News for hackers. Stuff that matters.
Re:Why Python Pickle is Inscecure by cool-RR on Wednesday September 09, 2009 @12:35PM (#813441)
Makes me fear that data corruption in my pickles will crash the system. Maybe someone should implement an interface to 'pickle' that maintains a hash of the string.
Re:Why Python Pickle is Inscecure by yangyang on Wednesday September 09, 2009 @01:06PM (#813522)
Why are they any more likely to be corrupted than any other file (including your python sources or .pyc files (which use another serialisation scheme, marshal))?
Re:Why Python Pickle is Inscecure by pyre on Wednesday September 09, 2009 @01:54PM (#813637)
I'm guessing because it's possible for the data to be corrupted in just the right way so as to construct some system-crashing (or critical-data corrupting) system() or eval() call. Though that's a pretty extreme paranoia.

As you state, the python files themselves could also be corrupted in such a manor and then run in the interpreter, or a compiled program could get corrupted in just the right way to execute 'rm -rf /' though it's not likely.