accurate, Python has multiple serialization libraries and there is nothing special about pickle. Python's internal serialization is 'marshal' and shouldn't be used by apps for other reasons
    - dalke 13y ago
      anonymoushn said "object serialization". "marshal" doesn't serialize objects. >>> import marshal, cPickle >>> x = object() >>> marshal.dumps(x) Traceback (most recent call last): File "<stdin>", line 1, in <module> ValueError: unmarshallable object >>> cPickle.dumps(x) 'ccopy_reg\n_reconstructor\np1\n(c__builtin__\nobject\np2\ng2\nNtRp3\n.' That's a bit tongue-in-cheek, but it shows that the marshal serialization only handles a handful (I count 9) of built-in object types. What's "special" about pickle is it's the default recommended serialization method. Quoting http://docs.python.org/2/library/marshal.html http://docs.python.org/2/library/marshal.html: > "If you’re serializing and de-serializing Python objects, use the pickle module instead – the performance is comparable, version independence is guaranteed, and pickle supports a substantially wider range of objects than marshal."
- nightpool 13y ago
  Probably the python memory serialization library, which is known to be really dangerous if you use on untrusted input. http://docs.python.org/2/library/pickle.html http://docs.python.org/2/library/pickle.html
- emillon 13y ago
  pickle is a (de-)serialization library for Python. It allows arbitrary code evaluation, so shouldn't be exposed to the outside world (for the same reason that we have JSON parsers and don't use JS eval() to parse JSON).
- Noughmad 13y ago
  Considering the poster mentions serialization, I would say it's about this: http://docs.python.org/3/library/pickle.html http://docs.python.org/3/library/pickle.html
- deleted 13y ago
  [deleted]
- i_c_b 13y ago
  When I was working at a game dev studio on a game that partially took place in a city, we had an artist, looking for photo reference, type in "man hole" in the google image search. The resulting photo reference, in addition to being rather NSFW, was not useful for the particularly game we were making.
Sharlin 13y ago
How do you mean? strcpy and friends aren't buggy - they work according to the spec, and you can't just go and change an API that literally billions of lines of code depend on. You can only provide new, better alternatives. If you mean the buggy software that uses the unsafe C APIs (and is not careful enough), then, that's exactly what those posters are about.
- nullc 13y ago
  I'm pretty sure those posters are making fun of the thinking that says you can just use some replacements and magically be safe. The 'safe' versions of the functions have their own risks too. No amount of use-this-thing is a replacement for conscientious programming and review.

Many of the man pages for the function say "don't use them." OpenBSD let you link against "strcpy" but screams at you if you do. Also, what's pickle? PS: don't type "man pickle" into the google, you won't like it.

PhantomGremlin 13y ago
Googling for "python pickle" will provide more benign search results.
Piskvorrr 13y ago
https://wiki.python.org/moin/UsingPickle https://wiki.python.org/moin/UsingPickle
anonymoushn 13y ago
Pickle is Python's native object serialization. Unpickling user inputs is executing arbitrary code.
- pekk 13y ago
  Not accurate, Python has multiple serialization libraries and there is nothing special about pickle. Python's internal serialization is 'marshal' and shouldn't be used by apps for other reasons
  - dalke 13y ago
    anonymoushn said "object serialization". "marshal" doesn't serialize objects. >>> import marshal, cPickle >>> x = object() >>> marshal.dumps(x) Traceback (most recent call last): File "<stdin>", line 1, in <module> ValueError: unmarshallable object >>> cPickle.dumps(x) 'ccopy_reg\n_reconstructor\np1\n(c__builtin__\nobject\np2\ng2\nNtRp3\n.' That's a bit tongue-in-cheek, but it shows that the marshal serialization only handles a handful (I count 9) of built-in object types. What's "special" about pickle is it's the default recommended serialization method. Quoting http://docs.python.org/2/library/marshal.html http://docs.python.org/2/library/marshal.html: > "If you’re serializing and de-serializing Python objects, use the pickle module instead – the performance is comparable, version independence is guaranteed, and pickle supports a substantially wider range of objects than marshal."
nightpool 13y ago
Probably the python memory serialization library, which is known to be really dangerous if you use on untrusted input. http://docs.python.org/2/library/pickle.html http://docs.python.org/2/library/pickle.html
emillon 13y ago
pickle is a (de-)serialization library for Python. It allows arbitrary code evaluation, so shouldn't be exposed to the outside world (for the same reason that we have JSON parsers and don't use JS eval() to parse JSON).
Noughmad 13y ago
Considering the poster mentions serialization, I would say it's about this: http://docs.python.org/3/library/pickle.html http://docs.python.org/3/library/pickle.html
deleted 13y ago
[deleted]
i_c_b 13y ago
When I was working at a game dev studio on a game that partially took place in a city, we had an artist, looking for photo reference, type in "man hole" in the google image search. The resulting photo reference, in addition to being rather NSFW, was not useful for the particularly game we were making.

Sharlin 13y ago

How do you mean? strcpy and friends aren't buggy - they work according to the spec, and you can't just go and change an API that literally billions of lines of code depend on. You can only provide new, better alternatives. If you mean the buggy software that uses the unsafe C APIs (and is not careful enough), then, that's exactly what those posters are about.

nullc 13y ago
I'm pretty sure those posters are making fun of the thinking that says you can just use some replacements and magically be safe. The 'safe' versions of the functions have their own risks too. No amount of use-this-thing is a replacement for conscientious programming and review.