Re: Pyro 4.20 serpent serializer issues

On 13-6-2013 19:13, Vernon D. Cole wrote:
> List Readers:
> 
> You can switch serializers by setting the environment variable
> Linux:
> export PYRO_SERIALIZER=pickle
> Windows:
> set PYRO_SERIALIZER=pickle
> 
> Irmen:
> 
> The documentation page at http://pythonhosted.org/Pyro4/api/config.html refers back to
> itself.  I think that you intended for it to refer to:
> http://pythonhosted.org/Pyro4/config.html#overview-of-config-items
> which is where I (finally) found the answer I needed.

Thanks for reporting the link mistake. I'll fix it.


> May I suggest putting information on _how_ to change serializers earlier in the
> documentation?  It took me an age to find out how to switch back to pickle. 

I am sorry if this caused any confusion.
I usually list all relevant changes in the Change Log, like this:
"config item SERIALIZER added to select desired serializer, default is ‘serpent’"
but I can see how this major change can get overlooked. I'll try to improve the docs.

I suppose I should have added it to
http://pythonhosted.org/Pyro4/clientcode.html#serialization
as well.


> (My code
> already has a work-around for a pickle idiosyncrasy, and I suspect that I will have to
> vastly expand that to handle decimal and datetime instances (if I even can) to support
> serpent.  I am doing SQL database I/O, and do not know in advance what type of data my
> user might throw at me.

Then serpent/json/marshal is probably not the serializer you want to provide by default.
Can't you stick with pickle? If you are accepting any type of data a user throws at you,
you probably don't find yourself in a situation where pickle's security problem is an
actual issue?

Regards,
Irmen de Jong


------------------------------------------------------------------------------
This SF.net email is sponsored by Windows:

Build for Windows Store.

http://p.sf.net/sfu/windows-dev2dev