tmpfile is insecure, use mkstemp which is a posix extension, maybe using python api is better