Comment 1 for bug 817247

I've added a new USE_INSECURE_UNPICKLER option to carbon.conf, it defaults to False, so the default implementation now is basically the implementation from http://nadiana.com/python-pickle-insecure

I left the insecure version as an option because it is faster. Also note that not using the insecure unpickler does not imply that the unpickler you get is secure! There are various vulnerabilities in the pickle protocol beyond just calling os.system.

If you install 0.9.9 and see a performance regression you might consider explicitly setting USE_INSECURE_UNPICKLER = True.