_carljm

There are now benchmark comparisons with stock CPython in a PERF file in the repo.

Thank you, that’s very kind of you both. To be clear, this is the work of a team, and many others have contributed a lot more than I have to it.

Definitely influenced. There are people on our team who also worked on hhvm.

Haven't tried Pyston, its revival as an active project happened well after Cinder was in production.

We've already upstreamed a lot of changes, including one that makes all coroutines faster in Python 3.10. The big-ticket items in Cinder would be big changes for CPython and need discussion about whether CPython even wants them. You don't just slap a C++ JIT into a bugs.python.org ticket. Opening Cinder is the first step in the conversation, and we're here for that work too. It's not just "if you want it, take it."

There'll be a talk on Cinder at (virtual) PyCon in a couple weeks, there are detailed benchmark numbers in the talk. We've talked about getting them into the repo too, might happen.

We tried PyPy without much success (and we really tried, six month project just to get it to run our codebase.) Our workload is very heavy on the CPython C API, which makes life difficult for PyPy or any other alternative Python implementation. PyPy is great for a lot of uses, just not a great fit for us.

In Python 3, that raises a TypeError.

The advisory and release notes are now fixed to not describe the XML vulnerabilities as DoS.

AFAIK the XML entity expansion attacks are DoS-only, but the other fixed vulnerability (external entities) may be usable in some cases to gain information about local files (again, presuming Django's XML model deserializer is exposed to untrusted input, which it is not by default and should not be). I'm working on updating the announcement and release notes to characterize that more accurately.

You're right, thanks for pointing this out. Although (as jacobian mentions) Django's exposure in general to these attacks was quite limited, we still shouldn't describe these XML vulnerabilities as DoS-only.

I'm working on updates to the release announcement and release notes for 1.3.6 and 1.4.4 to make this clearer.

The vulnerability we fixed is not just entity expansion, it's also accessing external entities. Although this is a DoS vector, I think it's true that it could be used to gain information about the presence or absence of files on the local filesystem, or even potentially information about their contents (given access to the results of XML parsing).

It's not just billion laughs, this fixes related but different entity-expansion attacks, as well as fetching of external resources (DTDs or entity definitions), which is a totally separate issue from billion laughs.