[issue5262] PythonLauncher considered harmfull

[Ronald Oussoren]

Ronald Oussoren added the comment:

The attached patch removes the code that checks if "Python Launcher" is the 
default application for opening python files.

--
Added file: http://bugs.python.org/file31108/issue-5262.txt

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue5262] PythonLauncher considered harmfull

[Ezio Melotti]

Ezio Melotti added the comment:

FWIW more than once I tried to open a .py file on Windows just to see a black 
box flashing by and promptly disappear.  I agree that opening the file in an 
editor (e.g. IDLE) is a better option, but I realize some users might prefer to 
launch a script when they double-click on it (I always launch them by doing 
"python file.py").

--
nosy: +ezio.melotti

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue5262] PythonLauncher considered harmfull

[Ronald Oussoren]

Ronald Oussoren added the comment:

I thinking about closing this issue, but need to do some more research before 
doing so. In particular, I need to check the behavior of double clicking on 
python files on Windows and the main Linux desktops. IIRC double clicking a .py 
file on Windows will execute that file, it might be useful to stay consistent 
with that and not disallow making Python Launcher the default action.

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue5262] PythonLauncher considered harmfull

[Ronald Oussoren]

Changes by Ronald Oussoren :


--
priority: normal -> low
versions: +Python 3.4 -Python 3.2

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue5262] PythonLauncher considered harmfull

[Ronald Oussoren]

Changes by Ronald Oussoren :


Removed file: http://bugs.python.org/file18266/smime.p7s

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue5262] PythonLauncher considered harmfull

[Ronald Oussoren]

Changes by Ronald Oussoren :


--
nosy: +ned.deily

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue5262] PythonLauncher considered harmfull

[Ronald Oussoren]

Ronald Oussoren  added the comment:

> Would your other proposed change require users to set PythonLauncher as the 
> opening app for each Python file, or would there be a way to manually set it 
> as the default from Finder or elsewhere? 

I would no longer be possible to set PythonLauncher as the default action for 
Python files, because doing that is a clear security risk.

Ronald

--
Added file: http://bugs.python.org/file18266/smime.p7s

___
Python tracker 

___

smime.p7s
Description: S/MIME cryptographic signature
___
Python-bugs-list mailing list
Unsubscribe: 
http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue5262] PythonLauncher considered harmfull

[Kevin Walzer]

Kevin Walzer  added the comment:

Ronald, 

I'd vote for warning if it's the default action. 

Would your other proposed change require users to set PythonLauncher as the 
opening app for each Python file, or would there be a way to manually set it as 
the default from Finder or elsewhere? 

Kevin

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue5262] PythonLauncher considered harmfull

[Ronald Oussoren]

Ronald Oussoren  added the comment:

Kevin: what's your opinion on changing PythonLauncher to check if it is the 
default action for opening python files and warning about that? 

What about refusing to run when Python Launcher is the default action for 
python files?

Users would still be able to run python files from the Finder by using the 
"Open with" menu, or by selecting Python Launcher through the Get Info dialog.

This would seriously reduce the risks w.r.t. accidentally running python 
scripts.

(Removing 2.7 because it is too late to change 2.7 behavior)

--
versions:  -Python 2.7

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue5262] PythonLauncher considered harmfull

[Ronald Oussoren]

Ronald Oussoren  added the comment:

I propose to at least change the code in pythonlauncher to warn if it is the 
default association for python files, that is to reverse the test that it 
currently does.

That way users can still set pythonlauncher as the launcher for a specific 
files, but would get a warning when they make pythonlauncher the default action 
for python files.

BTW. I still think that pythonlauncher is unsafe and should be removed.

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue5262] PythonLauncher considered harmfull

[Ronald Oussoren]

Ronald Oussoren  added the comment:

At the very least PythonLauncher should not be the default for opening 
python files, and should actively warn against being the default 
(basicly reversing the current default).

When PythonLauncher is the default application for .py files double-
clicking a .py file, or opening it from Mail.app will run the script. 
This is not what I'd expect when opening a source file and is risky when 
this happens accidently.

There are several ways for running python scripts by double-clicking on 
them. Two examples:

* Use py2app to create an .app bundle

* Give the script a ".command" suffix and a '#!/usr/bin/python' prefix.

Both result in "files" where it is clear that opening them will result 
in code execution.

--
versions: +Python 3.2 -Python 3.1

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue5262] PythonLauncher considered harmfull

[Nir Soffer]

Nir Soffer  added the comment:

I also think it should be removed. Opening a file should run it only if it 
is executable.

--
nosy: +nirs

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue5262] PythonLauncher considered harmfull

[Kevin Walzer]

Kevin Walzer  added the comment:

I disagree that this is a bad idea--it's helpful to be able to double-
click a GUI script and launch it automatically. I realize one can just 
fire up Terminal and go "python myscript.py," but I missed this 
functionality when it was broken and would be unhappy to see it removed.

--
nosy: +wordtech

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue5262] PythonLauncher considered harmfull

[Ronald Oussoren]

New submission from Ronald Oussoren :

The Mac port of Python contains a binary named "PythonLauncher" which 
can be used as the association of ".py" and ".pyw" files. This program 
will launch the script (either in a Terminal window or without a 
window).

In hindsight adding this tool was not a good idea: this makes it way to 
easy to accidently launch python script downloaded from the Internet. 
Removing PythonLauncher would still allow running the scripts through 
IDLE (which also has an association to ".py" and ".pyw" files in it 
Info.plist).

In my experience most ".py" files are modules instead of standalone 
scripts, opening the file in an editor would therefore be a better 
action in the majority of use-cases.

--
assignee: ronaldoussoren
components: Macintosh
messages: 82108
nosy: ronaldoussoren
severity: normal
status: open
title: PythonLauncher considered harmfull
versions: Python 2.7, Python 3.1

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com