del password and python string objects

[jeffmallozzi]

in html_roles_fetcher.py, line 132, and other places there is:

password = '###################################################'
del password

I believe that this is an attempt to overwrite the user's password in memory before deleting it from memory, a belt and suspenders approach. However I don't think this accomplishes what is intended.

In Python strings are immutable so in the first line:

password = '###################################################'

Python is creating a new string object in a new memory location and reassigning the name 'password' to that new object. Then

del password

is destroying that new string object. The old string object, containing the user's password, has now been left to the garbage collector to take care of. It has not been overwritten nor explicitly destroyed with 'del'.

[pdecat]

Indeed, submitted #190 to resolve this.