[26226] in Perl-Users-Digest
Perl-Users Digest, Issue: 8411 Volume: 10
daemon@ATHENA.MIT.EDU (Perl-Users Digest)
Tue Sep 13 06:05:33 2005
Date: Tue, 13 Sep 2005 03:05:04 -0700 (PDT)
From: Perl-Users Digest <Perl-Users-Request@ruby.OCE.ORST.EDU>
To: Perl-Users@ruby.OCE.ORST.EDU (Perl-Users Digest)
Perl-Users Digest Tue, 13 Sep 2005 Volume: 10 Number: 8411
Today's topics:
Re: Can a Perl Programmer Pick up PHP quickly? <john@castleamber.com>
Re: Perldoc security issues <john@castleamber.com>
Re: Perldoc security issues <tadmc@augustmail.com>
Re: Perldoc security issues (Anno Siegel)
Posting Guidelines for comp.lang.perl.misc ($Revision: tadmc@augustmail.com
Re: SOLVED: "Text File Busy" And Other Frustrating NFS/ <jgibson@mail.arc.nasa.gov>
Re: sorting data - hash vs. list <tadmc@augustmail.com>
Digest Administrivia (Last modified: 6 Apr 01) (Perl-Users-Digest Admin)
----------------------------------------------------------------------
Date: 13 Sep 2005 01:25:11 GMT
From: John Bokma <john@castleamber.com>
Subject: Re: Can a Perl Programmer Pick up PHP quickly?
Message-Id: <Xns96CFCF98E19Bcastleamber@130.133.1.4>
nospam@geniegate.com wrote:
> In: <Xns96CF57E75B6AFcastleamber@130.133.1.4>, John Bokma
> <john@castleamber.com> wrote:
>>nospam@geniegate.com wrote:
>>
>>> Used to be you'd call a sub like this &subroutine() which is how I
>>> learned it.
>>
>>Then you didn't learn enough. You still set register globals to on?
>
> No. My point is, a lot of the perl docs from days gone by document
> perl subs as having a '&'. Now they don't.
Now they have when the side effect of it are required. And "days gone"
is over 10 years.
>>Nonsense. PHP is not easier compared to Perl. If you do serious things
>>in PHP you have to learn a lot. The thing is, most people use PHP for
>>small toy thingies.
>
> To design _software_ you need to learn a lot.
Yup
> To learn a language and JUST the language, PHP is easier. Sounds like
> you're talking about software design.
And sounds like you're talking about learning the syntax. Sure, one can
learn PHP syntax in a day or 2.
> I suppose it's rather like any human language, learning english
> doesn't mean it's easy to describe the components and interactions
> of a complex system.
So we are talking about syntax then. Learning the syntax of a language
is something I wouldn't call learning a language.
>>It's not even close to Java of 1995.
>
> Yea, I'd agree. PHP hasn't gotten that slow yet! :-)
Is that why you either have to buy stuff to speed it up (the commercial
part of PHP), or get a free version?
>>If there was an easy to learn programming language it would have been
>>in use for over 50 years by now. So why isn't there such a language?
>>Remember Java? Easier and "smarter" then C++. No more memory leaks
>>(sure), write once, run everywhere (sure). And have a peek at Java
>>now.
>
> Probably because easy languages, as you point out are really not that
> good.
I didn't say that. I doubt an easy programming language is possible. I
have done RISC (ARM) assembly language. The instruction set is extremely
orthogonal. Easy to learn? Well, you can learn all instructions in a
day. But programming in ARM easy? No.
> BASIC has been around for quite some time, as has REXX. Sure, they're
> easy (well, if you believe there are easy languages, they're easy) but
> they're very difficult to do any real work in, which is why you don't
> often see REXX being used to write video games.
I can only speak for BASIC, and I don't call BASIC an easy language. I
don't know any easy to learn programming languages. (Similar with human
languages btw).
--
John Small Perl scripts: http://johnbokma.com/perl/
Perl programmer available: http://castleamber.com/
Happy Customers: http://castleamber.com/testimonials.html
------------------------------
Date: 13 Sep 2005 01:27:37 GMT
From: John Bokma <john@castleamber.com>
Subject: Re: Perldoc security issues
Message-Id: <Xns96CFD002A2F63castleamber@130.133.1.4>
James Taylor <spam-block-@-SEE-MY-SIG.com> wrote:
> In article <Xns96CF585C89187castleamber@130.133.1.4>,
> John Bokma <john@castleamber.com> wrote:
>> Never fix input, like you do above.
>
> Never? What's the right way to tidy user input in this situation?
If it's unexpected input, don't fix it. It was wrong in the first place.
> Obviously, as I'm not getting paid by the hour, I'd like a
> lightweight solution; something I can knock up over lunch in a
> few lines of code, not an over-engineered solution involving
> multiple chunks of OPC.
It probably has been done before, I know there is at least one interface to
perldoc on line.
>> But don't do that with a regexp. Use a parser.
>
> Why use a sledgehammer when a nutcracker will do?
You misread my post: regexp will *not* do what you want. You asked for
security, you won't get that with a regexp (or several).
--
John Small Perl scripts: http://johnbokma.com/perl/
Perl programmer available: http://castleamber.com/
Happy Customers: http://castleamber.com/testimonials.html
------------------------------
Date: Mon, 12 Sep 2005 20:27:24 -0500
From: Tad McClellan <tadmc@augustmail.com>
Subject: Re: Perldoc security issues
Message-Id: <slrndicans.skd.tadmc@magna.augustmail.com>
James Taylor <spam-block-@-SEE-MY-SIG.com> wrote:
> I've created a very simple web-based perldoc interface that
> simply passes the options and arguments the user enters to
> perldoc via the shell, but before I release it I'd like to ask
> if anyone is aware of any security issues with perldoc that I
> should defend against. I know little about perldoc's many
> options or whether they are abusable and would really appreciate
> some pointers. For instance, it's not clear to me whether it
> would be possible to use some of perldoc's more esoteric options
> to write to another file, or execute another file even.
Then disallow any functions that you are wary of.
> Of course, there are shell related security issues too. Those
> that come to mind are semicolons, pipes, and i/o redirectors.
> I therefore remove most punctuation characters from the user
> input before passing it to the shell with a tr:
>
> $query =~ tr/- _A-Za-z0-9:"'//cd;
You should fail to run rather than repair input and then run.
You should specify what you will allow rather than what you will forbid.
> I have left colons so people can look up modules, and quote marks
> so people can quote phrases to look up in the FAQ. This should
> allow most of the common perldoc references given in this group
> to be looked up, but would exclude interesting regexes. However,
> if I can be a little less paranoid and allow more without
> sacrificing security that would be good too.
>
> Can anyone offer me general guidance?
if ( $ARGV[0] eq '-f' and $ARGV[1] =~ /^\w+$/ )
{ perldoc_f() }
}
elsif ( $ARGV[0] eq '-q' and
( $ARGV[1] =~ /^[\w ]+$/ or $ARGV[1] =~ /^(['"])[\w ]+\1$/ )
{ perldoc_q() }
}
elsif ( $ARGV[0] =~ /^(\w|::)+$/ ) {
perldoc();
}
else {
fail();
}
--
Tad McClellan SGML consulting
tadmc@augustmail.com Perl programming
Fort Worth, Texas
------------------------------
Date: 13 Sep 2005 09:51:23 GMT
From: anno4000@lublin.zrz.tu-berlin.de (Anno Siegel)
Subject: Re: Perldoc security issues
Message-Id: <dg67er$mda$1@mamenchi.zrz.TU-Berlin.DE>
James Taylor <spam-block-@-SEE-MY-SIG.com> wrote in comp.lang.perl.misc:
> In article <Xns96CF585C89187castleamber@130.133.1.4>,
> John Bokma <john@castleamber.com> wrote:
[security advice]
> Well, ideally I should just make it perfect, of course.
> I'm looking for a simple, minimally sufficient solution.
[advice]
> Pragmatic compromise is the way to go.
[advice]
> I'd like a lightweight solution; something I can knock up over lunch in a
[advice]
> Why use a sledgehammer when a nutcracker will do?
In view of this attitude one has to wonder why you asked about security
in the first place. You are obviously determined not to invest any more
effort than you already have. Answering was a waste of time.
Anno
--
If you want to post a followup via groups.google.com, don't use
the broken "Reply" link at the bottom of the article. Click on
"show options" at the top of the article, then click on the
"Reply" at the bottom of the article headers.
------------------------------
Date: 13 Sep 2005 07:22:40 GMT
From: tadmc@augustmail.com
Subject: Posting Guidelines for comp.lang.perl.misc ($Revision: 1.5 $)
Message-Id: <43267e3f$0$4859$8b463f8a@news.nationwide.net>
Outline
Before posting to comp.lang.perl.misc
Must
- Check the Perl Frequently Asked Questions (FAQ)
- Check the other standard Perl docs (*.pod)
Really Really Should
- Lurk for a while before posting
- Search a Usenet archive
If You Like
- Check Other Resources
Posting to comp.lang.perl.misc
Is there a better place to ask your question?
- Question should be about Perl, not about the application area
How to participate (post) in the clpmisc community
- Carefully choose the contents of your Subject header
- Use an effective followup style
- Speak Perl rather than English, when possible
- Ask perl to help you
- Do not re-type Perl code
- Provide enough information
- Do not provide too much information
- Do not post binaries, HTML, or MIME
Social faux pas to avoid
- Asking a Frequently Asked Question
- Asking a question easily answered by a cursory doc search
- Asking for emailed answers
- Beware of saying "doesn't work"
- Sending a "stealth" Cc copy
Be extra cautious when you get upset
- Count to ten before composing a followup when you are upset
- Count to ten after composing and before posting when you are upset
-----------------------------------------------------------------
Posting Guidelines for comp.lang.perl.misc ($Revision: 1.5 $)
This newsgroup, commonly called clpmisc, is a technical newsgroup
intended to be used for discussion of Perl related issues (except job
postings), whether it be comments or questions.
As you would expect, clpmisc discussions are usually very technical in
nature and there are conventions for conduct in technical newsgroups
going somewhat beyond those in non-technical newsgroups.
The article at:
http://www.catb.org/~esr/faqs/smart-questions.html
describes how to get answers from technical people in general.
This article describes things that you should, and should not, do to
increase your chances of getting an answer to your Perl question. It is
available in POD, HTML and plain text formats at:
http://mail.augustmail.com/~tadmc/clpmisc.shtml
For more information about netiquette in general, see the "Netiquette
Guidelines" at:
http://andrew2.andrew.cmu.edu/rfc/rfc1855.html
A note to newsgroup "regulars":
Do not use these guidelines as a "license to flame" or other
meanness. It is possible that a poster is unaware of things
discussed here. Give them the benefit of the doubt, and just
help them learn how to post, rather than assume
A note about technical terms used here:
In this document, we use words like "must" and "should" as
they're used in technical conversation (such as you will
encounter in this newsgroup). When we say that you *must* do
something, we mean that if you don't do that something, then
it's unlikely that you will benefit much from this group.
We're not bossing you around; we're making the point without
lots of words.
Do *NOT* send email to the maintainer of these guidelines. It will be
discarded unread. The guidelines belong to the newsgroup so all
discussion should appear in the newsgroup. I am just the secretary that
writes down the consensus of the group.
Before posting to comp.lang.perl.misc
Must
This section describes things that you *must* do before posting to
clpmisc, in order to maximize your chances of getting meaningful replies
to your inquiry and to avoid getting flamed for being lazy and trying to
have others do your work.
The perl distribution includes documentation that is copied to your hard
drive when you install perl. Also installed is a program for looking
things up in that (and other) documentation named 'perldoc'.
You should either find out where the docs got installed on your system,
or use perldoc to find them for you. Type "perldoc perldoc" to learn how
to use perldoc itself. Type "perldoc perl" to start reading Perl's
standard documentation.
Check the Perl Frequently Asked Questions (FAQ)
Checking the FAQ before posting is required in Big 8 newsgroups in
general, there is nothing clpmisc-specific about this requirement.
You are expected to do this in nearly all newsgroups.
You can use the "-q" switch with perldoc to do a word search of the
questions in the Perl FAQs.
Check the other standard Perl docs (*.pod)
The perl distribution comes with much more documentation than is
available for most other newsgroups, so in clpmisc you should also
see if you can find an answer in the other (non-FAQ) standard docs
before posting.
It is *not* required, or even expected, that you actually *read* all of
Perl's standard docs, only that you spend a few minutes searching them
before posting.
Try doing a word-search in the standard docs for some words/phrases
taken from your problem statement or from your very carefully worded
"Subject:" header.
Really Really Should
This section describes things that you *really should* do before posting
to clpmisc.
Lurk for a while before posting
This is very important and expected in all newsgroups. Lurking means
to monitor a newsgroup for a period to become familiar with local
customs. Each newsgroup has specific customs and rituals. Knowing
these before you participate will help avoid embarrassing social
situations. Consider yourself to be a foreigner at first!
Search a Usenet archive
There are tens of thousands of Perl programmers. It is very likely
that your question has already been asked (and answered). See if you
can find where it has already been answered.
One such searchable archive is:
http://groups.google.com/advanced_group_search
If You Like
This section describes things that you *can* do before posting to
clpmisc.
Check Other Resources
You may want to check in books or on web sites to see if you can
find the answer to your question.
But you need to consider the source of such information: there are a
lot of very poor Perl books and web sites, and several good ones
too, of course.
Posting to comp.lang.perl.misc
There can be 200 messages in clpmisc in a single day. Nobody is going to
read every article. They must decide somehow which articles they are
going to read, and which they will skip.
Your post is in competition with 199 other posts. You need to "win"
before a person who can help you will even read your question.
These sections describe how you can help keep your article from being
one of the "skipped" ones.
Is there a better place to ask your question?
Question should be about Perl, not about the application area
It can be difficult to separate out where your problem really is,
but you should make a conscious effort to post to the most
applicable newsgroup. That is, after all, where you are the most
likely to find the people who know how to answer your question.
Being able to "partition" a problem is an essential skill for
effectively troubleshooting programming problems. If you don't get
that right, you end up looking for answers in the wrong places.
It should be understood that you may not know that the root of your
problem is not Perl-related (the two most frequent ones are CGI and
Operating System related), so off-topic postings will happen from
time to time. Be gracious when someone helps you find a better place
to ask your question by pointing you to a more applicable newsgroup.
How to participate (post) in the clpmisc community
Carefully choose the contents of your Subject header
You have 40 precious characters of Subject to win out and be one of
the posts that gets read. Don't waste them. Take care while
composing them, they are the key that opens the door to getting an
answer.
Spend them indicating what aspect of Perl others will find if they
should decide to read your article.
Do not spend them indicating "experience level" (guru, newbie...).
Do not spend them pleading (please read, urgent, help!...).
Do not spend them on non-Subjects (Perl question, one-word
Subject...)
For more information on choosing a Subject see "Choosing Good
Subject Lines":
http://www.cpan.org/authors/id/D/DM/DMR/subjects.post
Part of the beauty of newsgroup dynamics, is that you can contribute
to the community with your very first post! If your choice of
Subject leads a fellow Perler to find the thread you are starting,
then even asking a question helps us all.
Use an effective followup style
When composing a followup, quote only enough text to establish the
context for the comments that you will add. Always indicate who
wrote the quoted material. Never quote an entire article. Never
quote a .signature (unless that is what you are commenting on).
Intersperse your comments *following* each section of quoted text to
which they relate. Unappreciated followup styles are referred to as
"top-posting", "Jeopardy" (because the answer comes before the
question), or "TOFU" (Text Over, Fullquote Under).
Reversing the chronology of the dialog makes it much harder to
understand (some folks won't even read it if written in that style).
For more information on quoting style, see:
http://web.presby.edu/~nnqadmin/nnq/nquote.html
Speak Perl rather than English, when possible
Perl is much more precise than natural language. Saying it in Perl
instead will avoid misunderstanding your question or problem.
Do not say: I have variable with "foo\tbar" in it.
Instead say: I have $var = "foo\tbar", or I have $var = 'foo\tbar',
or I have $var = <DATA> (and show the data line).
Ask perl to help you
You can ask perl itself to help you find common programming mistakes
by doing two things: enable warnings (perldoc warnings) and enable
"strict"ures (perldoc strict).
You should not bother the hundreds/thousands of readers of the
newsgroup without first seeing if a machine can help you find your
problem. It is demeaning to be asked to do the work of a machine. It
will annoy the readers of your article.
You can look up any of the messages that perl might issue to find
out what the message means and how to resolve the potential mistake
(perldoc perldiag). If you would like perl to look them up for you,
you can put "use diagnostics;" near the top of your program.
Do not re-type Perl code
Use copy/paste or your editor's "import" function rather than
attempting to type in your code. If you make a typo you will get
followups about your typos instead of about the question you are
trying to get answered.
Provide enough information
If you do the things in this item, you will have an Extremely Good
chance of getting people to try and help you with your problem!
These features are a really big bonus toward your question winning
out over all of the other posts that you are competing with.
First make a short (less than 20-30 lines) and *complete* program
that illustrates the problem you are having. People should be able
to run your program by copy/pasting the code from your article. (You
will find that doing this step very often reveals your problem
directly. Leading to an answer much more quickly and reliably than
posting to Usenet.)
Describe *precisely* the input to your program. Also provide example
input data for your program. If you need to show file input, use the
__DATA__ token (perldata.pod) to provide the file contents inside of
your Perl program.
Show the output (including the verbatim text of any messages) of
your program.
Describe how you want the output to be different from what you are
getting.
If you have no idea at all of how to code up your situation, be sure
to at least describe the 2 things that you *do* know: input and
desired output.
Do not provide too much information
Do not just post your entire program for debugging. Most especially
do not post someone *else's* entire program.
Do not post binaries, HTML, or MIME
clpmisc is a text only newsgroup. If you have images or binaries
that explain your question, put them in a publically accessible
place (like a Web server) and provide a pointer to that location. If
you include code, cut and paste it directly in the message body.
Don't attach anything to the message. Don't post vcards or HTML.
Many people (and even some Usenet servers) will automatically filter
out such messages. Many people will not be able to easily read your
post. Plain text is something everyone can read.
Social faux pas to avoid
The first two below are symptoms of lots of FAQ asking here in clpmisc.
It happens so often that folks will assume that it is happening yet
again. If you have looked but not found, or found but didn't understand
the docs, say so in your article.
Asking a Frequently Asked Question
It should be understood that you may have missed the applicable FAQ
when you checked, which is not a big deal. But if the Frequently
Asked Question is worded similar to your question, folks will assume
that you did not look at all. Don't become indignant at pointers to
the FAQ, particularly if it solves your problem.
Asking a question easily answered by a cursory doc search
If folks think you have not even tried the obvious step of reading
the docs applicable to your problem, they are likely to become
annoyed.
If you are flamed for not checking when you *did* check, then just
shrug it off (and take the answer that you got).
Asking for emailed answers
Emailed answers benefit one person. Posted answers benefit the
entire community. If folks can take the time to answer your
question, then you can take the time to go get the answer in the
same place where you asked the question.
It is OK to ask for a *copy* of the answer to be emailed, but many
will ignore such requests anyway. If you munge your address, you
should never expect (or ask) to get email in response to a Usenet
post.
Ask the question here, get the answer here (maybe).
Beware of saying "doesn't work"
This is a "red flag" phrase. If you find yourself writing that,
pause and see if you can't describe what is not working without
saying "doesn't work". That is, describe how it is not what you
want.
Sending a "stealth" Cc copy
A "stealth Cc" is when you both email and post a reply without
indicating *in the body* that you are doing so.
Be extra cautious when you get upset
Count to ten before composing a followup when you are upset
This is recommended in all Usenet newsgroups. Here in clpmisc, most
flaming sub-threads are not about any feature of Perl at all! They
are most often for what was seen as a breach of netiquette. If you
have lurked for a bit, then you will know what is expected and won't
make such posts in the first place.
But if you get upset, wait a while before writing your followup. I
recommend waiting at least 30 minutes.
Count to ten after composing and before posting when you are upset
After you have written your followup, wait *another* 30 minutes
before committing yourself by posting it. You cannot take it back
once it has been said.
AUTHOR
Tad McClellan <tadmc@augustmail.com> and many others on the
comp.lang.perl.misc newsgroup.
------------------------------
Date: Mon, 12 Sep 2005 18:53:22 -0700
From: Jim Gibson <jgibson@mail.arc.nasa.gov>
Subject: Re: SOLVED: "Text File Busy" And Other Frustrating NFS/Perl Errors
Message-Id: <120920051853224684%jgibson@mail.arc.nasa.gov>
In article <gK2dnf03grtfRbjeRVn-rA@comcast.com>, Hal Vaughan
<hal@thresholddigital.com> wrote:
[problem with files not getting updated over NFS snipped]
I used to have a similar problem running on some SGI systems under Irix
and using NFS. My files were stored (in Clearcase, a source-code
control system) on a file-server, I was editing them on a workstation,
and I needed to compile them on a third system that had Oracle
installed. Sometimes, after I had saved a file on the workstation (to
the file server) I would run make (the Clearcase version) on the
database server, and make would report nothing to do. The new version
of the file was not yet visible to the database server. I would have to
wait a few seconds (10-20) and try again. Eventually, the database
server would see that the file had changed and make would re-compile
it. Your problem sounds similar but more serious. I have no other
insight to offer. It was just something we had to live with to use NFS.
If I edited the files on the database server, the problem went away.
Posted Via Usenet.com Premium Usenet Newsgroup Services
----------------------------------------------------------
** SPEED ** RETENTION ** COMPLETION ** ANONYMITY **
----------------------------------------------------------
http://www.usenet.com
------------------------------
Date: Mon, 12 Sep 2005 20:41:23 -0500
From: Tad McClellan <tadmc@augustmail.com>
Subject: Re: sorting data - hash vs. list
Message-Id: <slrndicbi3.skd.tadmc@magna.augustmail.com>
Fred@fred.net <Fred@fred.net> wrote:
> On Sun, 11 Sep 2005 22:30:59 GMT, "A. Sinan Unur" <1usa@llenroc.ude.invalid> wrote:
>
>>"Fred@fred.net" <Fred@fred.net> wrote in
>>news:qf79i19v7kqklccnr86pqr56ck5rc6loio@4ax.com:
>>If reading the whole file into memory bothers you, why not just use the
>>sort utility (good old DOS and XP have a sort utility as well)?
> Trying to stick with perl.
Why are you trying to stick with Perl?
If a Perl solution requires the entire thing in memory and sort
utilties do not require that, then you should use them instead.
> It was what I thought might be a modest contribution.
>>
>>> But just so you'll know I am not a complete rookie I'll post some
>>> recent work,
>>
>>Which seems to be completely irrelevant to the issue at hand.
> It is in the very specific context, yet in other more broadly scoped contexts it is apropos.
>>
>>I am a little baffled.
Me too.
>>> I have posted here before and been flamed to death,
If you engage in socially unacceptable behavior you should be expecting same.
I would hope that what you took away from that experience was
to act in a socially responsible manner...
>>Have you read the posting guidelines for this group? They contain
>>invaluable information on how to help yourself and help others help you.
> Thanks, but no.
You don't *want* to help people help you?
Why not?
Do you really want an answer, or are you just trolling around?
> I find them so restrictive.
Crowd control becomes necessary when a crowd forms.
> I don't like using modules that don't ship with Active State Perl
Then you will have to rewrite a lot of code that has already been written.
Expecting others to rewrite it all for you is an unrealistic expectation.
--
Tad McClellan SGML consulting
tadmc@augustmail.com Perl programming
Fort Worth, Texas
------------------------------
Date: 6 Apr 2001 21:33:47 GMT (Last modified)
From: Perl-Users-Request@ruby.oce.orst.edu (Perl-Users-Digest Admin)
Subject: Digest Administrivia (Last modified: 6 Apr 01)
Message-Id: <null>
Administrivia:
#The Perl-Users Digest is a retransmission of the USENET newsgroup
#comp.lang.perl.misc. For subscription or unsubscription requests, send
#the single line:
#
# subscribe perl-users
#or:
# unsubscribe perl-users
#
#to almanac@ruby.oce.orst.edu.
NOTE: due to the current flood of worm email banging on ruby, the smtp
server on ruby has been shut off until further notice.
To submit articles to comp.lang.perl.announce, send your article to
clpa@perl.com.
#To request back copies (available for a week or so), send your request
#to almanac@ruby.oce.orst.edu with the command "send perl-users x.y",
#where x is the volume number and y is the issue number.
#For other requests pertaining to the digest, send mail to
#perl-users-request@ruby.oce.orst.edu. Do not waste your time or mine
#sending perl questions to the -request address, I don't have time to
#answer them even if I did know the answer.
------------------------------
End of Perl-Users Digest V10 Issue 8411
***************************************
