Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
There are some ubiquitous patterns that are elegant and simple. There are others that are not.
from time import time, sleep
max_sleep_time_sec = 1.5
start_time = time()
timeout_sec = 42.0
while time() - start_time < timeout_sec:
# Do or check some stuff
time_remaining = timeout_sec - (time() - start_time)
if time_remaining > max_slep_time_sec:
sleep(min(time_remaining, max_sleep_time_sec))
else:
sleep(max_sleep_time_sec)
What is the purpose of this loop? Oh, I see, it's a timeout. Is the order of
operations correct in my loop condition? Have I correctly calculated
time_remaining
? Is my if
clause correct? Hint: It's not. Does this code
behave properly if the system clock is updated after I set start_time
? Hint:
It doesn't. How many times is this code duplicated within my application?
We can do better. EggTimer can help.
from time import sleep
from eggtimer import EggTimer
max_sleep_time_sec = 1.5
timer = EggTimer()
timer.set(42.0)
while not timer.is_expired():
# Do or check some stuff
sleep(min(timer.time_remaining_sec, max_sleep_time_sec))
Ah, that's better! Clear, concise, reusable, and expressive. The risk of defects is significantly lower, too!
Install with pip install -U egg-timer
EggTimer
- A class for checking whether or not a certain amount of time has
elapsed.
ThreadSafeEggTimer
- A thread-safe implementation of EggTimer
.
See EggTimer Example for an example of how to use
EggTime
. ThreadSafeEggTimer
shares the same interface.
Python 3.10.4 (main, Jun 29 2022, 12:14:53) [GCC 11.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> from eggtimer import EggTimer
>>> help(EggTimer)
Help on class EggTimer in module eggtimer.eggtimer:
class EggTimer(builtins.object)
| A class for checking whether or not a certain amount of time has elapsed.
|
| Methods defined here:
|
| __init__(self)
| Initialize self. See help(type(self)) for accurate signature.
|
| is_expired(self)
| Check whether or not the timer has expired
|
| :return: True if the elapsed time since set(TIMEOUT_SEC) was called is greater than
| TIMEOUT_SEC, False otherwise
|
| reset(self)
| Reset the timer without changing the timeout
|
| set(self, timeout_sec: float)
| Set a timer
|
| :param timeout_sec: A non-negative floating point number expressing the number of
| seconds to set the timeout for.
|
| ----------------------------------------------------------------------
| Readonly properties defined here:
|
| time_remaining_sec
| Return the amount of time remaining until the timer expires.
|
| :return: The number of seconds until the timer expires. If the timer is expired, this
| function returns 0 (it will never return a negative number).
|
| ----------------------------------------------------------------------
| Data descriptors defined here:
|
| __dict__
| dictionary for instance variables (if defined)
|
| __weakref__
| list of weak references to the object (if defined)
>>>
Running the tests is as simple as poetry install && poetry run pytest
EggTimer is open-source software licensed under the GNU General Public License v3.0.
FAQs
A simpler way to handle timeouts in Python
We found that egg-timer demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.