Re: Pyro 4.20 serpent serializer issues

Mostly I want the Python version restriction to go away. Users should not
need to know which version of Python the server is running. But security is
an issue, too. The database password is in clear text, and who knows what
sensitive information might be in the data records. Changing serializers
will be worth the trouble as soon as I have time to implement the change.
On Jun 13, 2013 10:44 PM, "Irmen de Jong" <[email protected]> wrote:

> On 13-6-2013 19:13, Vernon D. Cole wrote:
> > List Readers:
> >
> > You can switch serializers by setting the environment variable
> > Linux:
> > export PYRO_SERIALIZER=pickle
> > Windows:
> > set PYRO_SERIALIZER=pickle
> >
> > Irmen:
> >
> > The documentation page at http://pythonhosted.org/Pyro4/api/config.htmlrefers back to
> > itself.  I think that you intended for it to refer to:
> > http://pythonhosted.org/Pyro4/config.html#overview-of-config-items
> > which is where I (finally) found the answer I needed.
>
> Thanks for reporting the link mistake. I'll fix it.
>
>
> > May I suggest putting information on _how_ to change serializers earlier
> in the
> > documentation?  It took me an age to find out how to switch back to
> pickle.
>
> I am sorry if this caused any confusion.
> I usually list all relevant changes in the Change Log, like this:
> "config item SERIALIZER added to select desired serializer, default is
> ‘serpent’"
> but I can see how this major change can get overlooked. I'll try to
> improve the docs.
>
> I suppose I should have added it to
> http://pythonhosted.org/Pyro4/clientcode.html#serialization
> as well.
>
>
> > (My code
> > already has a work-around for a pickle idiosyncrasy, and I suspect that
> I will have to
> > vastly expand that to handle decimal and datetime instances (if I even
> can) to support
> > serpent.  I am doing SQL database I/O, and do not know in advance what
> type of data my
> > user might throw at me.
>
> Then serpent/json/marshal is probably not the serializer you want to
> provide by default.
> Can't you stick with pickle? If you are accepting any type of data a user
> throws at you,
> you probably don't find yourself in a situation where pickle's security
> problem is an
> actual issue?
>
> Regards,
> Irmen de Jong
>
>
>
> ------------------------------------------------------------------------------
> This SF.net email is sponsored by Windows:
>
> Build for Windows Store.
>
> http://p.sf.net/sfu/windows-dev2dev
> _______________________________________________
> Pyro-core mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/pyro-core
>

------------------------------------------------------------------------------
This SF.net email is sponsored by Windows:

Build for Windows Store.

http://p.sf.net/sfu/windows-dev2dev

_______________________________________________
Pyro-core mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/pyro-core