3 ms·

Many of the man pages for the function say "don't use them." OpenBSD let you link against "strcpy" but screams at you if you do. Also, what's pickle? PS: don'

Many of the man pages for the function say "don't use them." OpenBSD let you link against "strcpy" but screams at you if you do. Also, what's pickle? PS: don't type "man pickle" into the google, you won't like it.

PhantomGremlin 13y ago
Googling for "python pickle" will provide more benign search results.
Piskvorrr 13y ago
https://wiki.python.org/moin/UsingPickle https://wiki.python.org/moin/UsingPickle
anonymoushn 13y ago
Pickle is Python's native object serialization. Unpickling user inputs is executing arbitrary code.
- pekk 13y ago
  Not accurate, Python has multiple serialization libraries and there is nothing special about pickle. Python's internal serialization is 'marshal' and shouldn't be used by apps for other reasons
  - dalke 13y ago
    anonymoushn said "object serialization". "marshal" doesn't serialize objects. >>> import marshal, cPickle >>> x = object() >>> marshal.dumps(x) Traceback (most recent call last): File "<stdin>", line 1, in <module> ValueError: unmarshallable object >>> cPickle.dumps(x) 'ccopy_reg\n_reconstructor\np1\n(c__builtin__\nobject\np2\ng2\nNtRp3\n.' That's a bit tongue-in-cheek, but it shows that the marshal serialization only handles a handful (I count 9) of built-in object types. What's "special" about pickle is it's the default recommended serialization method. Quoting http://docs.python.org/2/library/marshal.html http://docs.python.org/2/library/marshal.html: > "If you’re serializing and de-serializing Python objects, use the pickle module instead – the performance is comparable, version independence is guaranteed, and pickle supports a substantially wider range of objects than marshal."
nightpool 13y ago
Probably the python memory serialization library, which is known to be really dangerous if you use on untrusted input. http://docs.python.org/2/library/pickle.html http://docs.python.org/2/library/pickle.html
emillon 13y ago
pickle is a (de-)serialization library for Python. It allows arbitrary code evaluation, so shouldn't be exposed to the outside world (for the same reason that we have JSON parsers and don't use JS eval() to parse JSON).
Noughmad 13y ago
Considering the poster mentions serialization, I would say it's about this: http://docs.python.org/3/library/pickle.html http://docs.python.org/3/library/pickle.html
deleted 13y ago
[deleted]
i_c_b 13y ago
When I was working at a game dev studio on a game that partially took place in a city, we had an artist, looking for photo reference, type in "man hole" in the google image search. The resulting photo reference, in addition to being rather NSFW, was not useful for the particularly game we were making.

PhantomGremlin 13y ago

Googling for "python pickle" will provide more benign search results.

Piskvorrr 13y ago

https://wiki.python.org/moin/UsingPickle https://wiki.python.org/moin/UsingPickle

anonymoushn 13y ago

Pickle is Python's native object serialization. Unpickling user inputs is executing arbitrary code.

pekk 13y ago
Not accurate, Python has multiple serialization libraries and there is nothing special about pickle. Python's internal serialization is 'marshal' and shouldn't be used by apps for other reasons
- dalke 13y ago
  anonymoushn said "object serialization". "marshal" doesn't serialize objects. >>> import marshal, cPickle >>> x = object() >>> marshal.dumps(x) Traceback (most recent call last): File "<stdin>", line 1, in <module> ValueError: unmarshallable object >>> cPickle.dumps(x) 'ccopy_reg\n_reconstructor\np1\n(c__builtin__\nobject\np2\ng2\nNtRp3\n.' That's a bit tongue-in-cheek, but it shows that the marshal serialization only handles a handful (I count 9) of built-in object types. What's "special" about pickle is it's the default recommended serialization method. Quoting http://docs.python.org/2/library/marshal.html http://docs.python.org/2/library/marshal.html: > "If you’re serializing and de-serializing Python objects, use the pickle module instead – the performance is comparable, version independence is guaranteed, and pickle supports a substantially wider range of objects than marshal."

nightpool 13y ago

Probably the python memory serialization library, which is known to be really dangerous if you use on untrusted input. http://docs.python.org/2/library/pickle.html http://docs.python.org/2/library/pickle.html

emillon 13y ago

pickle is a (de-)serialization library for Python. It allows arbitrary code evaluation, so shouldn't be exposed to the outside world (for the same reason that we have JSON parsers and don't use JS eval() to parse JSON).

Noughmad 13y ago

Considering the poster mentions serialization, I would say it's about this: http://docs.python.org/3/library/pickle.html http://docs.python.org/3/library/pickle.html

deleted 13y ago

[deleted]

i_c_b 13y ago

When I was working at a game dev studio on a game that partially took place in a city, we had an artist, looking for photo reference, type in "man hole" in the google image search. The resulting photo reference, in addition to being rather NSFW, was not useful for the particularly game we were making.