Re: sending code objects around between different interpreters.

anthony baxter (anthony.baxter@aaii.oz.au)
Mon, 26 Sep 1994 18:59:41 +1000

Guido.van.Rossum@cwi.nl wrote:
> executed code from stomping on the code that calls it -- probably the
> import statement must also be restricted; or perhaps the entire thing
> could be executed in a child process... But if forking is OK, a
> simpler solution may exist: fork a child and setuid to nobody or some
> such...

Would doing something like trying to set 'import' to point to a different
function (presumably one that says 'oi! nick off' or similar) work?

Hmm, maybe not, a quick look reveals that import is not like an ordinary
command, presumably its some sort of builtin... darn. Dunno bout this, have
to think more about whether it's needed, assuming I can trust where the
stuff is from. My main concern is with people feeding bad things to one of
my servers without me noticing it, rather than crash-proofing it.

> There's a whole RSA implementation (based on GMU MP) in Demo/rsa --
> I'm sure you can use this to build an authentication system in about
> half an hour...

Aha. This is what I need. (D'oh! I forgot to fossick around in Demo/)

> If you can live with a string checksum, the md5 module (standard on
> most systems!) is all you need...

Nah, I'd prefer to have it a bit stronger than that...

Anthony.