News for hackers. Stuff that matters.

A comment on Why Python Pickle is Inscecure. Parent comment

Re:Why Python Pickle is Inscecure by viraptor on Wednesday September 09, 2009 @12:38PM (#813451)
> not quite as blatantly insecure as pickle (it won't do any string interpolation on load)

Are you saying that pickle works via string interpolation (or that this problem is possible because of interpolation)? That's incorrect...

[ Parent | on HN ]
Re:Why Python Pickle is Inscecure by tptacek on Wednesday September 09, 2009 @12:51PM (#813490)
No; Marshal and pickle are very different (and I confused things by talking in Ruby terms and referring to Python). Ruby Marshal isn't a virtual machine. Pickle is more like Flash or Postscript than RTF, which is what Marshal is like.
[ Parent | on HN ]