Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×

Comment Re:Heh (Score 5, Informative) 54

It looks like a feature where you could supply one placeholder in a prepared statement, but give it an array of values, and it would expand the placeholders to fit the array. So if the query was like this:

SELECT * FROM table WHERE id IN (:idlist)

and you passed an array with 3 values for idlist, it would replace the query like this:

SELECT * FROM table WHERE id IN (:idlist_1, :idlist_2, :idlist_3) ... then use the values in the array as the three values for those placeholders. It looks like the old code was using the keys from the data array, so instead of appending someting like "_1", it would append the actual key. So an attacker could put SQL code into the array keys and it would stick those (unchanged) into the query.

Here is the old code (without comments):

foreach (array_filter($args, 'is_array') as $key => $data) {
            $new_keys = array();
            foreach ($data as $i => $value) {
                $new_keys[$key . '_' . $i] = $value;
            }
            $query = preg_replace('#' . $key . '\b#', implode(', ', array_keys($new_keys)), $query);

And the new code:

foreach (array_filter($args, 'is_array') as $key => $data) {
            $new_keys = array();
            foreach (array_values($data) as $i => $value) {
                $new_keys[$key . '_' . $i] = $value;
            }
            $query = preg_replace('#' . $key . '\b#', implode(', ', array_keys($new_keys)), $query);

array_values will return an array with numeric indexes, which is what removes the vulnerability.

Comment Re:German illegal? (Score 2) 323

And this isn't old news either - that a Presidential candidate (JFK) was Catholic was a divisive issue within living memory.

The problem with knowing the truth of US history is, starting in the 60's the black civil rights movement co-opted the idea of discrimination and painted in simple black-and-white terms. Steadily since then, except for things like the internment of the Japanese that simply couldn't be overwritten, the story of discrimination and persecution in the US has been told solely in terms of antisemitism and Jim Crow.

Comment Re:For everything there is a season (Score 2, Insightful) 228

Ebola is easy to stop. We have oceans to protect us. All we need to do is stop allowing the 25,000 VISAS from affected countries from being used to gain entry.

1. Person from Ebola Land travels to Europe or some other non-US country, and exposes a person who is not from Ebola Land, who then travels home to the US.

2. US citizen travels to and from Ebola Land.

There are many different ways that Ebola can reach out and touch people who are not from Ebola Land, shutting down foreign visas is not the solution.

Comment Re:Reasonable (Score 1) 144

Riiight. Because US sex offenders lists contain people who made the mistake of drunkenly pissing against a wall in public...

Bullshit. Cite a reliable news source on that one.

Not to mention that US laws actually allows the prosecution of minors when their nude shot of themselves gets into the public internet.

We're talking about Google's response to the European "right to be forgotten", not US laws.

Can you stay on-topic? Or are you one of these one-topic fanatics that tie every subject into your obsession?

Comment Re:It must be running out of fuel (Score 1) 81

I don't see any claim that they "need" to bring it back, just that they "are" bringing it back. Considering that its stated mission is to test various technologies, maybe they want to change the payload out. Maybe the mission ended. Apparently the other two missions did not end because of a lack of fuel.

Comment Re:Reasonable (Score 1) 144

Granted, my son is 11.

Your anecdotal argument is irrelevant, your son is a young juvenile, which as you well know, are held to different standards that young adults and adults. For young adults and adults who do bad things, there are different consequences than a young juvenile would expect, and those consequences are generally proportional to the bad thing the young adult or adult has done.

But the real issue here is indexing publicly available data. These people that want to be forgotten need to talk to the people that are making this data public, not the people who are accessing in in a completely legal way and indexing it.

Comment Re:The Russian space program was amazing (Score 1) 122

I believe the differences between the two is mostly to the "no nonsense" approach to the Russians, and the fact that they like re-using designs and equipment that work instead of constantly re-inventing the wheel.

Except... they don't re-use designs and equipment. The current mark of the Soyuz (capsule) has almost nothing in common with the early ones other than a reasonably similar moldline. Soyuz has been modified and updated multiple times, not the least as it evolved from a general purpose Earth orbiter into a very specialized station taxi.
 

Sure, their spacecraft may look "ugly" (or at least, "uglier") than western or American ones, but they get the job done and they are reliable workhorses.

Reliable... is a very shaky claim given the number of near failures and almost disasters suffered by Soyuz over the years. It hasn't killed anyone in a long time, but it's come uncomfortably close an uncomfortably significant percentage of it's flights.[1] And speaking of flights and workhorses... even though it started flying over a decade earlier, it won't match the number of Shuttle flights until somewhere around the end of this decade at the current flight rate. (Last time I looked, I haven't calculated in a while.) In the same vein, while Shuttle suffered two LOCV accidents, it had zero complete mission failures and only one partial mission failure due to an abort-to-orbit placing it in too low of an orbit. Meanwhile, Soyuz had one pad abort, one failure to orbit, and at least two complete mission failures due to an inability to dock with a space station. (As well as several instances of either the orbital module or the re-entry module failing to separate properly.)
 
All of which is a roundabout way of saying the comparison isn't really as black-and-white as people would like it to be once you compare the actual Shuttle against the actual Soyuz (as opposed the largely fictional Soyuz the actual Shuttle is commonly compared to) and look at the actual numbers.

[1] Here's three accounts just covering reentry and landing failures.

Slashdot Top Deals

Kleeneness is next to Godelness.

Working...