Get rid of subprocess

[KOLANICH]

The mere presence of a module importing subprocess is a security issue because other backdoored modules can use it to evade static analysis

[ilanschnell]

Can you explain in more detail why this is a security issue? What do you mean by "other backdoored modules"? Thanks

[KOLANICH]

What do you mean by "other backdoored modules"? Thanks

When a module a uses a package subprocess directly, it is detected easily by static analysis. But when it imports perfect_hash, for static analysers it looks benign, they don't check interpackage control and data flows.

Can you explain in more detail why this is a security issue?

Not really a security issue within the package itself. It is more that python interpreter is flawed. I have an idea how to make it better, but any manual overrides of taints (absolutely necessary for practiaclly useful modules) will make all the proofs unsound.