6 ms·
Frick. A .pl CGI script on a production box? All the yapache & yphp security fixes and is all undone by a a .pl with +ExeCGI. They used to run "crack days" wh
by gopalv 12y ago
Frick. A .pl CGI script on a production box?
All the yapache & yphp security fixes and is all undone by a a .pl with +ExeCGI.
They used to run "crack days" where all of us used to get kicks out of breaking & entering prod, whatever means available.
Was a fun way to weed through such low-hanging issues, by a highly motivated (i.e otherwise bored) crowd.
I wonder if they still have them.
- discardorama 12y agoI think therein lies the problem: yapache. It's their own version of (modified) Apache. So when these bugs like shellshock come out, it's harder to patch your own home-grown version.
- jmathai 12y agoNot sure that's the problem though. yapache and yphp solve a very important need and probably saved Yahoo!'s ass on multiple occasions with engineers making lazy or common mistakes. There might have been a better way to implement it but with a company the size of Yahoo! I think they'd have the resources to maintain/patch such critical flaws. So the idea of a home-grown (really it's more of a patched version of apache / php than anything else) isn't entirely crazy. Just looks like this one slipped through the cracks.
- monokrome 12y agoThe idea of still using Apache / PHP nowadays is pretty crazy if you ask me.
- sudowhodoido 12y agoI could say the same about most of the supposed superior replacements. Everything is dangerous in the hands of idiots. The technology is almost entirely irrelevant to the discussion.
- jmulho 12y agoHalf the world must be crazy. What is better and why?
- currysausage 12y agoNginx, Node.js … and Twitter Bootstrap, obviously. (scnr)
- deleted 12y ago[deleted]
- ambrood 12y agoNobody was really working on yapache when I worked there around 2 years ago.
- nodata 12y agoWhat's wrong with a Perl CGI script?
- dTal 12y agoGolly. Who was this "they" and "all of us"?
- darkstar999 12y agoPeople who use the word "frick" or "frickin'".
- andrewflnr 12y agoI'm guessing GP once worked for Yahoo.
- jlgaddis 12y agoWhat's the issue with Perl scripts on production web servers? Probably 90% of my (homegrown) scripts are written in Perl. What does Perl vs. PHP vs. Ruby vs. $languageoftheweek have to do with anything?
- btown 12y agoIt's really just that Shellshock becomes viable only when HTTP headers are passed to your code as environment variables. For CGI, this is the way things are done, and most Perl scripts interact with the web server through CGI. On the other hand, Ruby and $languageoftheweek are usually called through a server framework like WSGI or Rack, which have their own ways of getting HTTP headers to the user code besides passing them as environment variables. Perl has PSGI ( plackperl.org ) but it's more commonly used in CGI.
- btilly 12y agoPerl has PSGI ( plackperl.org ) but it's more commonly used in CGI. Citation needed. I've been a serious Perl programmer since the 90s who has written public facing code at at least a half-dozen companies in the last decade. I've seen all kinds of combinations of things like mod_perl, fastcgi and Plack, but not once CGI. I don't doubt that there are still some toy websites that run old CGI programs written in Perl. But I haven't seen them in the wild. And that niche has been replaced by PHP.
- csirac2 12y agoI spent four years mostly on perl 2009-2012, and again briefly last year. The performance of any non-trivial perl web app is laughably bad when you run as CGI. I've never run prod systems without psgi or mod_fcgid.