Slashdot is powered by your submissions, so send in your scoop

 



Forgot your password?
typodupeerror
×

Comment Re:Fox News? (Score 1) 460

Even when they present both sides, it is much more interesting and informative if they're not on at the same time arguing with each other. A local radio call in show has both formats, and when a full hour is given to one candidate, then the next day is the other candidate, you learn a lot. But them both on debating and arguing then you learn nothing.

At least NPR's Science Friday never had the "now for the opposing argument" format.

Comment Re:I had clients that did this in the 90s. (Score 1) 208

Isn't the property tax most places based upon the value of the home? So adding a pool will increase the value of the home. Normally though there's a tax assessor that goes around and should be looking at every lot and assign a new assessed value, though in practice I think they just google if the prices in the neighborhood have gone up or down.

A lot of government in the US works by assuming most people are generally lawful, and they're not going to just start adding rooms onto the house without filing the paperwork first. For taxes they do some random audits on a small subset. This generally works, those breaking the rules aren't too many and don't get away with it for too long (often neighbors turn them in, they get very nosy when construction starts). But this all breaks down if you have wholesale cheating going on, such as Greeks with taxes awhile back, and perhaps these Argentinean neighborhoods.

Comment Re:"could be worse than Heartbleed" (Score 2) 318

It looks like a side effect of how it passes exported functions to sub shells. The only communication mechanism for talking to the subshell is the environment. So these are implemented by putting the function in an environment variable, then the subshell on startup looks at every variable to see if it looks like a function, and if so tries to turn them into a function. The snag then is that it does this by actually executing what's in the variable instead of fully parsing it first.

Comment Re:"could be worse than Heartbleed" (Score 1) 318

Ya you're right for the most part. I was confused by the : const char *argp[] = {"sh", "-c", NULL, NULL};
Except that the first arg there is just the name being used, not the actual file to be executed, which was my mistake.

However I do recall some unixlike-but-not-unix systems that used other methods to find the shell because is wasn't always in a fixed location.

Comment Re:Still problem with user input. (Score 1) 318

I don't think the early people did think it out, however even if they had some security expert thinking of all the ways it could go wrong I'm not sure it would stick out as a hole. After all nothing as far as they knew executed the contents of arbitrary environment variables especially not ones with names that they controlled. Even if they were really paranoid and decided not to use system(), or didn't use it for performance reasons, there were still perl scripts underneath that went and called system() behind the scenes...

I bet if you took a time machine to last week that many web security experts if asked if passing data in an environment variable is safe or not would think it was insecure, assuming the program that parsed the data took care.

Slashdot Top Deals

Ya'll hear about the geometer who went to the beach to catch some rays and became a tangent ?

Working...