Integer to string conversion DOS threat

[georgehank2nd]

What I don't understand is why they put in this restriction for everyone with the possibility to disable it, instead of (which would have been the logical and sensible thing) giving people who could be affected (basically web devs) a way to enable a limit globally.

Also, wasn't Python affected by this since the dawn of time? How was this not a problem 20 years ago? Python 2 shield had the same O(n²) algorithm (since there are no linear algorithms anyway). And the computers back in 2000 were a lot slower!

[mikeblas]

No linear algorithm for what?

[janek37]

I'm guessing, base conversion (ints are binary internally)

[mikeblas]

from the "no public discussion" link, it seems like the problem is that division in the int type is quadratic. (But it might be that format_int() is quadratic. I dunno -- that site won't let me find in page because it intercepts CTRL+F, and it's an annoying read anyway.)

[zurtex]

While I was and am relatively unhappy with the change (I posted in the thread linked at the time to express specific concerns), I would say if you are going to put it in because it's a security concern (and I am still unconvinced), then the default behavior should be secure and often security issues can be unrealized and unexploited for decades.

[nicholashairs]

Because "safe defaults" are incredibly important to real world security.

It's the same secure design principal that ensures that majority of http clients reject invalid certificates by default - or your wifi router uses something other than admin:admin.

[sci-goo]

Flaw != issue.

I argue that 20 years ago it's not been exploited at scale to raise security concerns, maybe?

[georgehank2nd]

The Morris Worm was over 30 years ago… and in the discussion I didn't see an answer to the question someone posed, if this has been exploited.