Monthly Archives: October 2007

Why is register_globals = On a security risk?

A question from comp.lang.php:

I understand that register_globals was turned off by default as, unless you initialised it, it could be altered by a malicious coder.

What I don’t understand is how the $_POST[‘foo’] form is any more secure. Surely Mr Malicious Coder can still just send his own version of $_POST[‘foo’]?

Obviously I’m missing something, I just can’t figure out what!

What you are missing is a realization that with register_globals = On, the malicious coder can initialize ANY variable, regardless of whether the script expects to receive it via CGI.

Let’s say, you have something like this:

// Tons of code here...
// The script processes incoming data
// and, depending on the program flow,
// may or may not initialize the $bar
// variable.
if (isset($bar)) {
  $query = "DELETE FROM the_table WHERE bar='$bar'";
  $result = mysql_query($query);
}
// Tons of code here too...

Now let’s say that register_globals = On and malicious coder submitted:

$_REQUEST['bar'] = "' OR bar LIKE '%"

The server receives it and initializes:

$bar = "' OR bar LIKE '%"

If $bar is not changed elsewhere, the script issues the following MySQL query:

DELETE FROM the_table WHERE bar='' OR bar LIKE '%'

meaning, delete all records from the_table.

Granted, the above example is not a good coding practice, but with register_globals = Off it is still safe (the malicious user cannot initialize $bar and thus alter the program flow), while with register_globals = On it is a security risk.

Ronald Reagan and the fall of communism

A question from Yahoo! Answers:

How did Ronald Reagan’s foreign policy contribute to the fall of communism in Russia??

It didn’t. Communism was slowly decaying from within (French historian Emmanuel Todd very convincingly showed it in his remarkable 1976 book, “The final fall: An essay on the decomposition of the Soviet sphere“), but the U.S. government was too busy writing checks to defense contractors to notice…

The most influential person in the last thousand years

A question from Yahoo! Answers:

Who was the most influential person in the last thousand years?

In the year 2000, the biography channel did a special highlighting who their experts considered the most influential people in the last thousand years. I thought they did a good job on the top 5–though I disagreed with # 1 and wasn’t too happy to see Princess Diana on the list, much less ahead of Jonas Salk. Who is your pick for the number one most influential person in the last thousand years?

Assuming you mean a person who has lived within the last 1,000 years (so Gautama, Jesus, and Mohammed are disqualified), that would be Johannes Gutenberg.   Both Industrial Revolution and modern democracy depended on reliable vehicles of storing and disseminating information.   Gutenberg’s movable type (much improved by others) provided such a vehicle.   It can be argued that without movable type, development of both technology and democracy would have been severely impeded.

This said, one should wonder whether movable type would have been invented by someone else if Gutenberg didn’t invent it…

Tax cuts and economy’s performance

A question from Yahoo! Answers:

Liberals, tell me where I’m wrong?

The way to improve the economy is through tax cuts, not tax increases. Tax cuts work because it give employers of small businesses and even large, the ability to pay their employees a higher salary and create more jobs. If you begin to tax the so called “rich business owners” they will not take a cut in their own salary, but rather lay off workers or decrease wages. Also giving money back allows more opportunities for investment in the market and spending in general. Increasing taxes would discourage a person from starting their own business because the risks would greatly outweigh the potential rewards.

In addition to hurting the economy, redistributing wealth through taxes is simply un-American and anti-capitalism. What people like Hillary Clinton want to do is a direct play from the communist book in Soviet Russia.

First of all, the way to improve the economy may not necessarily be through tax cuts. Taxes serve a useful purpose; they pay, among other things, for the legal system that enforces contracts and property rights. Imagine that taxes are cut to the point where no contract or property rights enforcement is possible. Would this still be a good environment for business? Not likely… In fact, such an environment would be eerily reminiscent of present-day Bangladesh or Myanmar.

Taxes also pay for the public infrastructure, most notably, roads. Again, use your imagination and visualize taxes cut to the point where no road maintenance takes place. Would this be a good environment for business? Again, not likely…

Further, assuming we agree that taxes need to be cut, there is still a question of which taxes to cut. Any tax cut benefits different groups of people to a different extent. Expanding the Earned Income Tax Credit would primarily benefit the poor, while raising the gift tax threshold would primarily benefit the wealthy. Similar collisions may occur along employer-employee, borrower-lender, or tenant-landlord lines…

Now, on to discouraging people from starting their own businesses. The greatest discouragement actually is the absence of universal healthcare in the U.S. When you quit your job to start your own business, you lose valuable health coverage provided by your employer and have to make up for it somehow or just go without. Compared to a paid employee, a business owner is about twice as likely to have no health insurance at all and more than 50% as likely to be insured as someone else’s dependent.

As to “the communist book in Soviet Russia,” the Bush administration uses it, too, especially when it comes to justifying generous handouts to the defense contractors… If you want to see something un-American and anti-capitalism, just take a look at all the wars that the U.S. has fought in the recent years. Recall that Thomas Jefferson suggested that the U.S. should have “peace, commerce and honest friendship with all nations; entangling alliances with none”…

What would be Earth’s main export?

A question from Yahoo! Answers:

In the future (hypathetically) what would be Earth’s main export?

Great question, albeit the one without an answer.

The theory of comparative advantage predicts that goods that end up as exports are those that can be produced at a comparative advantage. In other words, if on Earth one unit of good A sells for the same price as one unit of good B, while on another planet one unit of good A sells for the same price as five units of good B, Earth will export good A and import good B. So it is impossible to say what the Earth’s main exports are going to be without first looking at the economies of its trading partners.

Also, comparative advantage must be large enough to cover transportation costs. If interstellar cargo hauling turns out to be prohibitively expensive, there will be no trade.

Changes to the Indian countryside

On a previous occasion, I pointed out that the success of India may ultimately depend on its ability to bring about major and positive change to the countryside. Looks like I am not alone in thinking so. And what’s more, the change is actually beginning to happen…

From The World Is Flat by Thomas L. Friedman:

One day in the spring of 2006 I was interviewing B. Ramalinga Raju, chairman of Satyam Computer Services, one of India’s top firms doing outsourced work from America, and he mentioned in passing how Satyam has just started outsourcing some of its American work to Indian villages. The outsourcee has become the outsourcer! Why not? Raju exlpained: “We told ourselves: If business process outsourcing can be done from cities in India to support cities in the developed world, why can’t it be done by villages in India to support cities in India? Things like processing employee records can be done from anywhere, so there is no reason they can’t be done from a village.” Satyam began with two villages a year ago and plans to scale up to 150. There is enough bandwidth now, even reaching big Indian villages, to parcel out this work, and the villagers are very eager. “The attrition level is low, and the commitment levels are high,” Raju said. “It is a way of breathing economic life into villages.”

Parsing RDF files with PHP and SimpleXML

A question from comp.lang.php

Here is an XML file I’d like to parse with php.
It’s a mozilla install.rdf file.

[RDF skipped]

How would you do that ?

If you want to parse RDF with SimpleXML, you should keep in mind that in RDF, XML entities’ names contain colons, which creates problems when you try to parse an XML document into an object, since columns are illegal in PHP variable names. You can, however, replace colons with underscores:

$RDF = file_get_contents('install.rdf');
$RDF = str_replace('<RDF:', '<RDF_', $RDF);
$RDF = str_replace('<em:', '<em_', $RDF);
$XML = simplexml_load_string($RDF);
foreach ($XML->RDF_Description as $num => $description) {
  $attributes = $description->attributes();
  if (isset($attributes['em_id'])) {
    echo "ID = {$attributes['em_id']};",
         " version = {$attributes['em_version']}";
  }
}

This should help…

What if Hitler had died in August 1941?

A question from Yahoo! Answers:

What if Hitler had died in august 1941 what would have happened after his death?

There are at least two possibilities I can think of.

One (the most likely, in my opinion) is business as usual, with the new Fuhrer at the helm (variation: a Fuhrer by committee, with several people pitching in to fill the void). All policies remain in place, with a possible addition of a new round of purges just in case.

The other (much less likely, I feel) is the return of the Junkers, followed by a quick and not very thorough purging of Nazis from the government (much like what happened in West Germany after the war), a peace treaty in the West and possibly joint assault in the East.

The reason I think business as usual is the more likely of the two alternatives is that Adolf Hitler, as important as he was to the Nazi movement, was far from indispensable. By 1941, the Nazis have succeeded in constructing a parallel security system (SS, SD, gestapo, etc.), whose loyalty was first and foremost to the Nazi party and its leadership, not to the German government (forget German people). Any attempt by the Junkers to take control would face a strong (and armed to the teeth) opposition from the Nazi party and its affiliated security agencies.

Sub-Saharan kingdoms: why is so little left of them?

A question from Yahoo! Answers:

Questions about sub-saharan African kingdoms?

O.k. I have learned about various kingdoms that developed in Africa. My question is why did they leave so little behind? For example the Sahelian Kingdoms of Mali, Songhai, and Ghana, we know from history that they were great, however, unlike the Egyptians ,they didn’t leave much behind. Yes, Iknow there is a beautiful mud mosque in Mali, but Why didn’t they built greater monuments like pyramids and temples, stuff like that. Could stone not be found in the Sahel? Were there no other resources they could use ?
2nd question Concerning the great Zimbabwe, it is good that the ancient zimbabweans, who are supposedly the ancestors of the modern day shona people ( who are the majority in zimbabwe) built the city However, why didn’t they built all of their cities like that of zimbabwe, instead of only two { the great zimbabwe and Khami, another city though smaller than zimbabwe.}?

It is possible that whatever they did leave behind was appropriated by successors. Egyptian monuments lost a lot of their original glory to grave robbers and construction material seekers of later generations, so this could (and did) happen in other places as well…

As to your second question, the answer is rather obvious. Many ancient empires were built by force, with the metropolis and its army living off the conquered lands. So the imperial government only wanted to have one unrivaled city, the one it resided in.

If life were discovered on Pluto…

A question from Yahoo! Answers:

Pluto is a very dark, cold planet. If life were discovered on Pluto, what kind of animal might live there?

What would it look like?

Describe it’s way of life.

I sincerely doubt there could be an animal on Pluto… Animals need to eat. They either eat plants or other animals (who in turn eat plants). So animals cannot exist without plants. And plants cannot exist without sunlight, which is something Pluto seriously lacks.