Hacker News Reader

From the linked bug..

> It takes about 50ms to parse an int string with 100,000 digits and about 5sec for 1,000,000 digits. The float type, decimal type, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected.

Sure seems strange to set the limit to 4300. 50ms is not a DoS.

View on HN

balooning 2ms request to 50ms is absolutely a DoS

that's only 20req/sec to fill a core of execution

Just rate-limit anyone who does 20req/sec.

This is easy for huge corporations who live and breathe automated-DDoS protection without blinking an eye, but a major challenge for all of the little applications and small hosts.

It might be a DoS for a webserver that's supposed to be IO-bound.

Turning on that behavior for all python code in a patch release with only a global override is sloppy.

Reply on news.ycombinator.com