title: What difference between subprocess.call() and subprocess.Popen() makes PIPE less secure for the former?
body: <p>I've had a look at the documentation for both of them. </p>
  
  <p>This question is prompted by J.F.'s comment here: <a href="https://stackoverflow.com/questions/1996518/retrieving-the-output-of-subprocess-call#comment31660313_1996540">Retrieving the output of subprocess.call()</a></p>
  
  <p>The current Python documentation for <a href="https://docs.python.org/library/subprocess.html#module-subprocess" rel="nofollow noreferrer"><code>subprocess.call()</code></a> says the following about using <code>PIPE</code> for <code>subprocess.call()</code>: </p>
  
  <blockquote>
    <p>Note Do not use <code>stdout=PIPE</code> or <code>stderr=PIPE</code> with this function. The child process will block if it generates enough output to a pipe to fill up the OS pipe buffer as the pipes are not being read from.</p>
  </blockquote>
  
  <p>Python 2.7 <a href="https://docs.python.org/2.7/library/subprocess.html#subprocess.call" rel="nofollow noreferrer"><code>subprocess.call()</code></a>: </p>
  
  <blockquote>
    <p>Note Do not use <code>stdout=PIPE</code> or <code>stderr=PIPE</code> with this function as that can deadlock based on the child process output volume. Use Popen with the communicate() method when you need pipes.</p>
  </blockquote>
  
  <p>Python 2.6 includes no such warnings. </p>
  
  <p>Also, the <a href="https://docs.python.org/2.6/library/subprocess.html#convenience-functions" rel="nofollow noreferrer"><code>subprocess.call()</code> and <code>subprocess.check_call()</code></a> don't seem to have a way to access their output, except for using stdout=PIPE with communicate(): </p>
  
  <p><a href="https://docs.python.org/2.6/library/subprocess.html#convenience-functions" rel="nofollow noreferrer">https://docs.python.org/2.6/library/subprocess.html#convenience-functions</a></p>
  
  <blockquote>
    <p>Note that if you want to send data to the process’s <code>stdin</code>, you need to create the <code>Popen</code> object with <code>stdin=PIPE</code>. Similarly, to get anything other than None in the result tuple, you need to give <code>stdout=PIPE</code> and/or <code>stderr=PIPE</code> too.</p>
  </blockquote>
  
  <p><a href="https://docs.python.org/2.6/library/subprocess.html#subprocess.Popen.communicate" rel="nofollow noreferrer">https://docs.python.org/2.6/library/subprocess.html#subprocess.Popen.communicate</a></p>
  
  <p>What difference between <code>subprocess.call()</code> and <code>subprocess.Popen()</code> makes <code>PIPE</code> less secure for <code>subprocess.call()</code>? </p>
  
  <p><strong>More Specific:</strong> Why does <code>subprocess.call()</code> <em>"deadlock based on the child process output volume."</em>, and not <code>Popen()</code>? </p>