I think there's a serious problem with having a '.' at the head of the
default sys.path, and that it would be better to leave it to the user
to add it, via $PYTHONPATH, instead of including it by default.
There are two reasons:
- the current sys.path logistics are only conducive, at the user
level, to adding elements, not to inhibiting default ones.
- there are some situations where it is truly risky (due to prospects
of trojan horses) to have it on the path. what if i run a python
script as root? (1)
While many people might want '.' on their load path, some users will
*need* to not have it there, and may not even realize it is 'til too
late. Though somewhat less convenient for many, i think it needs to
be the prerogative of the user to elect for it, via $PYTHONPATH,
instead being a (difficult to override) default behavior.
Perhaps there's another option. I'm game, i just think some
refinement of this needs to be made.
In case this does make sense, here's the patch that i believe would
implement the policy change. There may be document changes or build
or operational things that depend on the '.', but i haven't noticed
any problems running this way.
Ken
ken.manheimer@nist.gov, 301 975-3539
(1 the old crack-the-super-secure-system-challenge-story has a
competitor asking the monitors about a missing file in the
competitors home directory, or something. The competitor neglects
to mentioning that they have a special script named 'ls' in their
home dir. the monitors inadvertantly use the doctored 'ls' when
they look to examine the supposed problem, and the script sets up a
back door for the competitor. taa dah.
while the scenario would have to be different with python, there is
a real risk here.)
*** 1.1 1994/06/14 20:26:24
--- Modules/Setup.in 1994/06/14 20:27:29
***************
*** 56,62 ****
# Enable this if stdwin installed
#STDWINPATH=:$(DESTLIB)/stdwin
! PYTHONPATH=.:$(DESTLIB)$(TESTPATH)$(ARCHPATH)$(STDWINPATH)
# Modules that should always be present (non UNIX dependent)
--- 56,62 ----
# Enable this if stdwin installed
#STDWINPATH=:$(DESTLIB)/stdwin
! PYTHONPATH=$(DESTLIB)$(TESTPATH)$(ARCHPATH)$(STDWINPATH)
# Modules that should always be present (non UNIX dependent)