making apps, making webs.

GET urls with side effects can be a security problem. For example, imagine the following urls: paymoney?user=joe&amount=3000.0 deleteSomething?file=important.xls Now if those urls are protected by a login system, then only those who login can use them right? Nope. It is easy enough to trick someone into visiting a web page so that those urls are called by their web browser. If that person is logged in when they are tricked, then the action happens. A person can be tricked either by using img, frame, redirect or some other tags or http/html/flash/javascript features. This is because according to a web browser it is ok to include or link to elements on other pages. In fact that's the whole point of hyper linking. In this way it uses the authorization of person viewing your well crafted page. You can now create a page so that you can delete files as someone else, or pay any amount of money you want to anyone. Whatever the badly designed GET urls allow you to do. This can eve...

I saw this in the latest development release notes of gimp 2.3.12: "- build a color-managed CMYK color selector if lcms is available" http://developer.gimp.org/NEWS So it seems the gimp is getting CYMK support(or has it already). That'll be good for those doing print work that requires it. Along with the gimps next generation image processing core (GEGL) things are looking good for the gimp. http://www.linux.com/article.pl?sid=06/10/16/1342216 http://www.gegl.org/ I really think the new versions are quite good. With most of the bugs that annoyed me gone, and with new features being added all of the time. There's still some font handling issues which would be wonderful if fixed. Like rotated fonts, and fonts that can follow a path. However I think those features will appear over time. This line may be interesting for those python users out there wanting to optimize their image production pipeline... "- many improvements to the Python bindings and the pygimp...

To design a font on linux you can use fontforge. http://fontforge.sourceforge.net/ As part of my learning graphical design, I have become interested in finding out how fonts work and how to design fonts. I think learning to design a font will give me insight into other fonts. Much like how learning assembly language gave me insight into how computers work. Creating a font on linux with fontforge is the way to go I think. I haven't found any other way to create a font on linux yet! It was quite hard to find fontforge for designing fonts on linux too. It's a time consuming thing - designing a font. That I think will take years to figure out. I don't expect to make a great font, however I think there is room for creativity in fonts yet. So I hope to make something useful and learn something on the way. I guess I have made bitmap fonts before including the animated one on f0o.com http://f0o.com/ . However crude it might be ;) True Type Fonts .(ttf) fonts contain a virtu...

Some python web frame works are using pickle to store session data. Pickle is a well known poor choice for secure systems. However it seems to be more widely known by those writing network applications, than those making web frameworks. Is your web framework using pickle for sessions despite the warnings in the python documentation about it being insecure? By using sessions with pickle people who can write to the database servers session table can execute code on the app server. Or people who can get data into the session file/memcache data store can execute data. This might be an issue if the database server is run by separate people than the app server. Or if the session table is compromised by an sql injection attack elsewhere. There are some more secure ways of storing pickled data. Pickle is deemed to be untrustworthy for data. In that it is not certain that code can not be snuck into the data that will be executed by pickle. So if some data from user input is put into the p...

It's been really interesting to see VMs over the last couple of years. Now there are emulators, and virtualisers which are capable of running x86 really quickly. The processors themselves don't run x86 natively anymore, it's a VM. Now Apple are using x86, and x86 is getting more common in the embedded world too. So now, rather than creating a VM like python does it seems to make sense to use the standard VM, and that is x86. Of course x86 is really complex, and still fairly slow to emulate on slow hardware. So using a simpler VM still has its advantages. However writing directly to the most common VM has its advantages too. You can make software which is 400 bytes big which can do almost the same as a 8000 byte program. That's a 10x saving in program size. The same program will run in 12KiB of memory, instead of 1.7MiB of memory. That's a 141x memory usage saving. Because the code size, and memory size is so much smaller you can get a lot more done with the s...

http://www.pyweek.org/3/ The theme voting has begun. Here are the themes for the week long python game jam. * Pick a card, any card * Watch me pull a rabbit out from this hat * Sawn in half * Spoon bending * The Disappearing Act A very short list of themes to choose from this time. Thanks to Richard for organising pyweek again! If you have some spare time coming up, and want to finish a game then you should enter pyweek . If you don't have much time, find a team and join that. Let's hope the server stays up mostly :) These competitions all ways result in a server going down. Lots of users, and wide spread attention amongst smart, young and demanding hacker types means it gets challenges lots of other websites do not get. Strain on the software, and on the hardware are two of the causes. Otherwise it is caused by a simple cracking in to the machine to take it down.

not a bit of good food for got home gut jill had her kill Oh, how I love bad poetry. I just had to share. You need to type it to appreciate how bad it is.