111–120 of 160 posts
One of these days it would be nice to make an unofficial Python reference book which documents these tools, hidden features (like re.Scanner!), and other corners of the stdlib or language.
Earlier quoted context omitted.
Most people who read this blog already have python installed
The bafflement increases. The topic of this thread is the safety and security of running Python on (or merely next to) arbitrary content. Even ignoring that: is "most people" greater than, less than, or the same amount as "all"?
So does the pendantry.
> Pretty-print JSON: > echo '{"foo": "bar", "baz": [1, 2, 3]}' | python -m json.tool This is even more fun on MacOS if you combine it with the pbpaste/pbcopy utils: alias json_pretty="pbpaste | python -m json.tool | pbcopy" That command will pretty-print any JSON in your clipboard, and write it back to the clipboard, so you can paste it somewhere else formatted!
Why would you rely on any of these? They can be deprecated at a whim like distutils and many other things. That's why Python requires so many blog posts.
Earlier quoted context omitted.
You're reading a ridiculous mischaracterization of reality (~20 deprecated modules [1] out of the ~300 PSL modules [2] is "most"?). Of course you find it odd. [1] https://peps.python.org/pep-0594/ [2] https://docs.python.org/3/library/
It's the trend that is a bit worrying. It's definitely been floated more than once that the stdlib should be fundamentally gutted. It has not become a reality yet, but there are some loud voices advocating to just chuck most modules as a principle into pypi.
(1) Not letting little used modules that pose maintenance problems drive up the cost of maintaining Python, and
(2) Not forcing actively used, actively developed modules to be limited to the core language upgrade cadence (and not forcing users to upgrade the language to get upgrades to the modules.)
Ruby I think has a decent approach to this (particularly, one that deals with #2 better than just evicting things entirely from the standard distribution) with “Gemification” of the standard library, where most things that are moved out of the standard library aren’t moved out of the standard distribution, but into a set of gems distributed with the standard distribution but which can be upgraded independently.
Earlier quoted context omitted.
Doing that requires palcement of files right in the directory where the user is likely to run that module. Seems to be a quite rare vector for exploitation. Sure, on a multiuser system I might trick some other user into running such a command in /tmp and prepare that directory accordingly, but other vectors seem more esoteric.
There are thousands of tools (shellscripts, makefiles ...) which execute "python -m": https://www.gnod.com/search/?engines=af&nw=1&q=python%20-m Even in Google's own repos. Starting any of those (no matter where they are stored) in a hostile repo would let the code in the repo take over the machine.
Speaking of hidden Python tools, I'm a big fan of re.Scanner[0]. It's a regex-based tokenizer[1] in the `re` module, that for reasons is completely missing from any official documentation. You give it a pattern for each token type, and a function to be called on each match, and you get back a list of processed tokens. Importantly, it processes the list in one pass and ensures the matches are contiguous, where a naive…
This is one of the best ChatGPT use cases: creating regex complex patterns
Earlier quoted context omitted.
I know, but I expected that to be restricted only to older modules. I don't expect them to annotate all existing modules. I don't see why they would introduce _new_ code without annotating it, when that's clearly the trend for 3rd party libraries. From a quick look, it doesn't seem like it would be difficult to type either.
Maybe submit a patch?
I am not someone who complains about "stop piping cats" but using '-e' with grep is a lot quicker and easier to read. This: grep -v 'test/' | grep -v 'tests/' | grep -v idlelib | grep -v turtledemo Becomes: grep -ve 'test/' -e 'tests/' -e idlelib -e turtledemo
not this? grep -ve 'test/|tests/|idlelib|turtledemo'
Nice! I use this on winboxes: zipfile Decompress a zip file: python -m zipfile -e archive.zip /path/to/extract/to Compress a directory into a zip file: python -m zipfile -c new_archive.zip /path/to/directory