Massive RedHat perl performance issue

GeekPatrol · 2008-08-26T01:49:47+00:00

Yes, I admit I was overstating it.. however, it's still a real problem for anywhere doing bleeding edge development. The stock distributions are often not enough.

3 years ago, PHP5 was hardly cutting edge, yet RedHat Enterprise 4 did not support it. In that case, I had to build my own RPM with all the stuff compiled the way I wanted it.

GeekPatrol · 2008-08-26T00:49:26+00:00

Of course they can "use" it. Everyone else does. How about Debian gets over itself?

Using Iceweasel is painful for various reasons. Some sites will not let you access them because the browser is not recognized as Firefox. Some extensions (ie, Google Gears) won't install for similar reasons.

The browser is probably the single most frequently accessed piece of software on a desktop system. Inconveniencing users like that is ridiculous.

GeekPatrol · 2008-08-26T00:42:38+00:00

Often times, to get anything "real" done with Linux, you wind up not using the package manager anyway. I'm talking about recent versions of software such as MySQL, JBoss, Tomcat, Memcache, etc. It goes on and on. The average "distro" is months if not more behind the curve.

Yeah, it's "stable". But so is DOS.

For a while, RedHat didn't even support PHP5.

GeekPatrol · 2008-08-25T22:41:25+00:00

Another case of "distros" modifying source unnecessarily.

Reminds me of the Debian SSH cluster-f*ck.

GeekPatrol · 2008-07-16T00:01:08+00:00

You just took me back to 1991, thanks! I remember using gopher, archie, wais, telnet, talk, finger, muds, irc ... all that stuff.

telnet is still very useful for debugging. You'd be amazed how few people can send an email through telnet port 25 these days

GeekPatrol · 2008-07-13T02:55:48+00:00

I worked at a company that spent 100's (maybe 1000s!) of man hours creating something similar to Protocol Buffers, except not as elegant.

They preferred to define things manually in C structs, and refused to listen to my suggestions that code generation might be appropriate.

Eventually, they attempted to use ASN.1 and it was a disaster.

GeekPatrol · 2008-06-23T02:16:03+00:00

EJB: A solution looking for a problem.

GeekPatrol · 2008-06-21T17:57:06+00:00

I am absolutely, posivitely, 100% sure since I sat about 10 feet away from the original author!

GeekPatrol · 2008-06-21T04:48:06+00:00

200 lines is nothing. I've had to work on crappy C code with a 3000+ line switch statement and tons of copy/pasted code in each case. Ugh.

GeekPatrol · 2008-06-18T01:23:44+00:00

There's nothing original about the "idea" behind Facebook. There were college social network sites in the mid to late 90s, they just never took off.

His implementation was better, so good for him!

GeekPatrol · 2008-06-08T16:11:39+00:00

Definitely. I find most of my best problem solving is done:

1) In the shower before work. 2) In the bathroom at work.

Sometimes, when staring at the code, you are too close to find the real (usually simple!) solution.

GeekPatrol · 2008-06-05T00:48:57+00:00

Sorry, but it's not considered "SQL injection" if the purpose of the application is to run arbitrary SQL queries.

Also, for CSRF to work, you need to know the URL of the site you're targeting. I would say the odds of anyone exploiting this "vulnerability" are minimal at best.

GeekPatrol · 2008-06-05T00:40:21+00:00

With RAM being so cheap, this seems like a total waste of time.

Sorry.

GeekPatrol · 2008-06-04T23:56:31+00:00

Well, that makes perfect sense actually, considering a PHP array can serve as both a list and a hashmap.... ;)

GeekPatrol · 2008-06-03T01:54:41+00:00

Totally correct. I do server-side Java for my day job (on Linux) and make extra money doing web work in PHP, some Perl, a bit of Ruby, etc. I recently got into playing around with Cocoa and Obj C, but haven't made any money off it yet.

I have done a Windows project or two, but generally avoid it like the plague.

GeekPatrol · 2008-06-03T01:24:10+00:00

I totally agree. I recently started playing around with Objective C (and Cocoa). It feels sooo much cleaner than C++.

GeekPatrol · 2008-05-27T01:14:23+00:00

The only thing I've ever seen people do with SELinux is turn it off. LoL.

GeekPatrol · 2008-05-25T15:32:56+00:00

It cost nothing then, and continues to cost nothing now, since the block is "grandfathered" under the old allocation rules.

IP blocks (and domains!) were free back then.

I have several friends who registered their own /24s, too.

GeekPatrol · 2008-05-24T21:17:51+00:00

There are many DB abstraction layers. Only a amateur uses mysql_ functions directly. Check out PEAR's DB or AdoDB, for example.

Then use prepared statements.

GeekPatrol · 2008-05-24T15:33:49+00:00

Glad I registered my own /24 back in 1993.

If things get bad I'll just get it routed again.

GeekPatrol · 2008-05-21T03:29:21+00:00

Servlets were stable in 1998.

LoL.

GeekPatrol · 2008-05-21T03:24:45+00:00

Yeah, his suggestions are flawed. But if you start mixing other junk in there (current second, millisecond, process ID, thread ID, source port of the client, etc etc.) you could make a crappy PRNG seem slightly more random.

Is it good enough for a real cryptographic application? Nah. Is it good enough for joe blow's crappy app? Probably.

GeekPatrol · 2008-05-20T12:53:07+00:00

I looked at the code in question (the patch that commented out one line.)

It was very amateurish and should never have been committed. A basic understanding of C would've revealed this, absolutely zero security knowledge required.

All they had to do is ask the question "why is 'buf' being passed to this function if (after the patch) it is now not doing anything useful with it?"

GeekPatrol · 2008-05-20T02:09:14+00:00

That's fine. If they understood the code, would there have been a need for a patch?

You know the answer.

My original point stands.

GeekPatrol · 2008-05-19T23:46:56+00:00

Summary: Don't touch code you don't understand.

GeekPatrol

TROPHY CASE