Re:One million lines of code ought to be enough for anybody
by sitkack on Wednesday December 18, 2019 @12:00PM
(#21826847)
It is not. Python already doesn't have a spec, it has the CPython interpreter. This is repainting the facade while you still have a sump pump that isn't working.
There are a myriad of better ways to improve Python and this isn't it.
Re:One million lines of code ought to be enough for anybody
by matheusmoreira on Saturday December 21, 2019 @06:12AM
(#21850769)
> Correctness when you have arbitrarily long input gets complicated very easily.
Indeed. Accepting arbitrary inputs frequently requires an arbitrary amount of resources. Even if there are no vulnerabilities to exploit, a denial of service attack may still be possible because processing untrusted input can result in massive memory allocations.
A concrete example I've recently dealt with:
https://github.com/multiformats/unsigned-varint/blob/master/...
These variable length integers may consume an unbounded amount of memory when decoded. I think it's wise to constrain this by default and let the caller increase or turn off the limits if they want:
decode(buffer) # max=9, per spec
decode(buffer, max=64)
decode(buffer, max=math.inf)
Correctness when you have arbitrarily long input gets complicated very easily. I was originally skeptical when reading, it seemed ridiculous and arbitrary, until I realized that’s what they were going for.