today | current | recent ... categories | search ... mail | who ... syndication

posts brought to you by the category “security”

Das eez kaput! Sometime around 2002 I spaced the entire database table that mapped individual entries to categories. Such is life. What follows is a random sampling of entries that were associated with the category. Over time, the entries will be updated and then it will be even more confusing. Wander around, though, it's still a fun way to find stuff.

posts brought to you by the category “scrabble” ←   → posts brought to you by the category “sex”
 

Movable Thoughts #21 : Removed -T from mt.cfg and mt-send-entry.cgi

You can enable taint mode explicitly with the -T command-line switch. You should do this for daemons, servers, and any programs that run on behalf of someone else, such as CGI scripts. Programs that can be run remotely or anoymously by anyone on the Net are executing in the most hostile of environments. You should not be afraid to say No! occasionally. Contrary to popular belief, you can exercise a great deal of prudence without dehydrating into a wrinkled prude.

On the more security-conscious sites, running all CGI scripts under the -T flag isn't just a good idea: it's the law. We're not claiming that running in taint mode is sufficient to make your script secure. It's not, and it would take a whole book just to mention everything that would. But if you aren't executing your CGI scripts under taint mode, you've needlessly abandoned the strongest protection Perl can give you.

The Camel Book, 3.0

Prompted by all the talk about using Movable Type as an open relay for spammers, I decided to poke at the actual code and see what was going on.

There really isn't anywhere that Movable Type should be disabling taint mode but if I had to list things in order of importance, the mt-send-entry.cgi script would be near the top.

The script is potentially handing off to the sendmail program whose entire existence has been marked by security exploits. There is nothing to suggest that more won't be found in the future. Relying on sendmail to test for Potential Badness being passed by a ne'er do well via the Internet is wishful thinking, at best, and just plain crazy, at worst.

In fairness, the Movable Type mail widget tries to load Mail::Sendmail which does some basic sanity checking and, drumroll, untainting on the stuff you pass it. On the other hand it is not part of the core libraries shipped with Perl, nor is it in Movable Type's extlib directory which is a mystery since two thirds of it's dependencies are part of CORE and the other third has no non-standard requirements itself.

Untainting email addresses can be brain-crushingly difficult and inaccurate and the last thing you want to do when you're selling a computer widget for non-techincal people is start spewing errors where there are none. But not only did the Movable Type kids disable the -T flag on the mt-send-entry.cgi script they don't appear to have ever done any kind of untainting on the to and from parameters. Hello? Is anyone home?

I find this especially discouraging because one of the first things I did when Movable Type was released was send Ben code to at least try and untaint email addresses .

refers to

meta

 

Marc Fonvieille : Encrypted File System on a USB Thumbdrive

refers to

meta

[x]

permalink

http://www.aaronland.info/weblog/2003/11/20/5314

pubdate

http://www.aaronland.info

created

2003-11-20T13:14:44-05:00

last modified

2003-11-21T14:52:53-05:00

revision

1.4

changes

http://www.aaronland.info/weblog/2003/11/20/5314/changes.html

categories

license

http://creativecommons.org/licenses/by-nd-nc/1.0/

external links

[x]
 

Lori Alden : The Cook's Thesaurus

refers to

meta

[x]

permalink

http://www.aaronland.info/weblog/2003/09/15/5219/

pubdate

http://www.aaronland.info

created

2003-09-15T04:21:39-04:00

last modified

2003-10-11T10:36:53-04:00

revision

1.3

changes

http://www.aaronland.info/weblog/2003/09/15/5219//changes.html

categories

license

http://creativecommons.org/licenses/by-nd-nc/1.0/

external links

[x]
 

The New York Times ties its panties in a knot over wireless back-channelling.

This is a funny article in that it uses the classroom as the hook and then devolves quickly into talking only about conferences full of starry-eyed propellor heads. Frankly if I were a professor lecturing in a room with a wireless network, I would just log all the traffic and see what people were saying...

refers to

meta

[x]

permalink

http://www.aaronland.info/weblog/2003/07/24/5157/

pubdate

http://www.aaronland.info

created

2003-07-24T23:48:07-04:00

last modified

2003-10-11T10:37:57-04:00

revision

1.9

changes

http://www.aaronland.info/weblog/2003/07/24/5157//changes.html

categories

license

http://creativecommons.org/licenses/by-nd-nc/1.0/

external links

[x]
 

Andy Lester : "...I added a utility called 'mech-forms'."

refers to

meta

[x]

permalink

http://www.aaronland.info/weblog/2003/06/30/5110/

pubdate

http://www.aaronland.info

created

2003-06-30T12:55:15-04:00

last modified

2003-10-11T10:38:43-04:00

revision

1.8

changes

http://www.aaronland.info/weblog/2003/06/30/5110//changes.html

categories

license

http://creativecommons.org/licenses/by-nd-nc/1.0/

external links

[x]
 

Meanwhile, William Gibson cites

himself , which seems only fair all thing considered.

refers to

meta

[x]

permalink

http://www.aaronland.info/weblog/2003/04/10/4989/

pubdate

http://www.aaronland.info

created

2003-04-10T14:26:21-04:00

last modified

2003-10-11T10:40:42-04:00

revision

1.9

changes

http://www.aaronland.info/weblog/2003/04/10/4989//changes.html

categories

license

http://creativecommons.org/licenses/by-nd-nc/1.0/

external links

[x]
 

John Carleton : "I was almost done with my ramen"

Maybe it's just because I once knew some one who became a Hairy Fishnut and was promptly nicknamed Snack Ramen, but for the life of me I can't understand why people still eat the stuff.

refers to

meta

[x]

permalink

http://www.aaronland.info/weblog/2003/04/02/4967/

pubdate

http://www.aaronland.info

created

2003-04-02T16:55:47-05:00

last modified

2003-10-11T10:41:04-04:00

revision

1.9

changes

http://www.aaronland.info/weblog/2003/04/02/4967//changes.html

categories

license

http://creativecommons.org/licenses/by-nd-nc/1.0/

external links

[x]
 

The first two points on this author's wishlist will never happen

because they have nothing to do Movable Type, really. They are problems (translation: this is actually a feature, not a bug) that have plagued multi-user environments from day one.

refers to

meta

[x]

permalink

http://www.aaronland.info/weblog/2003/03/22/4940/

pubdate

http://www.aaronland.info

created

2003-03-22T06:56:23-05:00

last modified

2003-10-11T10:41:31-04:00

revision

1.9

changes

http://www.aaronland.info/weblog/2003/03/22/4940//changes.html

categories

license

http://creativecommons.org/licenses/by-nd-nc/1.0/

external links

[x]
 

Laura Holder : Illinois Flatland #5

refers to

meta

[x]

permalink

http://www.aaronland.info/weblog/2003/02/19/4868/

pubdate

http://www.aaronland.info

created

2003-02-19T00:49:56-05:00

last modified

2003-10-11T10:42:43-04:00

revision

1.9

changes

http://www.aaronland.info/weblog/2003/02/19/4868//changes.html

categories

license

http://creativecommons.org/licenses/by-nd-nc/1.0/

external links

[x]
 

Me : sql-abstract-_recurse_where-order-by.2.diff

Because there's nothing like having Tim Bunce ask you: And if table has a field named order?

refers to

meta

[x]

permalink

http://www.aaronland.info/weblog/2003/02/10/4839/

pubdate

http://www.aaronland.info

created

2003-02-10T23:50:15-05:00

last modified

2003-10-11T10:43:12-04:00

revision

1.9

changes

http://www.aaronland.info/weblog/2003/02/10/4839//changes.html

categories

license

http://creativecommons.org/licenses/by-nd-nc/1.0/

external links

[x]
 

James Spahr : "I made a Movable Type BBEdit glossary"

refers to

meta

[x]

permalink

http://www.aaronland.info/weblog/2003/01/23/4803/

pubdate

http://www.aaronland.info

created

2003-01-23T11:51:09-05:00

last modified

2003-10-11T10:43:48-04:00

revision

1.9

changes

http://www.aaronland.info/weblog/2003/01/23/4803//changes.html

categories

license

http://creativecommons.org/licenses/by-nd-nc/1.0/

external links

[x]
 

From the "I don't mean to disabuse you of your Google swooning" department:

this is what the search engine thinks of when you say the words bread+poetry .

meta

[x]

permalink

http://www.aaronland.info/weblog/2002/11/27/4730/

pubdate

http://www.aaronland.info

created

2002-11-27T14:35:00-05:00

last modified

2003-10-11T10:45:01-04:00

revision

1.9

changes

http://www.aaronland.info/weblog/2002/11/27/4730//changes.html

categories

license

http://creativecommons.org/licenses/by-nd-nc/1.0/

external links

[x]
 

Angela Lewis : Hoax E-mails and Bonsai Kittens: Are You E-literate in the Docuverse?

Our social mantra is very much 'is Internet, is good', and our logic is often placed around a misguided belief that if the information was found on the 'Net, then it must be good'.

This paper discusses the importance of not only having the skills of computer literacy, that is defined as being able to use computers and software to navigate the Internet, but also the importance of information literacy, defined as the skill of being critically literate.

refers to

meta

[x]

permalink

http://www.aaronland.info/weblog/2002/09/04/4581/

pubdate

http://www.aaronland.info

created

2002-09-04T20:34:12-04:00

last modified

2003-10-11T10:47:30-04:00

revision

1.9

changes

http://www.aaronland.info/weblog/2002/09/04/4581//changes.html

categories

license

http://creativecommons.org/licenses/by-nd-nc/1.0/

external links

[x]
 

The random pseudodictionary.com word of the day is : world serious

A collection of baseball games, generally played in October, often viewed by aficionados in a light similar to religious ritual. Term first coined in the 1950s by the inimitable Walt Kelly, cartoonist, humorist, and linguist extraordinaire. ("We have met the enemy and he is us.")
ex. 2001 was the first year the World Serious lasted into November.

refers to

meta

[x]

permalink

http://www.aaronland.info/weblog/2002/07/23/4488/

pubdate

http://www.aaronland.info

created

2002-07-23T20:30:02-04:00

last modified

2003-10-11T10:49:03-04:00

revision

1.9

changes

http://www.aaronland.info/weblog/2002/07/23/4488//changes.html

categories

license

http://creativecommons.org/licenses/by-nd-nc/1.0/

external links

[x]
 

The random pseudodictionary.com word of the day is : skrilla

"Money, Loot, Chedda."
ex. "whut up ninjaz,I gots the skrilla fo' rilla, I'll take care of the chizeck"

refers to

meta

[x]

permalink

http://www.aaronland.info/weblog/2002/05/24/4366/

pubdate

http://www.aaronland.info

created

2002-05-24T14:00:44-04:00

last modified

2003-10-11T10:51:05-04:00

revision

1.9

changes

http://www.aaronland.info/weblog/2002/05/24/4366//changes.html

categories

license

http://creativecommons.org/licenses/by-nd-nc/1.0/

external links

[x]
 

The random pseudodictionary.com word of the day is : narkit/fair narkit

Scottish slang. Narkit = angry. Fair narkit = pretty darn angry.
ex. Your wee laddie made me fair narkit.

refers to

meta

[x]

permalink

http://www.aaronland.info/weblog/2002/05/06/4305/

pubdate

http://www.aaronland.info

created

2002-05-06T03:47:05-04:00

last modified

2003-10-11T10:52:05-04:00

revision

1.9

changes

http://www.aaronland.info/weblog/2002/05/06/4305//changes.html

categories

license

http://creativecommons.org/licenses/by-nd-nc/1.0/

external links

[x]
 

Kip Hampton : Introducing XML::SAX::Machines, Part Two

Meanwhile, I'd like to know what's up with the bad Wallpaper* illustrations and which one is Perl and the other XML?

refers to

meta

[x]

permalink

http://www.aaronland.info/weblog/2002/03/21/4123/

pubdate

http://www.aaronland.info

created

2002-03-21T06:00:27-05:00

last modified

2003-10-11T10:55:07-04:00

revision

1.9

changes

http://www.aaronland.info/weblog/2002/03/21/4123//changes.html

categories

license

http://creativecommons.org/licenses/by-nd-nc/1.0/

external links

[x]
 

The random pseudodictionary.com word of the day is : fundage

Money.
ex. We're gonna have to go soon. I'm running low on fundage.

refers to

meta

[x]

permalink

http://www.aaronland.info/weblog/2002/03/20/4114/

pubdate

http://www.aaronland.info

created

2002-03-20T03:16:47-05:00

last modified

2003-10-11T10:55:16-04:00

revision

1.10

changes

http://www.aaronland.info/weblog/2002/03/20/4114//changes.html

categories

license

http://creativecommons.org/licenses/by-nd-nc/1.0/

external links

[x]
 

W3C : IsaViz

IsaViz is a visual environment for browsing and authoring RDF models represented as graphs.

mmmmm....weblogging with boxes and arrows.

refers to

meta

[x]

permalink

http://www.aaronland.info/weblog/2002/03/15/4093/

pubdate

http://www.aaronland.info

created

2002-03-15T23:21:03-05:00

last modified

2003-10-11T10:55:37-04:00

revision

1.10

changes

http://www.aaronland.info/weblog/2002/03/15/4093//changes.html

categories

license

http://creativecommons.org/licenses/by-nd-nc/1.0/

external links

[x]
 

Bob DuCharme : Reading Multiple Input Documents [in XSLT]

refers to

meta

[x]

permalink

http://www.aaronland.info/weblog/2002/03/08/4057/

pubdate

http://www.aaronland.info

created

2002-03-08T17:52:23-05:00

last modified

2003-10-11T10:56:13-04:00

revision

1.9

changes

http://www.aaronland.info/weblog/2002/03/08/4057//changes.html

categories

license

http://creativecommons.org/licenses/by-nd-nc/1.0/

external links

[x]
 

The dictified dictionary.com word of the day is : frisson

frisson n : an almost pleasurable sensation of fright; "a frisson of surprise shot through him" [syn: {shiver}, {chill}, {quiver}, {shudder}, {thrill}, {tingle}] wn

refers to

meta

[x]

permalink

http://www.aaronland.info/weblog/2002/03/06/4040/

pubdate

http://www.aaronland.info

created

2002-03-06T17:22:42-05:00

last modified

2003-10-11T10:56:30-04:00

revision

1.9

changes

http://www.aaronland.info/weblog/2002/03/06/4040//changes.html

categories

license

http://creativecommons.org/licenses/by-nd-nc/1.0/

external links

[x]
 

The dictified dictionary.com word of the day is : tyro

Tyro, KS (city, FIPS 71925) Location: 37.03670 N, 95.82142 W Population (1990): 243 (98 housing units) Area: 1.4 sq km (land), 0.0 sq km (water) gazetteer
Tyro \Ty"ro\, n.; pl. {Tyros}. [L. tiro a newlylevied soldier, a beginner.] A beginner in learning; one who is in the rudiments of any branch of study; a person imperfectly acquainted with a subject; a novice. [Written also {tiro}.] The management of tyros of eighteen Is difficult. --Cowper. web1913
tyro n : someone new to a field or activity [syn: {novice}, {beginner}, {tiro}, {initiate}] wn

refers to

meta

[x]

permalink

http://www.aaronland.info/weblog/2002/02/26/4008/

pubdate

http://www.aaronland.info

created

2002-02-26T16:44:29-05:00

last modified

2003-10-11T10:57:02-04:00

revision

1.9

changes

http://www.aaronland.info/weblog/2002/02/26/4008//changes.html

categories

license

http://creativecommons.org/licenses/by-nd-nc/1.0/

external links

[x]
 

Nicholas C. Zakas : Creating a Cross-Browser (DOM) Expandable Tree

refers to

meta

[x]

permalink

http://www.aaronland.info/weblog/2002/02/21/3991/

pubdate

http://www.aaronland.info

created

2002-02-21T12:04:32-05:00

last modified

2003-10-11T10:57:19-04:00

revision

1.10

changes

http://www.aaronland.info/weblog/2002/02/21/3991//changes.html

categories

license

http://creativecommons.org/licenses/by-nd-nc/1.0/

external links

[x]
 

The dictified dictionary.com word of the day is : potable

Potable \Po"ta*ble\, a. [F., fr. L. potabilis, fr. potare to drink; akin to Gr. po`tos a drinking, po`sis a drink, Skr. p[=a] to drink, OIr. ibim I drink. Cf. {Poison}, {Bib}, {Imbibe}.] Fit to be drunk; drinkable. ``Water fresh and potable.'' --Bacon. -- n. A potable liquid; a beverage. ``Useful in potables.'' --J. Philips. web1913
potable adj : of alcoholic beverages that are suitable for drinking; "it's an impudent young wine but I think you will find it quite potable" n : any liquid suitable for drinking: "may I take your beverage order?" [syn: {beverage}, {drink}, {drinkable}] wn
POTABLE, n. Suitable for drinking. Water is said to be potable; indeed, some declare it our natural beverage, although even they find it palatable only when suffering from the recurrent disorder known as thirst, for which it is a medicine. Upon nothing has so great and diligent ingenuity been brought to bear in all ages and in all countries, except the most uncivilized, as upon the invention of substitutes for water. To hold that this general aversion to that liquid has no basis in the preservative instinct of the race is to be unscientific -- and without science we are as the snakes and toads. devils

refers to

meta

[x]

permalink

http://www.aaronland.info/weblog/2002/01/27/3892/

pubdate

http://www.aaronland.info

created

2002-01-27T13:03:47-05:00

last modified

2003-10-11T10:58:58-04:00

revision

1.10

changes

http://www.aaronland.info/weblog/2002/01/27/3892//changes.html

categories

license

http://creativecommons.org/licenses/by-nd-nc/1.0/

external links

[x]
 

chromatic : Slash's Wiki Plugin

"In theory, any Web application could be reimplemented as a Slash plugin. In practice, it's not terribly difficult to write something useful."

refers to

meta

[x]

permalink

http://www.aaronland.info/weblog/2002/01/18/3854/

pubdate

http://www.aaronland.info

created

2002-01-18T15:01:46-05:00

last modified

2003-10-11T10:59:36-04:00

revision

1.9

changes

http://www.aaronland.info/weblog/2002/01/18/3854//changes.html

categories

license

http://creativecommons.org/licenses/by-nd-nc/1.0/

external links

[x]
 

N.Y. Times : " The court began by observing that a hyperlink is not merely a high-tech footnote

or reference card that conveys information to a reader concerning the location of additional content. Rather, the court said, a hyperlink contains a speech component and an additional "nonspeech" component -- some computer code -- that has the functional capacity to bring the content of the linked Web page to the user's computer screen at the click of a mouse. It is this instantaneous, functional nature of the hyperlink that distinguishes it from its non-electronic print cousin, said the court, because a hyperlink to digital material can result in "instantaneous worldwide distribution [of prohibited material] before any preventative measures can be taken." Because the D.M.C.A.'s anti-trafficking provision is targeted at the functional, instantaneous aspect of Corley's hyperlinks, continued the court, the regulation is "content neutral" and thus is subject to a relaxed level of judicial scrutiny." Meanwhile, the other Aaron (permalinks, gentlemen? :-) asks : I wonder what the court would say if I came out with a browser that linked every instance of the word "the" to the DeCSS source code? . Isn't that what we all tied our panties in a knot over when Microsoft announced Smart Tags ?

refers to

meta

 

The dict-ified dictionary.com word of the day is enunciate

| source : web1913 | Enunciate \E*nun"ci*ate\, v. t. [imp. & p. p. {Enunciated}; p. pr. & vb. n. {Enunciating}.] [L. enuntiatus, -ciatus, p. p. of enuntiare, -ciare. See {Enounce}.] 1. To make a formal statement of; to announce; to proclaim; to declare, as a truth. The terms in which he enunciates the great doctrines of the gospel. --Coleridge. 2. To make distinctly audible; to utter articulately; to pronounce; as, to enunciate a word distinctly. | source : web1913 | Enunciate \E*nun"ci*ate\, v. i. To utter words or syllables articulately. | source : wn | enunciate v 1: speak, pronounce, or utter in a certain way; "She pronounces French words in a funny way"; "I cannot say `zip wire'" [syn: {pronounce}, {articulate}, {enounce}, {say}] 2: express or state clearly [syn: {articulate}, {vocalize}]

refers to

meta

[x]

permalink

http://www.aaronland.info/weblog/2001/12/08/3704/

pubdate

http://www.aaronland.info

created

2001-12-08T04:41:14-05:00

last modified

2003-10-11T11:01:59-04:00

revision

1.8

changes

http://www.aaronland.info/weblog/2001/12/08/3704//changes.html

categories

license

http://creativecommons.org/licenses/by-nd-nc/1.0/

external links

[x]
 

Does anyone know if any standardized vocabularies

for writing FAQs, in XML, have been developed?

refers to

meta

[x]

permalink

http://www.aaronland.info/weblog/2001/11/07/3610/

pubdate

http://www.aaronland.info

created

2001-11-07T11:53:21-05:00

last modified

2003-10-11T11:03:32-04:00

revision

1.9

changes

http://www.aaronland.info/weblog/2001/11/07/3610//changes.html

categories

license

http://creativecommons.org/licenses/by-nd-nc/1.0/

external links

[x]
 

Me : Apache::XML::TreeView.pm

is a mod_perl handler that allows a user to specify a local, or remote, XML document which to be transformed using the tree-view XSL stylesheet.

refers to

meta

[x]

permalink

http://www.aaronland.info/weblog/2001/10/16/3538/

pubdate

http://www.aaronland.info

created

2001-10-16T07:19:28-04:00

last modified

2003-10-11T11:04:44-04:00

revision

1.9

changes

http://www.aaronland.info/weblog/2001/10/16/3538//changes.html

categories

license

http://creativecommons.org/licenses/by-nd-nc/1.0/

external links

[x]
 

Danny Goodman : Supporting Three Event Models at Once

refers to

meta

[x]

permalink

http://www.aaronland.info/weblog/2001/09/26/3460/

pubdate

http://www.aaronland.info

created

2001-09-26T15:32:40-04:00

last modified

2003-10-11T11:06:00-04:00

revision

1.10

changes

http://www.aaronland.info/weblog/2001/09/26/3460//changes.html

categories

license

http://creativecommons.org/licenses/by-nd-nc/1.0/

external links

[x]
 

Canada DMCA Opponents

via matt goyer

refers to

meta

[x]

permalink

http://www.aaronland.info/weblog/2001/08/31/3325/

pubdate

http://www.aaronland.info

created

2001-08-31T08:56:45-04:00

last modified

2003-10-11T11:08:02-04:00

revision

1.9

changes

http://www.aaronland.info/weblog/2001/08/31/3325//changes.html

categories

license

http://creativecommons.org/licenses/by-nd-nc/1.0/

external links

[x]
 

Daniel Lundin : xmlrpc.el

"is an XML-RPC client implementation in emacs lisp, capable of both synchronous and asynchronous method calls (using the url package's async retrieval functionality)." Yay! via scripting news

refers to

meta

[x]

permalink

http://www.aaronland.info/weblog/2001/07/24/3205/

pubdate

http://www.aaronland.info

created

2001-07-24T21:16:39-04:00

last modified

2003-10-11T11:10:00-04:00

revision

1.9

changes

http://www.aaronland.info/weblog/2001/07/24/3205//changes.html

categories

license

http://creativecommons.org/licenses/by-nd-nc/1.0/

external links

[x]
 

I wonder how difficult it would be to write an interactive weblog client

using Jabber . I wonder how you would do categories. Maybe you could create individual categories as users and invite them to participate in a chat or a text conference. I wonder...

meta

[x]

permalink

http://www.aaronland.info/weblog/2001/04/18/2972/

pubdate

http://www.aaronland.info

created

2001-04-18T03:03:36-04:00

last modified

2003-10-11T11:13:44-04:00

revision

1.9

changes

http://www.aaronland.info/weblog/2001/04/18/2972//changes.html

categories

license

http://creativecommons.org/licenses/by-nd-nc/1.0/

external links

[x]
 

The Meerkat Product

"gives access to the Meerkat's XML-RPC API and allows the placement of news items in any Zope document."

refers to