Getting rid of pickle as serialization protocol - introducing serpent as new default serializer

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

I'm close to finalizing a rather big change in Pyro4: the support for multiple
serialization protocols.

Currently Pyro4 uses pickle and as you know, this has some security implications. When
I've finished the work in the multi_ser branch, Pyro4 will support various
serialization protocols. You can select the one to use by means of a configuration
item. I'm adding support for pickle (already there, duh), marshal, json, xmlrpc and my
own new serpent serializer (https://pypi.python.org/pypi/serpent).

My plan is to make serpent the default serializer, instead of pickle.
If you don't have serpent or don't want to install it, you'll have to set
PYRO_SERIALIZER to something else to make Pyro work.

Why not leave it at pickle? I'd like to ship Pyro "safe by default" and a big problem
when you wanted to use Pyro over the internet was that it relied on the unsafe pickle
protocol. I really want to change that. You'll always have the option to switch back
to pickle but it will require a conscious effort.

When using a different serializer than pickle, Pyro will be more restricted about what
kinds of objects it can transmit, and it will probably be slower. How much impact the
change has remains to be seen: I still have to do some tests once I get it all working.

I consider not to bump Pyro's wire protocol version. But the next version of Pyro will
not be able to talk to older versions unless you tell it to use pickle as serializer.
Strange errors are produced otherwise.


Cheers
Irmen de Jong

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (Cygwin)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQEcBAEBAgAGBQJRecCYAAoJEHC9o7RHFlf2Sm8IAMwxzzYPd5NcpajPn9/6Xfjc
7PIhAgwf/+GQg2SUObSWaVdHmn7WNPWZYFDtN85FLqtiRRhloWAyaRzo+0xI01xi
SR36/BhPGNaMBPK8brPWaFF9XVJq25kI3E7WRFOvBC/K3TnquSkj2ma8Iu2tyDvZ
d15gZM5XWjsGm1UZRw6v+7eia41M3lgDYswhjfVsXT7Qxzv+SZr0KUgrC4q9le7P
mgRXyCBPUR0cJicdU1oxfQ1rqoHz+1hT7ngYBjrObP5w53V4tzfda1LyRJt3oAkj
Dl5g7kesqVR1lI5axot4xOyihw6LcCnNoTRDXuaUZgZfutgF7M+Lmua4BJF/tAs=
=fJg6
-----END PGP SIGNATURE-----

------------------------------------------------------------------------------
Try New Relic Now & We'll Send You this Cool Shirt
New Relic is the only SaaS-based application performance monitoring service 
that delivers powerful full stack analytics. Optimize and monitor your
browser, app, & servers with just a few lines of code. Try New Relic
and get this awesome Nerd Life shirt! http://p.sf.net/sfu/newrelic_d2d_apr