On Wed, Nov 8, 2017 at 8:39 AM, אלעזר <elaz...@gmail.com> wrote: > > > בתאריך יום ג׳, 7 בנוב׳ 2017, 22:59, מאת Chris Angelico <ros...@gmail.com>: >> >> >> -1 on hiding eval/exec; these features exist in many languages, and >> they're identically dangerous everywhere. Basically, use eval only >> with text from the owner of the system, not from anyone untrusted. > > > I am sorry. I don't understand the reasons you are giving here. One sentence > is a fact, and I agree with the other, so I must be missing something.
If someone is using eval/exec with untrusted code, no amount of hiding-behind-imports is going to change that. A quick glance at the Stack Overflow search you linked to (just the search results themselves - I didn't dive deeper) shows only a few that would be affected by this change, and most of them are from people who seem to at least broadly understand what's going on. So the benefit isn't going to be huge, and a backward compatibility break is extremely annoying (even obscure functions like reduce incurred some backlash when they were "hidden" behind an import). Hence I'm -1 on changing this. Had Python always had eval off in some module, I wouldn't push for its promotion to builtin, but IMO the cost of moving it is greater than any benefit of protection. The dangers of eval/exec should be well known. ChrisA _______________________________________________ Python-ideas mailing list Python-ideas@python.org https://mail.python.org/mailman/listinfo/python-ideas Code of Conduct: http://python.org/psf/codeofconduct/
