Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×

Comment Re:Why is this a bash bug? (Score 2) 329

Why does bash have to worry about security?

Because if it is installed as /bin/sh (fairly common), it gets called in a great many places because of the OS APIs system() and popen(), which are both defined to use /bin/sh on Unix. Much of the reporting about it has been more than a little breathless, but that's journalists for you.

Not everything is vulnerable. CGI is not inherently vulnerable (it could use execve() directly) and the called code need not use bash ever. But it's still a serious problem as anything that explicitly requires bash is also definitely broken: we want it fixed ASAP. (A start would be to never process environment variables for function definitions during startup, especially when running as /bin/sh...)

Comment Re:"could be worse than Heartbleed" (Score 1) 318

Outside of malicious HTTP headers landing in environment variable in CGI land, I'm hard pressed to think of another reasonable vector for this bug to be a problem...

To be fair, with a moderately competent CGI implementation, the subprocess will start just fine. The problem comes with whatever that subprocess calls, since environment variables are inherited by default. The deeper you go, the greater the likelihood that some programmer will have used system() or popen(), or even flat-out implemented the process as a shell script.

Comment The OP video was wrong (Score 1) 134

Early in the video, the narrator said "our eyes just know that these (shown on the screen) videos are real", with the point being that later on he was going to surprise us that they were in fact renditions by his product.

But when I was looking at those images, I was actually thinking that they didn't look real to me. For some reason, I found myself thinking of Half-life 2.

Comment Re:Best to pretend you don't have the PhD... (Score 2) 479

This was my experience as well. I have lots of experience, but I decided to get a PhD both to scratch a personal itch and to maybe open some employment doors.

What I found was that it did open a few particular doors, including for my current job which I'm really enjoying.

However, the number of doors open, compared to if I'd just stopped at a Master's degree, is probably lower. Especially if you consider the years I was working on my PhD rather than keeping up with the latest buzzword-bingo skills.

I guess I had to learn the lesson the hard way, despite some pretty clear warnings: unless you're going for a career in academia or research, you're better off stopping at a masters.

Comment Re:Why is 1984 in this poll? (Score 1) 410

The American Library Association maintains lists of the most frequently challenged books (i.e. the ones people try to ban). Although 1984 shows up on the list of challenged classics, there is only one challenge listed -- someone in Jackson County, Florida in 1981 thought that it was "pro-communist and contained explicit sexual matter". The first part shows a massive failure of reading comprehension, not actual hostility towards the content. 1984 doesn't show up in the top 100 challenged books lists for 1990-1999 or 2000-2009.

However, the US isn't the only country that bans (or tries to ban) books. Works like 1984 are much more likely to be banned by totalitarian regimes precisely because they encourage people to think about the ways in which the regime is trying to restrict them. Banning books is basically wrong anywhere, not just in one country in one part of the planet.

Slashdot Top Deals

Neutrinos have bad breadth.

Working...