4 ms·

Yup. My bad. I started trying to figure out when it was by when I was at college, how long I did the PhD for, how long I was in the first job, how long into th

Yup. My bad. I started trying to figure out when it was by when I was at college, how long I did the PhD for, how long I was in the first job, how long into the second job I started using it and I screwed up the maths along the way. It was in 1996, not 1981... No excuses, that's just bad.

DonHopkins 6y ago
You also said you wrote the asset management system that was used by Lucasfilm on Star Wars, which was released in 1977. Are you sure you don't mean one of the later J. J. Abrams films, and not the film whose title was actually "Star Wars"? Mistakes about dates and context aside, I still can't believe you're actually trying to make excuses for mysql_real_escape_string. It has the word "real" in it. I mean, come on, who would ever name a function "real", and why? That implies the existance of a not-so-real mysql escape string function. Why didn't they simply FIX the gaping security hole in the not-so-real mysql escape string function, instead of maintaining one that was real that you should use, and one that was not so real that you should definitely not use, in the name of backwards compatibility? Or were there actually people out there using the non-real mysql escape string function, and they didn't want to ruffle their feathers by forcing those people with code that had a security hole so big you could fly a space shuttle through to fix their gaping security holes? The name of the function "mysql_real_escape_string" says all you need to know about the culture and carelessness and lack of security consciousness of the not-so-recent PHP community. And you shouldn't be making excuses for it, or blaming it on the wrong people for using it, instead of the right people for creating it then evangelizing it then not fixing it. It was a TERRIBLE mistake. The crappy code was PHP itself, and the code was crappy because the culture was crappy. I'm not going to start linking to all the anti-intellectual Rasmus quotes, or to the bug report about the time he checked in huge security regression to the crypto code that would have been caught by the tests, and then CUT A RELEASE, but didn't bother running the tests first because they produced so many errors. But you can google that debacle yourself.
- spacedcowboy 6y ago
  Well, it was episode I, which of course was the 4th film.
  - DonHopkins 6y ago
    It's not which verion of Star Wars you worked on in what year, it's that you're choosing to defend mysql_real_escape_string, and the culture that produced and maintained and evangelized it. What you've so brilliantly and unwittingly illustrated here is that PEOPLE MAKE MISTAKES. And that contradicts your argument that attempts to shift the blame for PHP's footguns like mysql_real_escape_string onto "crappy coders" instead of the culture and designers of PHP itself. People love to use that argument the self-aggrandize themselves, claiming they're too smart to make those mistakes, and only crappy inexperienced coders do that, so it's not a problem. But PHP has always been widely evangelized to inexperienced coders, foot-guns and all. Yes it DOES make a difference if a language is full of foot-guns, and the culture and developers around it don't give a shit (and don't bother running tests before checking in buggy changes to crypto functions before making a release) because they think they're too hot-shot to aim the foot-guns they designed and loaded at their own feet, then go around evangelizing their language to inexperienced crappy programmers. https://www.php.net/archive/2011.php#id2011-08-22-1 https://www.php.net/archive/2011.php#id2011-08-22-1 5.3.7 upgrade warning [22-Aug-2011] Due to unfortunate issues with 5.3.7 (see bug#55439) users should postpone upgrading until 5.3.8 is released (expected in a few days). https://bugs.php.net/bug.php?id=55439 https://bugs.php.net/bug.php?id=55439 Bug #55439 crypt() returns only the salt for MD5 https://news.ycombinator.com/item?id=2912678 https://news.ycombinator.com/item?id=2912678 Do not upgrade to PHP 5.3.7 due to a bug in crypt() (php.net) https://news.ycombinator.com/item?id=2913310 https://news.ycombinator.com/item?id=2913310 dramaticus3 on Aug 22, 2011 | parent | favorite | on: Do not upgrade to PHP 5.3.7 due to a bug in crypt(... Get ready for some WTF-ery Crypt takes an optional salt. If that value is an MD5 hash it is prefixed with the chars $1$ to tell the underlying crypt(3) function to use Modular Crypt Format[1]. MCF is an ad-hoc cruft because the orginal crypt() is weak. Anyway guess who did it : "let's use strlcpy/strlcat instead for these static string copies" - Rasmus I guess that's Lerdorf himself Whoever it was also didn't check the return values for error. Strlcat returns the length of the new string which might not be the same as strlen(dst) + strlen(src). "I'm not a real programmer. I throw together things until it works then I move on." - Rasmus Lerdorf Here's where he broke it : Sun Aug 7 16:10:34 2011 UTC http://svn.php.net/viewvc/php/php-src/trunk/ext/standard/php_crypt_r.c?sortdir=down&r1=313615&r2=314434&sortby=date http://svn.php.net/viewvc/php/php-src/trunk/ext/standard/php... Here's it being fixed : Fri Aug 19 22:49:18 2011 UTC http://svn.php.net/viewvc/php/php-src/trunk/ext/standard/php_crypt_r.c?sortdir=down&r1=314438&r2=315218&sortby=date http://svn.php.net/viewvc/php/php-src/trunk/ext/standard/php... [1] http://packages.python.org/passlib/modular_crypt_format.html http://packages.python.org/passlib/modular_crypt_format.html rll on Aug 22, 2011 [–] If you have never broken anything you have probably never built anything. dramaticus3 on Aug 22, 2011 [–] The project leader. Tests, I'm in charge, I don't test. dangrossman on Aug 22, 2011 [–] This code had a unit test, and it failed after the change as expected: http://gcov.php.net/viewer.php?version=PHP_5_3&func=tests&file=ext%2Fstandard%2Ftests%2Fstrings%2Fcrypt.phpt http://gcov.php.net/viewer.php?version=PHP_5_3&func=tests&fi...
- chipotle_coyote 6y ago
  > I mean, come on, who would ever name a function "real", and why? While that's a great question, the answer is "not the people who wrote PHP": https://dev.mysql.com/doc/refman/5.5/en/mysql-real-escape-string.html https://dev.mysql.com/doc/refman/5.5/en/mysql-real-escape-st... PHP has its issues (boy howdy), but sometimes those issues are being propagated from other places. Also, I'm gonna (very gently) push back on "evangelizing it then not fixing it," at least with respect to this particular boy howdy issue. PHP may have been late to get on board with bindings and basic DB abstraction, but they've had PDO since 2004. There are a lot of things like this in PHP -- big problems with its original conception/implementation that have been tackled in later iterations of the language, but that people seemingly won't forgive either because they're offended the sins were committed in the first place or because PHP preserves the stupid ways to do things for years and years in the name of backward compatibility. (I mean, I don't want to overstate anything here. PHP basically started out as a cargo cult version of Perl, and the PHP community collectively decided a few years ago that the proper thing to do to move the language forward was to turn it into a cargo cult version of Java which seems, well, debatable.)

DonHopkins 6y ago

You also said you wrote the asset management system that was used by Lucasfilm on Star Wars, which was released in 1977. Are you sure you don't mean one of the later J. J. Abrams films, and not the film whose title was actually "Star Wars"? Mistakes about dates and context aside, I still can't believe you're actually trying to make excuses for mysql_real_escape_string. It has the word "real" in it. I mean, come on, who would ever name a function "real", and why? That implies the existance of a not-so-real mysql escape string function. Why didn't they simply FIX the gaping security hole in the not-so-real mysql escape string function, instead of maintaining one that was real that you should use, and one that was not so real that you should definitely not use, in the name of backwards compatibility? Or were there actually people out there using the non-real mysql escape string function, and they didn't want to ruffle their feathers by forcing those people with code that had a security hole so big you could fly a space shuttle through to fix their gaping security holes? The name of the function "mysql_real_escape_string" says all you need to know about the culture and carelessness and lack of security consciousness of the not-so-recent PHP community. And you shouldn't be making excuses for it, or blaming it on the wrong people for using it, instead of the right people for creating it then evangelizing it then not fixing it. It was a TERRIBLE mistake. The crappy code was PHP itself, and the code was crappy because the culture was crappy. I'm not going to start linking to all the anti-intellectual Rasmus quotes, or to the bug report about the time he checked in huge security regression to the crypto code that would have been caught by the tests, and then CUT A RELEASE, but didn't bother running the tests first because they produced so many errors. But you can google that debacle yourself.

spacedcowboy 6y ago
Well, it was episode I, which of course was the 4th film.
- DonHopkins 6y ago
  It's not which verion of Star Wars you worked on in what year, it's that you're choosing to defend mysql_real_escape_string, and the culture that produced and maintained and evangelized it. What you've so brilliantly and unwittingly illustrated here is that PEOPLE MAKE MISTAKES. And that contradicts your argument that attempts to shift the blame for PHP's footguns like mysql_real_escape_string onto "crappy coders" instead of the culture and designers of PHP itself. People love to use that argument the self-aggrandize themselves, claiming they're too smart to make those mistakes, and only crappy inexperienced coders do that, so it's not a problem. But PHP has always been widely evangelized to inexperienced coders, foot-guns and all. Yes it DOES make a difference if a language is full of foot-guns, and the culture and developers around it don't give a shit (and don't bother running tests before checking in buggy changes to crypto functions before making a release) because they think they're too hot-shot to aim the foot-guns they designed and loaded at their own feet, then go around evangelizing their language to inexperienced crappy programmers. https://www.php.net/archive/2011.php#id2011-08-22-1 https://www.php.net/archive/2011.php#id2011-08-22-1 5.3.7 upgrade warning [22-Aug-2011] Due to unfortunate issues with 5.3.7 (see bug#55439) users should postpone upgrading until 5.3.8 is released (expected in a few days). https://bugs.php.net/bug.php?id=55439 https://bugs.php.net/bug.php?id=55439 Bug #55439 crypt() returns only the salt for MD5 https://news.ycombinator.com/item?id=2912678 https://news.ycombinator.com/item?id=2912678 Do not upgrade to PHP 5.3.7 due to a bug in crypt() (php.net) https://news.ycombinator.com/item?id=2913310 https://news.ycombinator.com/item?id=2913310 dramaticus3 on Aug 22, 2011 | parent | favorite | on: Do not upgrade to PHP 5.3.7 due to a bug in crypt(... Get ready for some WTF-ery Crypt takes an optional salt. If that value is an MD5 hash it is prefixed with the chars $1$ to tell the underlying crypt(3) function to use Modular Crypt Format[1]. MCF is an ad-hoc cruft because the orginal crypt() is weak. Anyway guess who did it : "let's use strlcpy/strlcat instead for these static string copies" - Rasmus I guess that's Lerdorf himself Whoever it was also didn't check the return values for error. Strlcat returns the length of the new string which might not be the same as strlen(dst) + strlen(src). "I'm not a real programmer. I throw together things until it works then I move on." - Rasmus Lerdorf Here's where he broke it : Sun Aug 7 16:10:34 2011 UTC http://svn.php.net/viewvc/php/php-src/trunk/ext/standard/php_crypt_r.c?sortdir=down&r1=313615&r2=314434&sortby=date http://svn.php.net/viewvc/php/php-src/trunk/ext/standard/php... Here's it being fixed : Fri Aug 19 22:49:18 2011 UTC http://svn.php.net/viewvc/php/php-src/trunk/ext/standard/php_crypt_r.c?sortdir=down&r1=314438&r2=315218&sortby=date http://svn.php.net/viewvc/php/php-src/trunk/ext/standard/php... [1] http://packages.python.org/passlib/modular_crypt_format.html http://packages.python.org/passlib/modular_crypt_format.html rll on Aug 22, 2011 [–] If you have never broken anything you have probably never built anything. dramaticus3 on Aug 22, 2011 [–] The project leader. Tests, I'm in charge, I don't test. dangrossman on Aug 22, 2011 [–] This code had a unit test, and it failed after the change as expected: http://gcov.php.net/viewer.php?version=PHP_5_3&func=tests&file=ext%2Fstandard%2Ftests%2Fstrings%2Fcrypt.phpt http://gcov.php.net/viewer.php?version=PHP_5_3&func=tests&fi...
chipotle_coyote 6y ago
> I mean, come on, who would ever name a function "real", and why? While that's a great question, the answer is "not the people who wrote PHP": https://dev.mysql.com/doc/refman/5.5/en/mysql-real-escape-string.html https://dev.mysql.com/doc/refman/5.5/en/mysql-real-escape-st... PHP has its issues (boy howdy), but sometimes those issues are being propagated from other places. Also, I'm gonna (very gently) push back on "evangelizing it then not fixing it," at least with respect to this particular boy howdy issue. PHP may have been late to get on board with bindings and basic DB abstraction, but they've had PDO since 2004. There are a lot of things like this in PHP -- big problems with its original conception/implementation that have been tackled in later iterations of the language, but that people seemingly won't forgive either because they're offended the sins were committed in the first place or because PHP preserves the stupid ways to do things for years and years in the name of backward compatibility. (I mean, I don't want to overstate anything here. PHP basically started out as a cargo cult version of Perl, and the PHP community collectively decided a few years ago that the proper thing to do to move the language forward was to turn it into a cargo cult version of Java which seems, well, debatable.)