4 ms·

Hi guys, Netanel Rubin here. First of, I'm not a Pythonist. Python has nothing to do with the faults of Perl - Perl does. Perl was a great language back at th

Hi guys, Netanel Rubin here. First of, I'm not a Pythonist. Python has nothing to do with the faults of Perl - Perl does. Perl was a great language back at the 90's and early 2000 - it doesn't now. That is mainly because of the 'write-only' code style and many not-that-intuitive behaviors other languages practice better. It is true that my talk was based on bad programming practices, but that's the practices actually used in the wild - in Bugzilla, TWiki, MovableType, and I haven't even started talking about what cPanel developers did. So, if 99% of programmers doesn't use the language properly, who's fault is that? A company needs to provide its costumers with a working, intuitive product. So is a programming language. If so many people doesn't know how to use it properly, I'm sorry, but it's the language fault. Another thing pointed out is prepare(). Yes, you can use it, no SQLIs there. BUT, this has nothing to do with the point. The point is that list expansion behavior in function calls is a problem most programmers weren't aware of. These are some code sections used at Bugzilla 4.4.6 (fully patched as of 30/12/2014) at different places: $attachment->_check_content_type($cgi->param('content_type')); $cgi->uploadInfo($cgi->param('data'))->{'Content-Type'}; IsValidQueryType($cgi->param('query_type')) And it also has 2 different quote() occurrences: $dbh->quote($cgi->param('requester')); $dbh->quote($cgi->param('requestee')); Now, I'm not saying all of those leads to a vulnerability, but as you can see there's a very visible trend here. Did all of those programmers and maintainers never read the tutorial for the language? Or did the language documentation confused them to the point they simply weren't aware of this behavior? From a personal perspective of one that did try to figure out what's going on with lists I can definitely say that this behavior is documents - At several places, very differently. As a simple example go back to my slides and look at the CGI documentation screen shot. VERY confusing, and honestly, just false. As for the attitude, I do apologize for everyone offended by the young douchebag that attacked your language. But, as recent vulnerabilities showed us, without a proper show no one's gonna notice you and your point, important as it may be. So, yes, I added a couple of funny images and built a momentum for a punch line, but otherwise this talk wouldn't have got the buzz it's getting right now and programmers would've still be blind to this behaviors, as sad as it may be. For an ending note, I do believe Perl has done it course, especially for large, maintained systems such as Bugzilla and cPanel. It may be the end of an era, but who said this is such a bad thing? Thank you for your comments (positive or negative) and for reading this.

laumars 12y ago
Your logic is completely broken though. You're looking at projects written back when the only real competitor to Perl was classic ASP (PHP was still in it's infancy) and then saying that Perl as a language is terrible because you're too lazy to look at all the modern frameworks that have been added since then (have you even heard of mod_perl, Mojolicious, Dancer or Catalyst? All of them do away with CGI) Yes, there are some bad Perl programmers, but there are bad programmers in every language. If someone missuses pointers in C/C++, you blame the developer. Or if someone cocks up the whitespacing in Python, you'd blame the developer. Of course the buck stops at the developer - he is the guy writing the code to begin with. Who else are you going to blame if someone writes bad code? Lists aside, ironically Perl has better type safety than many other loosely typed languages due to the lack of operator overloading - thus avoiding the often overlooked triple character operators (eg ===, !==, etc). So while Perl (like any language) does have it's hidden traps, it also has protection against hidden traps that other languages exhibit. However you conveniently overlook this when ranting about how poor Perl's type system is. The problem here is that you clearly have some deep seated prejudice against Perl and it's caused you to create a presentation that's, at best, rude, but realistically it's just down right ignorant flamebait. If you really cared half as much about good programming practices and secure web applications as you make out, then half your presentation would have been explaining how to avoid those pitfalls you demonstrated, instead of smugly shrugging whenever the question was raised. And since you continually explained how "shit" Perl is, you could have also demonstrated the equivalent features in other languages which are safe (the problem here is that examples you'd given would have been bad practice in any programming language - as has been discussed on here already). This is why you're receiving so many negative comments, both from HN, Youtube commenters and even half your peers in the audience that day. Hopefully the next time you decide to give a presentation, you will put your personal feelings aside and can give a more up-to-date, balanced and better researched talk.
zzzcpan 12y ago
> list expansion behavior in function calls is a problem most programmers weren't aware of. Actually, what lists do in list context is one thing every Perl programmer knows. You cannot go too far without it in Perl.

laumars 12y ago

Your logic is completely broken though. You're looking at projects written back when the only real competitor to Perl was classic ASP (PHP was still in it's infancy) and then saying that Perl as a language is terrible because you're too lazy to look at all the modern frameworks that have been added since then (have you even heard of mod_perl, Mojolicious, Dancer or Catalyst? All of them do away with CGI) Yes, there are some bad Perl programmers, but there are bad programmers in every language. If someone missuses pointers in C/C++, you blame the developer. Or if someone cocks up the whitespacing in Python, you'd blame the developer. Of course the buck stops at the developer - he is the guy writing the code to begin with. Who else are you going to blame if someone writes bad code? Lists aside, ironically Perl has better type safety than many other loosely typed languages due to the lack of operator overloading - thus avoiding the often overlooked triple character operators (eg ===, !==, etc). So while Perl (like any language) does have it's hidden traps, it also has protection against hidden traps that other languages exhibit. However you conveniently overlook this when ranting about how poor Perl's type system is. The problem here is that you clearly have some deep seated prejudice against Perl and it's caused you to create a presentation that's, at best, rude, but realistically it's just down right ignorant flamebait. If you really cared half as much about good programming practices and secure web applications as you make out, then half your presentation would have been explaining how to avoid those pitfalls you demonstrated, instead of smugly shrugging whenever the question was raised. And since you continually explained how "shit" Perl is, you could have also demonstrated the equivalent features in other languages which are safe (the problem here is that examples you'd given would have been bad practice in any programming language - as has been discussed on here already). This is why you're receiving so many negative comments, both from HN, Youtube commenters and even half your peers in the audience that day. Hopefully the next time you decide to give a presentation, you will put your personal feelings aside and can give a more up-to-date, balanced and better researched talk.

zzzcpan 12y ago

> list expansion behavior in function calls is a problem most programmers weren't aware of. Actually, what lists do in list context is one thing every Perl programmer knows. You cannot go too far without it in Perl.