cpython

ady on main and another 3 optimization PRs are always there behind the corner, but it needs to be possible for SC to say “we decided it’s not actually worth all this complexity for <some small number>% speed improvement” (I’m not commenting whether in this particular case it’d have been a right call), and the PEP (if not withdrawn) was the way to exercise that control. [1] https://github.com/python/cpython/pull/113465#issuecomment-1...

This list only blocks keys while * that update is still propagating to the OS, container images, or root CAs * bundled in Python packages. The threshold for adding an entry is very high. There's also an amusing workaround for security scanners that might trip on the tests included in the source release. From the code comment: > The distrusted test material… lives in a password-protected zip so it doesn't trip security scanners that cannot tell internal test fixtures from production secrets and flag any certificate or private key they find. It is encrypted, not merely zipped, because such scanners read inside plain archives. The password is fixed, public, and not a secret. What might that non-secret password be, you ask? Well, this is Python, so of course: DISTRUSTED_ZIP_CHOSEN_KNIGHT = 'Brave Sir Robin' [0]: https://discuss.python.org/t/_/109576/60 [1]: https://github.com/python/cpython/commit/7dd8b4736a1419750b94a388e6d158be15836fe6 [2]: https://github.com/python/cpython/issues/160040

e threshold for adding an entry is very high. * * See https://github.com/python/cpython/issues/160040 for the eMudhra discussion. As a Mint 22.x user, I wonder if and when Debian or Ubuntu will pick up the change and release another patch for the system Python (basically, to my understanding, a base of 3.12.3 with security patches from other patch releases backported). Since they've already updated ca-certificates it might not seem necessary, at least as long as the pip package gets updated (although I don't use that anyway). BTW, I think I saw your comments in other places about the 30-cent vibe-coded MITM demo proxy, unless someone else had the same idea. Thanks for helping educate. Edit: apparently (https://discuss.python.org/t/avoiding-compromised-certificat...), the relevant Debian and Ubuntu packages already patch the distro-provided pip to enforce using the system certificates. (Indeed, `ca-certificates` is listed as "Depends" for the pip package, rather than "Recommends".) But maybe they'll still be interested in the key blocking, on defense-in-depth principles.

er it's AI. (That said, I use AI all the time and find it to be a great tool. IMO is is a tool, not an autonomous intelligence with a will of its own.)

ricks like not initialising a buffer fully (let's say you have a library function with a return buffer. You don't want dynamic allocations for some reason. You can simulate this with a pointer return into a let's say a static 4KB buffer and a count return, you only initialise it until the count. Caller has the responsibility not to overread.)

for floating-point (values equal to an integer have to get converted and checked O(N) times, and other values can't be immediately rejected). That's been proposed and poorly received before too: https://discuss.python.org/t/_/18248 [2]. [0]: and I'd first thought of it long before that and didn't know where to propose it, plus it kept slipping my mind [1]: like https://zahlman.github.io/posts/a-brief-annotation/ [2]: see also my later post there, which went ignored

in B.2 or B.3 tables. + if (unicodedata_current.category(ch) != "Cn" + and ch.lower() != ch + and cp not in table_b2 + and cp not in table_b3): + b3_exceptions[cp] = ch # Identity.