Forgot your password?
typodupeerror

Comment Why does slashdot shill this stupid list? (Score 1) 15

We know this list is stupid. They count web search result and then massage the results. It's basically meaningless, and noise levels are going to be more significant month-to-month than any real changes in web content. Why does slashdot keep pushing it in our faces? Are they paid? Do slashdot's owners get ad revenue from them? Is it ragebait to drive "engagement"?

Comment Re:Who is Alice Jensen? (Score 1) 42

They only behave because they feel it's in their best interest to do so, and that doing otherwise would be overplaying their hand. Countries are only "good" when they don't think they can get away with openly being evil. The current US administration grew up believing the domestic propaganda, and they honestly believe they're the greatest at everything, they can act unilaterally, and everyone else will just have to deal with it. That isn't completely true, and will continue to become less true as China grows their influence. But when China feels they're the dominant player, expect them to behave badly, just like the US does.

Comment Re:mod_php was considered the easiest approach (Score 1) 29

If you're on EL9, mod_php is a lot more work to get set up, so imagine a lot of people moved from mod_php to php-fpm when moving to EL9. And if you're running php-fpm on EL9, you may as well reconfigure EL8 to work that way as well for consistency. EL7 and older didn't have php-fpm, and would require you to roll your own patched PHP as they're out of support.

Comment Re: They write themselves, folks (Score 1) 19

Function calls are expensive in Python. This makes it attractive to write huge functions with deeply nested control structures.

Within a function, to can indent twice, maybe 2 times in the case of a switch statement.

Besides the other issues with this sentence, Python doesn't have switch statements. Python 3.10 introduces a "match" statement that's supposed to provide similar functionality, but it isn't the same.

Comment Mitigations work (Score 3, Interesting) 100

See, this is a case of mitigations working. ASLR makes the exploit substantially harder weaponise. There are plenty of other mitigations you can use to reduce the chance of a bug being successfully exploited. Examples include:

  • Ensure PHP (and mod_wsgi, and mod_lua, and whatever else) can't be invoked on servers and/or vhosts where it isn't necessary. You don't want stuff being inadvertently executed as scripts.
  • Don't allow PHP (or other server side scripting languages) to run from any directory the web server user has write access to. This protects you from a whole class of exploits that involve uploading a file and then tricking a vulnerable web application into making the web server treat it as as server side script. Yes, this prevents WordPress from auto-updating, but it protects you from most known WordPress exploit kits. Same applies to other CMS, wikis, etc.
  • Use at least a basic selinux policy to constrain the web server and associated processes. A separate out-of-band whitelist of what the web server is allowed to access can block successful exploitation of vulnerabilities.

You need to be paranoid and assume the network is hostile.

Comment Re:It must suck to wake up everyday and be so wron (Score 1) 152

Your ancestors were "barbarians" from what's now western Germany who took advantage of the decline of the Roman empire to invade the Gaulish provinces, or Norsemen who muscled their way in because they liked the more pleasant climate. The Romans before them subjugated the Gaulish peoples. You weren't the first people to inhabit the land now known as France, and you won't be the last. Everything is temporary.

Slashdot Top Deals

The world is coming to an end. Please log off.

Working...