Forgot your password?
typodupeerror

Comment Re:mod_php was considered the easiest approach (Score 1) 28

If you're on EL9, mod_php is a lot more work to get set up, so imagine a lot of people moved from mod_php to php-fpm when moving to EL9. And if you're running php-fpm on EL9, you may as well reconfigure EL8 to work that way as well for consistency. EL7 and older didn't have php-fpm, and would require you to roll your own patched PHP as they're out of support.

Comment Re: They write themselves, folks (Score 1) 17

Function calls are expensive in Python. This makes it attractive to write huge functions with deeply nested control structures.

Within a function, to can indent twice, maybe 2 times in the case of a switch statement.

Besides the other issues with this sentence, Python doesn't have switch statements. Python 3.10 introduces a "match" statement that's supposed to provide similar functionality, but it isn't the same.

Comment Mitigations work (Score 3, Interesting) 100

See, this is a case of mitigations working. ASLR makes the exploit substantially harder weaponise. There are plenty of other mitigations you can use to reduce the chance of a bug being successfully exploited. Examples include:

  • Ensure PHP (and mod_wsgi, and mod_lua, and whatever else) can't be invoked on servers and/or vhosts where it isn't necessary. You don't want stuff being inadvertently executed as scripts.
  • Don't allow PHP (or other server side scripting languages) to run from any directory the web server user has write access to. This protects you from a whole class of exploits that involve uploading a file and then tricking a vulnerable web application into making the web server treat it as as server side script. Yes, this prevents WordPress from auto-updating, but it protects you from most known WordPress exploit kits. Same applies to other CMS, wikis, etc.
  • Use at least a basic selinux policy to constrain the web server and associated processes. A separate out-of-band whitelist of what the web server is allowed to access can block successful exploitation of vulnerabilities.

You need to be paranoid and assume the network is hostile.

Comment Re:It must suck to wake up everyday and be so wron (Score 1) 152

Your ancestors were "barbarians" from what's now western Germany who took advantage of the decline of the Roman empire to invade the Gaulish provinces, or Norsemen who muscled their way in because they liked the more pleasant climate. The Romans before them subjugated the Gaulish peoples. You weren't the first people to inhabit the land now known as France, and you won't be the last. Everything is temporary.

Comment Re:Change to a monthly service (Score 2) 152

You do know that you wouldn't have to sign up for such a scheme, right? There's no gun to your head?

Yes, this is understood...however, that's an indictment against the category. Games are optional entertainment products, so the problem is that *any* legislation of entertainment products can come under the guise of "it's optional, you can just not-buy it". Agreed; it's not food or medicine, so the industry benefits from a lower level of necessity in that respect.

However, "it's optional" doesn't mean it's not worth regulating. Gambling is "optional", yet slot machines have such strict regulatory compliance requirements to meet, that they commonly exceed the level of scrutiny given to voting machines and MRI hardware. The gun-to-head argument would stipulate that since casinos are way easier to avoid than hospitals or banks, slot machines don't need regulation.

When video games started running into areas that consumer protection laws typically cover, we started needing to assess the appropriate level of regulation. For decades, games were one-time, permanent purchases - people with Nintendo cartridges and Playstation games on disc can play them today, 20-40 years after release, and neither Nintendo nor Sony have a practical means of saying "...you can't play that anymore". Over time, games got tied to accounts, and there were some consumer benefits - no more scratched discs or lost media or shelf space issues, plus additional content and bug fixes after release.

These were great, until they weren't. Those accused of cheating saw account bans, which meant they couldn't play *other, paid-for games* anymore, irrespective of whether the accusations were true. Companies would take money for games, but then shut down the servers needed to play them saying "it costs us too much", but then would sue fans who said, "...we'll take it from here, then". Of course, there was the whole "surprise mechanics" thing, where games were literally-gambling and they tried to argue that it wasn't.

So yes, there's no gun-to-head requirement for people to sign up for these services. Stadia proved that. However, the problem is when such systems are implemented as a requirement, for artificial means. If GTA6 was "Stadia Exclusive", it's not like GTA6 can't run on consoles or PCs, it's purely a predatory business model for a game that inherently doesn't require it. It's "pay us the same amount as before, but we can claw your access to the game back, but you can't claw your money back, because this benefits us". Now sure, purely rational human beings would refuse to buy it until they released it with traditional distribution mechanisms, but 'vote with your wallet' is exceedingly difficult to make work at scale.

Even if you want to argue this is acceptable for video games, it's a short hop to business software, where such a model has harmed many small businesses with things like Quickbooks pulling this crap and forcing businesses to go from $300 every few years to $2500 annually. "It's optional!! they can print out 20 years of financial data and use paper and a pencil!!11" - how far does that argument go, exactly? that's the problem with the gun-to-head argument - if *only* unavoidable needs receive regulation, then everything that is "optional" becomes a potential means of exploitation. There needs to be a balance, of course, but somehow I don't think that video game publishers are unreasonably impacted because the government tells them "you have to remove DRM from your products if you're not selling them anymore, and you can't sue your customers for fixing things in your products if they paid for it, either".

Comment Re:Utah (Score 1) 50

Large quantities of porn are made in China. The chance of being arrested just for possessing porn or distributing porn on a small scale are basically zero. Every convenience store in Shanghai sells vibrators (as in female sex toys), with the boxes displayed conspicuously. They're a lot less hung up about sex than the USA and a lot of other western countries.

Comment nobody's falling for it (Score 2) 56

...if I need to connect it to an account, and/or it needs internet access to function, then it's a guarantee that 1.) the conversations will be stored in Amazon's meat grinder, 2.) the user won't be able to delete them (just make them invisible for themselves), and 3.) it's going to turn into a subscription fee. ...if, however, I can download the transcripts over a USB cable into software that installs on my computer and works despite an application firewall that block outbound internet connectivity, then maybe it might be interesting. However, *nobody* makes hardware/software like that anymore, especially Amazon.

Slashdot Top Deals

If mathematically you end up with the wrong answer, try multiplying by the page number.

Working...