Re: "Rehabilitating Pickle" a talk at PyCon UK 2018
Sean Upton <[email protected]> Thu, 24 Jan 2019 12:31:25 -0700
| Newsgroups | gmane.comp.web.zope.zodb |
|---|---|
| Message-ID | <[email protected]> |
--Apple-Mail=_5674757B-B959-496E-A3D9-A46E1CC739A8 Content-Type: text/plain; charset="UTF-8" > On Jan 24, 2019, at 11:09 AM, 'Juergen Herrmann' via zodb <[email protected]> wrote: > > I use the ZODB as file format for a application that is used by end users. So telling them "don't open files from untrusted sources" seems a bit weird :) Your ZEO isn't open to the public on a TCP port, only your application on machines you control, no? That makes the "injection" security question an application concern, not a ZODB or pickle problem? If you open your ZEO (or RelStorage) to Python applications running on machines you don't control, you are doing something ZODB was not designed to directly address. Sean -- You received this message because you are subscribed to the Google Groups "zodb" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout. --Apple-Mail=_5674757B-B959-496E-A3D9-A46E1CC739A8 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset="UTF-8" <html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; charset= =3Dus-ascii"></head><body style=3D"word-wrap: break-word; -webkit-nbsp-mode= : space; line-break: after-white-space;" class=3D""><br class=3D""><div><bl= ockquote type=3D"cite" class=3D""><div class=3D"">On Jan 24, 2019, at 11:09= AM, 'Juergen Herrmann' via zodb <<a href=3D"mailto:[email protected]= m" class=3D"">[email protected]</a>> wrote:</div><br class=3D"Apple-= interchange-newline"><div class=3D""><span style=3D"caret-color: rgb(0, 0, = 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-varia= nt-caps: normal; font-weight: normal; letter-spacing: normal; text-align: s= tart; text-indent: 0px; text-transform: none; white-space: normal; word-spa= cing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: no= ne; display: inline !important;" class=3D"">I use the ZODB as file format f= or a application that is used by end users. So telling them "don't open fil= es from untrusted sources" seems a bit weird :)</span><br class=3D"Apple-in= terchange-newline"></div></blockquote></div><br class=3D""><div class=3D"">= Your ZEO isn't open to the public on a TCP port, only your application on m= achines you control, no? That makes the "injection" security question= an application concern, not a ZODB or pickle problem?</div><div class=3D""= ><br class=3D""></div><div class=3D"">If you open your ZEO (or RelStorage) = to Python applications running on machines you don't control, you are doing= something ZODB was not designed to directly address.</div><div class=3D"">= <br class=3D""></div><div class=3D"">Sean</div></body></html> <p></p> -- <br /> You received this message because you are subscribed to the Google Groups &= quot;zodb" group.<br /> To unsubscribe from this group and stop receiving emails from it, send an e= mail to <a href=3D"mailto:[email protected]">zodb+unsubscri= [email protected]</a>.<br /> For more options, visit <a href=3D"https://groups.google.com/d/optout">http= s://groups.google.com/d/optout</a>.<br /> --Apple-Mail=_5674757B-B959-496E-A3D9-A46E1CC739A8--