Apple Browsing Share Tops Linux, Android Steals Share Everywhere (PC World)

PC World - More people browsed the Internet last month with a device running Apple's mobile operating system, iOS, than used Linux to do so. That's a first for Apple, according to NetMarketShare, a firm that produces metrics on the market share of browsers, operating systems and search engines.

Categories: News | Technology | Technology News | Yahoo News | Yahoo News Technology

Subversion Migration Complete

The migration from CVS to Subversion is complete. The web interface is at svn.php.net. You can read about it at php.net/svn.php, wiki.php.net/vcs/svnfaq. The URL to feed to your svn client is http://svn.php.net/repository. There is also a github mirror. Please use that instead of trying to do a full git clone from the svn repository. See the instructions at wiki.php.net/vcs/svnfaq#git Many thanks to Gwynne who did the bulk of the work and also all the other folks who pitched in. It was a major effort to move 14 years of CVS history to another RCS.

Categories: Computers | PHP | PHP Hypertext Preprocessor | Programming | Technology

CodeSOD: Role-based Canary

Role-based security requires, at a minimum, two key elements: users and roles. Roles (such as Administrator, Clerk, and ViewOnlyUser) are defined by the application code and then assigned to users to restrict which functions of the application they may use. It's a pretty simple concept that involves all of two database tables, or one if the user names come from some external source like Active Directory.

In Adam's case, the Role-based security feature served as a coalmine canary in the application he was tasked with reviewing. Although it passed all of the test cases — employees could only do certain things, customers could do other things, etc. — there was one fundamental flaw with the system. See if you can spot it.

public bool IsInRole(string roleName)
{
   return UserName.StartsWith(roleName.Substring(0, 3));
}

The roleName parameter is a string ("Employee") that's is passed in from a method to check security, and UserName is just that: it's the user's name. So, users with a name that started with "Emp" would be granted access to Employee functions, while no one else would. And why "Emp"? As it turned out, the user names created for testing were "Employee1", "Employee2", "Employee3", and so on.

As for the rest of the system, it's development was similar: it passed the test cases and little more.

Categories: Computer Humor | Computers | Humor | Programming | Technology | The Daily WTF

Chrome Browser Updated After Two Years of Growth (NewsFactor)

NewsFactor - Google's Chrome browser is now two years old, and the youngster -- and its proud parent -- are celebrating its steady rise in popularity. According to Net Applications, Chrome had 7.5 percent of the browser market in August -- putting it in third place behind Microsoft's Internet Explorer and Mozilla's Firefox, and above Apple's Safari.

Categories: News | Technology | Technology News | Yahoo News | Yahoo News Technology

Error'd: CAPTCHA'd

What's that, you say? We should have an entire Error'd dedicated to CAPTCHA images? Sure, why not!

---

Alex van Herwijnen spotted this interesting problem presented...

 

... which, of course Dan Ferrante noticed that ESPN provided a solution for.

 

You're right though, spousal abuse is not funny. But I know what is! Bathroom humor, like what Scott Lewis found at Ticketmaster!

 

See? Even Avast! anti-virus software is getting a peece of that action (from Viront).

 

"Really?" Justin Self wrote, "I have to type this? I just needed some help with Java!"

 

Well Justin, help was out there... but not for your Java. Matt found this combo, which seems to help with the previous pain in the butt.

 

I guess I'll take the advice that Tim Gourley saw, at keep it clean from now on.

 

Moving on, Andy wondered if Bloglines really wanted their CAPTCHA to be linked to the KKK.

 

"Admittedly, this took me a lot longer to solve than usual," wrote Dan Thompson, "but when I finally got to upload my image, I felt a real sense of achievement."

 

Categories: Computer Humor | Computers | Humor | Programming | Technology | The Daily WTF

Error'd: Logon-ing Off

Andrew Carpenter writes, "I guess this is like turn-oning off a switch?"

 

"While trying to signup for a Windows Live account, I found myself without my best friend Neil," wrote Rob, "unfortunately, my second-best friend Ray, third-best friend Jane, and fourth-best friend Tom are also excluded."

 

"I got this rather odd message when trying to install the Evo Java client," wrote Nick Edwards, "I clicked OK and it worked... even though I wasn't SURE_IT_WORKS!"

 

"I'm not sure why Google would omit entries and return zero results," Michael noted, "clicking on the link, I received 0 omitted results which were indeed very similar."

 

"YUM!! Blank Insert bear claws," wrote Matthew Sowders

 

"This came up while configuring Neverwinter Nights on my PC," Ville Rastas writes, "I was worried the game might not support today's high resolution screens, but I guess it's quite the opposite."

 

"I knew IKEA has some funny names on it's furniture," writes Patrik, "but who knew they were into the new fashion trend of nerd chic?

 

"According to Virgin Mobile," writes Glenn Jones, "Unlimited is twice as big as 10G (so maybe around 20G), except for videos where Unlimited is only 1.3 times 10G."

 

Categories: Computer Humor | Computers | Humor | Programming | Technology | The Daily WTF

Disk Storage Still Bouncing Back, IDC Says (PC World)

PC World - The market for enterprise disk storage systems grew strongly in the second quarter, continuing to recover from a slump brought on by the economic slowdown of 2008 and 2009, research company IDC said on Friday.

Categories: News | Technology | Technology News | Yahoo News | Yahoo News Technology

Fast Fix

"Do you think it's wise to have consultants running our IT department?" Holger asked. It was an honest question, worded as diplomatically as possible. Holger's company had more consultants on hand than actual IT staff.

"Holger, these folks are experts," his manager replied. "It isn't cost effective to hire-on this level of expertise full time. We may pay a little more up front, but when we don't need the consultants anymore, we can hand it off to our internal people."

Holger left that discussion pretty sure he had just been called incompetent. Maybe I should ask the consultants if they're hiring, Holger wondered to himself, thinking of the big money they pulled down relative to his salary. The thought was still percolating in his head when he sat down with the two newest consultants, Zack and Jack for their status meeting.

Holger hooked his laptop up to the projector and ran through a few recent changes in the configuration database, discussed the implications, and then moved onto other topics. He stopped paying attention to the computer, and it eventually dropped to its screensaver. Moments later, there was some snickering from Zack.

"Having some computer trouble?" Jack asked, mockery in his tone.

Holger glanced at the projection screen and saw that his screensaver was was running merrily. It merrily painted a BSOD to the screen, with plausible driver dumps, merrily churned the disk a little, like it was saving the contents of RAM, and merrily ran through a simulated reboot sequence. After which, the process repeated itself, merrily. "Oh," Holger said, "that happens sometimes. I've got it under control. No worries."

"Yeah, whatever," Jack said. The meeting continued.

The product of the meeting, like too many other meetings with consultants, resulted in the need for another meeting. "Let's see what my calendar looks like," Holger said. He grabbed the mouse, killed the screensaver, and called up his email client.

Zack gasped. "How did you do that?" Jack marveled.

"Oh, that?" Holger said. With his best deadpan, he said, "I got tired of waiting for the reboots to complete. I put together a tool that does an automatic fix and restart, letting me just continue right from where I left off."

Holger waited a beat. After a moment, he was certain that these consultants would realize he was pulling their leg.

Zack was up in a flash and quietly closed the door. Jack leaned across the table towards Holger and asked, "Did you make that on company time? And does anyone here know if you did? Because before we go back into that hallway, I want to buy this off of you."

"You don't have that kind of cash," Holger said.

"No, but I can put it on the expense account and then pay it off when I get VC funding," Jack said.

Holger spent the next fifteen minutes declining their offers to buy his tool. In the process, he discovered that the consultants had creative and unethical ideas about how to quickly get funding, and that one of them had a trophy wife that would do anything for the kinds of profits they were talking about. "And I do mean anything," Zack said with a leer.

Finally, Holger "confessed". "Look, you guys are generous and all, but I've already signed a contract with another company. Even if you could beat their offer, I can't break a contract."

"Sure you can!"

Holger left the meeting without any interest in finding out if their company had any openings.

Categories: Computer Humor | Computers | Humor | Programming | Technology | The Daily WTF

PHP 5.3.3 Released!

The PHP development team would like to announce the immediate availability of PHP 5.3.3. This release focuses on improving the stability and security of the PHP 5.3.x branch with over 100 bug fixes, some of which are security related. All users are encouraged to upgrade to this release. Backwards incompatible change:Methods with the same name as the last element of a namespaced class name will no longer be treated as constructor. This change doesn't affect non-namespaced classes. There is no impact on migration from 5.2.x because namespaces were only introduced in PHP 5.3.Security Enhancements and Fixes in PHP 5.3.3:Rewrote var_export() to use smart_str rather than output buffering, prevents data disclosure if a fatal error occurs (CVE-2010-2531).Fixed a possible resource destruction issues in shm_put_var().Fixed a possible information leak because of interruption of XOR operator.Fixed a possible memory corruption because of unexpected call-time pass by refernce and following memory clobbering through callbacks.Fixed a possible memory corruption in ArrayObject::uasort().Fixed a possible memory corruption in parse_str().Fixed a possible memory corruption in pack().Fixed a possible memory corruption in substr_replace().Fixed a possible memory corruption in addcslashes().Fixed a possible stack exhaustion inside fnmatch().Fixed a possible dechunking filter buffer overflow.Fixed a possible arbitrary memory access inside sqlite extension.Fixed string format validation inside phar extension.Fixed handling of session variable serialization on certain prefix characters.Fixed a NULL pointer dereference when processing invalid XML-RPC requests (Fixes CVE-2010-0397, bug #51288).Fixed SplObjectStorage unserialization problems (CVE-2010-2225).Fixed possible buffer overflows in mysqlnd_list_fields, mysqlnd_change_user.Fixed possible buffer overflows when handling error packets in mysqlnd.Key enhancements in PHP 5.3.3 include:Upgraded bundled sqlite to version 3.6.23.1.Upgraded bundled PCRE to version 8.02.Added FastCGI Process Manager (FPM) SAPI.Added stream filter support to mcrypt extension.Added full_special_chars filter to ext/filter.Fixed a possible crash because of recursive GC invocation.Fixed bug #52238 (Crash when an Exception occured in iterator_to_array).Fixed bug #52041 (Memory leak when writing on uninitialized variable returned from function).Fixed bug #52060 (Memory leak when passing a closure to method_exists()).Fixed bug #52001 (Memory allocation problems after using variable variables).Fixed bug #51723 (Content-length header is limited to 32bit integer with Apache2 on Windows).Fixed bug #48930 (__COMPILER_HALT_OFFSET__ incorrect in PHP >= 5.3). For users upgrading from PHP 5.2 there is a migration guide available on http://php.net/migration53, detailing the changes between those releases and PHP 5.3. For a full list of changes in PHP 5.3.3, see the ChangeLog.

Categories: Computers | PHP | PHP Hypertext Preprocessor | Programming | Technology

PHP 5.2.12 Released!

The PHP development team would like to announce the immediate availability of PHP 5.2.12. This release focuses on improving the stability of the PHP 5.2.x branch with over 60 bug fixes, some of which are security related. All users of PHP 5.2 are encouraged to upgrade to this release. Security Enhancements and Fixes in PHP 5.2.12:Fixed a safe_mode bypass in tempnam() identified by Grzegorz Stachowiak. (CVE-2009-3557, Rasmus)Fixed a open_basedir bypass in posix_mkfifo() identified by Grzegorz Stachowiak. (CVE-2009-3558, Rasmus)Added "max_file_uploads" INI directive, which can be set to limit the number of file uploads per-request to 20 by default, to prevent possible DOS via temporary file exhaustion, identified by Bogdan Calin. (CVE-2009-4017, Ilia)Added protection for $_SESSION from interrupt corruption and improved "session.save_path" check, identified by Stefan Esser. (CVE-2009-4143, Stas)Fixed bug #49785 (insufficient input string validation of htmlspecialchars()). (CVE-2009-4142, Moriyoshi, hello at iwamot dot com) Further details about the PHP 5.2.12 release can be found in the release announcement, and the full list of changes are available in the ChangeLog.

Categories: Computers | PHP | PHP Hypertext Preprocessor | Programming | Technology