6 ms·

I don't know much about Perl, but after seeing "The Perl Jam: Exploiting a 20-year old Vulnerability" from 31C3 it really doesn't feel like it's winning. You do

I don't know much about Perl, but after seeing "The Perl Jam: Exploiting a 20-year old Vulnerability" from 31C3 it really doesn't feel like it's winning. You don't need to know Perl to have a great time watching the talk (at least I didn't). https://www.youtube.com/watch?v=gweDBQ-9LuQ https://www.youtube.com/watch?v=gweDBQ-9LuQ --- I don't know if the talk is any good if you actually do know Perl.

chromatic 12y ago
Oh goodness, that's a terrible talk. I suppose the fact that someone can give such a talk in 2014 with apparent sincerity says something about the state of Perl, but that talk is more or less equivalent to saying "Look, I passed arbitrary user input to `unlink` and it deleted a file I didn't intend! How high up does this conspiracy go?!"
- lawl 12y ago
  Okay, I remember this talk, I'll try to write pseudo code for one of the real life bugs that nobody saw for 20 years (in Bugzilla that is, not some small script nobody knows). $user = new User({ userid => $foo, role => "user", username => cgi->param("username"), password => bcrypt(cgi->param("password")) }); If you're seriously telling me you instantly spot the bug (if that were real perl, i don't know perl) without having seen the talk before, then congratulations, nobody else did, please start auditing perl software. For anyone that didn't see the talk, no the bug isn't SQL injection or something like that (though that'd likely be possible too, watch the talk). If you pass ?username=foo&username=bar then cgi.param("username") will actually return a list ("foo", "bar"). Now say you pass a list of three elements ?username=foo&username=role&username=admin ... yes seriously. It'll add the list into the hash and use every %2 element as key and the other as value. allowing you to overwrite stuff in hashes. Of course, all of this is documented. But that doesn't make it not terrible. PS: I don't hate perl. Perl -e is still very handy sometimes.
  - alberich 12y ago
    well, you're supposed to validate user input before passing it to the function. I'm not sure this can be considered a bug.
  - chromatic 12y ago
    If you're seriously telling me you instantly spot the bug (if that were real perl, i don't know perl) without having seen the talk before, then congratulations, nobody else did, please start auditing perl software. I've fixed that bug in code as far back as 2000. There've been discussions on that anti-pattern on PerlMonks for at least a decade.
  - wschroed 12y ago
    I'll bite... I have been programming in Perl for the bioinformatics community for about seven years. I understand your code is pseudocode, but I should note that the "." is considered string concatenation in Perl. My very first thought before reading too carefully was that the bug was that someone tried to concatenate strings instead of calling functions. :) But I kept in mind that this was pseudocodish. Yes, my second thought was, "He says there is a bug here; I wonder if this is one of those cases where the function returns values in list context." For any experienced Perl programmer, this is a thing to be aware of, especially when calling functions in hash maps, not only because it may return multiple values but also because it may return NO values, which would match the "username" key with "password". We may debate the pros and cons of list context, but it is one of the first features I teach new hires because it can catch people accustomed to other languages by surprise. Perl is not the only language to support this kind of feature; it is present in Ruby with the "splat" operator (*array).
    - lawl 12y ago
      Sorry for the dot-confusion, i replaced it with "->". As I said, it may be documented and known in the perl community, in my option it's still horrible. But yes, that's just my opinion of course. > Perl is not the only language to support this kind of feature; it is present in Ruby with the "splat" operator (*array). Unfortunately I also don't know ruby, but as far as i understand from what you're saying is that in ruby you need to explicitly tell ruby to "splat" the list in. I really have problems coming up with usecases for this kind of behaviour, but yes, sure under some curcumstances it might be nice. But i'd argue it's the minority and so having to explicitly "whitelist" it would make sense. To avoid exactly this problem, of accidentaly calling a function that might return a list. The problem that I also see is that at some point you could refactor a function that previously couldn't return a list. Except maybe that's actually a thing in perl, to use this behaviour as a feature, I don't know.
lazyloop 12y ago
So you think sexism is cool? There's at least one slide in that talk with a very demeaning picture of a scantily clad woman at 6:55. https://www.youtube.com/watch?v=gweDBQ-9LuQ#t=417 https://www.youtube.com/watch?v=gweDBQ-9LuQ#t=417
- lazyloop 12y ago
  Of course this comment is getting downvoted into oblivion. The open source community has no problem with sexism... noooo sir.
  - deleted 12y ago
    [deleted]
  - danieldk 12y ago
    The problem is that you were attacking a straw man and I think that is what you are getting downvoted for. Yes, indeed, sexism in talks is bad. I stand with you to condemn it. Regardless, the talk could be good technically. (I didn't downvote you.)
  - teamhappy 12y ago
    Just in case somebody didn't watch the talk and thinks you actually got a point. She asked somebody to take a picture of her in a bikini lying in a puddle next to a road somewhere. The caption on the picture reads: "WAT" — which might just be the right question to ask in that situation. I take it you're upset that he made fun of two dudes and only one girl during his talk? Is that what we're upset about? Or do you want the asian guy to put on a bikini next time he takes his pig-themed scooter on a cruise? For what it's worth: I have it on good authority that most of the camels depicted in this talk are female. Take it easy. http://knowyourmeme.com/memes/wat http://knowyourmeme.com/memes/wat
droope 12y ago
Good talk!

chromatic 12y ago

Oh goodness, that's a terrible talk. I suppose the fact that someone can give such a talk in 2014 with apparent sincerity says something about the state of Perl, but that talk is more or less equivalent to saying "Look, I passed arbitrary user input to `unlink` and it deleted a file I didn't intend! How high up does this conspiracy go?!"

lawl 12y ago
Okay, I remember this talk, I'll try to write pseudo code for one of the real life bugs that nobody saw for 20 years (in Bugzilla that is, not some small script nobody knows). $user = new User({ userid => $foo, role => "user", username => cgi->param("username"), password => bcrypt(cgi->param("password")) }); If you're seriously telling me you instantly spot the bug (if that were real perl, i don't know perl) without having seen the talk before, then congratulations, nobody else did, please start auditing perl software. For anyone that didn't see the talk, no the bug isn't SQL injection or something like that (though that'd likely be possible too, watch the talk). If you pass ?username=foo&username=bar then cgi.param("username") will actually return a list ("foo", "bar"). Now say you pass a list of three elements ?username=foo&username=role&username=admin ... yes seriously. It'll add the list into the hash and use every %2 element as key and the other as value. allowing you to overwrite stuff in hashes. Of course, all of this is documented. But that doesn't make it not terrible. PS: I don't hate perl. Perl -e is still very handy sometimes.
- alberich 12y ago
  well, you're supposed to validate user input before passing it to the function. I'm not sure this can be considered a bug.
- chromatic 12y ago
  If you're seriously telling me you instantly spot the bug (if that were real perl, i don't know perl) without having seen the talk before, then congratulations, nobody else did, please start auditing perl software. I've fixed that bug in code as far back as 2000. There've been discussions on that anti-pattern on PerlMonks for at least a decade.
- wschroed 12y ago
  I'll bite... I have been programming in Perl for the bioinformatics community for about seven years. I understand your code is pseudocode, but I should note that the "." is considered string concatenation in Perl. My very first thought before reading too carefully was that the bug was that someone tried to concatenate strings instead of calling functions. :) But I kept in mind that this was pseudocodish. Yes, my second thought was, "He says there is a bug here; I wonder if this is one of those cases where the function returns values in list context." For any experienced Perl programmer, this is a thing to be aware of, especially when calling functions in hash maps, not only because it may return multiple values but also because it may return NO values, which would match the "username" key with "password". We may debate the pros and cons of list context, but it is one of the first features I teach new hires because it can catch people accustomed to other languages by surprise. Perl is not the only language to support this kind of feature; it is present in Ruby with the "splat" operator (*array).
  - lawl 12y ago
    Sorry for the dot-confusion, i replaced it with "->". As I said, it may be documented and known in the perl community, in my option it's still horrible. But yes, that's just my opinion of course. > Perl is not the only language to support this kind of feature; it is present in Ruby with the "splat" operator (*array). Unfortunately I also don't know ruby, but as far as i understand from what you're saying is that in ruby you need to explicitly tell ruby to "splat" the list in. I really have problems coming up with usecases for this kind of behaviour, but yes, sure under some curcumstances it might be nice. But i'd argue it's the minority and so having to explicitly "whitelist" it would make sense. To avoid exactly this problem, of accidentaly calling a function that might return a list. The problem that I also see is that at some point you could refactor a function that previously couldn't return a list. Except maybe that's actually a thing in perl, to use this behaviour as a feature, I don't know.

lazyloop 12y ago

So you think sexism is cool? There's at least one slide in that talk with a very demeaning picture of a scantily clad woman at 6:55. https://www.youtube.com/watch?v=gweDBQ-9LuQ#t=417 https://www.youtube.com/watch?v=gweDBQ-9LuQ#t=417

lazyloop 12y ago
Of course this comment is getting downvoted into oblivion. The open source community has no problem with sexism... noooo sir.
- deleted 12y ago
  [deleted]
- danieldk 12y ago
  The problem is that you were attacking a straw man and I think that is what you are getting downvoted for. Yes, indeed, sexism in talks is bad. I stand with you to condemn it. Regardless, the talk could be good technically. (I didn't downvote you.)
- teamhappy 12y ago
  Just in case somebody didn't watch the talk and thinks you actually got a point. She asked somebody to take a picture of her in a bikini lying in a puddle next to a road somewhere. The caption on the picture reads: "WAT" — which might just be the right question to ask in that situation. I take it you're upset that he made fun of two dudes and only one girl during his talk? Is that what we're upset about? Or do you want the asian guy to put on a bikini next time he takes his pig-themed scooter on a cruise? For what it's worth: I have it on good authority that most of the camels depicted in this talk are female. Take it easy. http://knowyourmeme.com/memes/wat http://knowyourmeme.com/memes/wat

droope 12y ago

Good talk!