Why oh why was it possible for the user nobody to have write permission on a CGI script? THAT is the real hole in that setup. The only time that I can think of data that needs to be owned by nobody is a web data file, in a contained directory. Certainly CGI scripts should not be writeable by nobody! An even better solution is to use a sql database, and make it so that absolutely no file is writeable by the web server.
The cron hole was a local hole, and should not have been exploitable remotely, as it in fact was not. The local cgi-bin hole took care of that.
Nevertheless, it does seem like an unfair test, if the NT box had SP5 installed. Hey, if they can fix the security on one, why not the other?
Of course the correct thing for Ebay to do is put a robots.txt file that limits the area that search engines can traverse. This has been a standard for a long time, and it is understandable to not want search engines to index highly dynamic pages, as the content of those pages would be out of date quickly.
Some things are linkable, some things aren't. Welcome to the dynamic nature of the web.
Contrary to what someone suggested elsewhere, I don't see this article as an insult or cruel joke; I t was quite funny! I'd actually be worried if someone was doing that distro for real, as it would be a complete waste of time. (the screenshots, fortune mods, etc would be nice, tough.)
Interesting idea.... It's a mysql database that I'm most concerned with; everything else can be rsync'd once a night or something. I wonder how much of a network load this would generate.
I too would like to know how to do real-time replication like that - having one computer handling a databse still presents a single point of failure... Heck, slashdot probably needs this too!:P
I rarely post, as There is nothing new to add most of the time. I have had one time where a post was moderated down, but I think that this case was in fact a case of Moderator abuse, which this problem is supposed to help fix. I guess I can't be part of the fix.
Well, it's not the same person for all of us, but maybe the generality of it could be placed here... My dad impacted my life far more than any of these...
I wouldn't even give them as honorable a name as cracker. Script Kiddie fits so much better. One kid around here "discovered" FTP and thought he had broke into our systems once. No, he simply logged in with his username and password, and had all the usual access that brings.
>and the fact of evolution is being observed > right now -- it's happening in front of our > eyes, for those who are willing to look.
Hahahah yeah right. Show me where one species has had its DNA changed or altered and remained viable, and even reproduced. We're not talking natural selection... that's not really evolution.
> There are species living with the eye in what we >could term mid-step of evolution.
two problems there, one is *could* term mid-step, meaning there is still some doubt. Two, why isn't there a progression of steps, instead of concrete, finite distinctions? For that matter, how can we classify species under evolution? There should be sooo many variations and grades between species that one couldn't say for sure. According to Evolution, our classification should be more like: "This species is 40% this and and 30% that and 1% this..."
If you look at *all* the facts, evolution takes just as much faith as creation. maybe more. There is also significant scientific proof for creation. As you say:
"it's happening in front of our eyes, for those who are willing to look."
This looks pretty impressive so far. Java is slow as ever, but hopefully the full release will speed things up. This may even be better than NetBeans, although NetBeans is free for tinkerers. IBM - Consider making this free unless a product is sold that was built using VA ?!?!?
Of course you never do lose power to your server because you are using a UPS, right?!?!?:)
The way things run around here, I have the system page me when the power fails, and then shuts down normally. I like to be there before it boots up again, because I almost certainly have not got the bootup scripts correct to bring it online perfectly. Having it not power on would be a "feature" for me.:)
An easy way to fix this: Have the ISP customers sign an agreement in which they asume responibility for information they post, and absolve the ISP of liability.
But really... how in the heck is a large ISP supposed to enforce controls on all the content on its server? As someone else said, we might as well have the Post Office open and scan every letter for infringements and such. Bye bye privacy!
Slashdot Mirror
Did you see the one with styrofoam peanuts? They stick to the walls for up to 16 minutes. Sounds like a fun prank, to me.... :P
I think the mnemonic web browser fits this description... but they need more coders to make it fly! www.mnemonic.org
Where in the heck do you get these figures? As owner of an ISP I can say that average usage is quite a bit higher, as are prices.
And I'm in the area /.'s think is sooooo ancient: Kansas.
Why oh why was it possible for the user nobody to have write permission on a CGI script? THAT is the real hole in that setup. The only time that I can think of data that needs to be owned by nobody is a web data file, in a contained directory. Certainly CGI scripts should not be writeable by nobody! An even better solution is to use a sql database, and make it so that absolutely no file is writeable by the web server.
The cron hole was a local hole, and should not have been exploitable remotely, as it in fact was not. The local cgi-bin hole took care of that.
Nevertheless, it does seem like an unfair test, if the NT box had SP5 installed. Hey, if they can fix the security on one, why not the other?
Of course the correct thing for Ebay to do is put a robots.txt file that limits the area that search engines can traverse. This has been a standard for a long time, and it is understandable to not want search engines to index highly dynamic pages, as the content of those pages would be out of date quickly.
Some things are linkable, some things aren't. Welcome to the dynamic nature of the web.
Count me in too! :)
Contrary to what someone suggested elsewhere, I don't see this article as an insult or cruel joke; I t was quite funny! I'd actually be worried if someone was doing that distro for real, as it would be a complete waste of time. (the screenshots, fortune mods, etc would be nice, tough.)
Interesting idea.... It's a mysql database that I'm most concerned with; everything else can be rsync'd once a night or something. I wonder how much of a network load this would generate.
I too would like to know how to do real-time replication like that - having one computer handling a databse still presents a single point of failure... Heck, slashdot probably needs this too! :P
I rarely post, as There is nothing new to add most of the time. I have had one time where a post was moderated down, but I think that this case was in fact a case of Moderator abuse, which this problem is supposed to help fix. I guess I can't be part of the fix.
How does one fix karma??????
That didn't take long... but he nuked the WRONG ONE!!!! :P I bet the comments were much better on the last one. Ah well.. *chuckle*
lol, actually, this whole story nd posting is providing some much needed humor today...
I say, moderate this post UP!
> Except for me; I know that I'm right!
;)
Good to know that I'm not alone!!!!!
Well, it's not the same person for all of us, but maybe the generality of it could be placed here... My dad impacted my life far more than any of these...
I wouldn't even give them as honorable a name as cracker. Script Kiddie fits so much better. One kid around here "discovered" FTP and thought he had broke into our systems once. No, he simply logged in with his username and password, and had all the usual access that brings.
Well, I've been living in an apartment above my business, an ISP. I've *got* to get out more.... :(
All I can say is, Ouch.
>and the fact of evolution is being observed
> right now -- it's happening in front of our
> eyes, for those who are willing to look.
Hahahah yeah right. Show me where one species has had its DNA changed or altered and remained viable, and even reproduced. We're not talking natural selection... that's not really evolution.
> There are species living with the eye in what we
>could term mid-step of evolution.
two problems there, one is *could* term mid-step, meaning there is still some doubt. Two, why isn't there a progression of steps, instead of concrete, finite distinctions? For that matter, how can we classify species under evolution? There should be sooo many variations and grades between species that one couldn't say for sure. According to Evolution, our classification should be more like:
"This species is 40% this and and 30% that and 1% this..."
If you look at *all* the facts, evolution takes just as much faith as creation. maybe more. There is also significant scientific proof for creation. As you say:
"it's happening in front of our eyes, for those who are willing to look."
>What, so we just sprang into being because of
> some divine influence? And that makes *more*
>sense? Give me a break.
hmm, well... yes. It does make more sense. Much
more sense than saying that we are a freak of nature.
Then again, looking at some people around here...
This looks pretty impressive so far. Java is slow as ever, but hopefully the full release will speed things up. This may even be better than NetBeans, although NetBeans is free for tinkerers.
IBM - Consider making this free unless a product is sold that was built using VA ?!?!?
Thank you! At least one other person caught that! :)
We use apcupsd. If the power goes out it calls a little bash script that sends email to my pager. Very simple, actually.
Care to give me a little more to work with? :)
HIT.net maybe?
Of course you never do lose power to your server because you are using a UPS, right?!?!? :)
:)
The way things run around here, I have the system page me when the power fails, and then shuts down normally. I like to be there before it boots up again, because I almost certainly have not got the bootup scripts correct to bring it online perfectly. Having it not power on would be a "feature" for me.
Maybe this category could cause a special rating of -2 ? This page looks obscene.
An easy way to fix this: Have the ISP customers sign an agreement in which they asume responibility for information they post, and absolve the ISP of liability.
But really... how in the heck is a large ISP supposed to enforce controls on all the content on its server? As someone else said, we might as well have the Post Office open and scan every letter for infringements and such. Bye bye privacy!