1 Speaking of the file system.  Would it be possible to make it so that when we create a new directory, the proper templates are automatically filled in?

2

They always used to tell me that OpenSourceâ„¢ was a guarantee of quality and lack of bugs and exploits. With all the eyes looking it over, nothing bad could make it through, they said. (Eric Raymond, I'm looking at you!)

3 Another forum I read was all over this today.  Most of the people there asserted "(essentially) nobody uses CGI these days so this isn't likely to be widespread."  I wonder if that's true.

4 CGI isn't used much these days - but all it takes is one old script that you've forgotten about, and persistent scanning bot, and they're in.

5 When they say "isn't used much", they almost always mean "for brand-new projects". There's all sorts of hairy old Production code out there with do-not-touch signs attached. There are several big companies who'd be happy to hire me because I know old Perl.

In this case, though, it doesn't matter. The most modern, spiffy web framework in the world might be running in a scripting language where system() calls out to the shell with an unsanitized environment, and then boom!

Many years ago I did much the same as Pixy when I was writing a secure-execution wrapper for student operators. "I can't think of anything nasty that you could do by passing the user's environment variables through, but just in case, I'll create a fresh, blank environment and pass just the ones I like". Six months later, there was a bug about overriding shared libraries through environment variables...

-j

6 Just a caution, I dunno if you caught the update to that article (or the various CERT notices), but the first official fix for the vulnerability was flawed and either introduced something new or did not fix the entire problem.  There is apparently an unofficial patch out (and being tested, I guess), but no official patch yet.

7 Yeah, I already applied the second patch, and it sounds like there's going to be at least one more.  Yech.

8 Spam continues to make The Pond sad, Pixy... there's three examples in my comments queue to look at, if it helps, but I'm getting 200+ spams at a shot, three or four times a day.

Help?

9 One more seems...optimistic.  CERT just dumped 2 more "previous fix was incomplete" alerts out and added 2 more separate (but slightly less ugly) alerts.

10 Pixy, I just had to delete 30 pages worth of spam from the Pond's comment section.  Same stuff that's been plaguing me for the past however long it's been...

Suggestions?

11 I'll set them on fire.  And also update the spam filter.

12 Ooh, yes, I like that idea.  Fire and spam goes well.

13 Your putting them to the torch appears to have made a difference, Pixy... instead of 30 pages of spam every few hours, I'm getting two or three spam comments total per day.

Thank you!