[Python-Dev] Possible bugs and security holes in getpass.py

[Guido van Rossum]

> 1,2,3,5 are possible security holes in addition to being possible bugs.
> 
> Although I don't completely understand all the details, it appears
> to me that getpass.c is more correct then getpass.py.

Sorry, but this just doesn't make sense.  There are so many
differences between C and Python that you can't just compare a C and a
Python version of a function and pointing at the differences as
possible security holes or bugs.  If you want to be helpful, I please
try to understand the details, and then see if there are *actual* bugs
or security holes instead of just "possible" ones.

Looking for security issues is serious business.  (It pays my
bills. :-)  But people shouldn't go around pointing out "possible"
security holes without understanding what they are talking about --
spreading fear doesn't help real security.  It is unlikely that a
beginning programmer can find a security hole in a piece of software
without dumb luck.

--Guido van Rossum (home page: http://www.python.org/~guido/)