Greetings:
Personally, I don't think top-posting is the most annoying newsgroup
habit. I think it's making a big fuss about minor inconveniences.
One of the nicest things about being human is the amazing flexibility of
our brains. For example, if a block of text isn't arranged in the order
we're used to, we can easily rearrange it mentally and read it anyway.
Oriental and Arabic peoples, for example, do this each time they read
something written in English. It's EASY, once you get used to it!
It took me about 3 seconds to realize that Mr. D'Aprano' Q&A session was
laid out bottom-to-top instead of top-to-bottom. After that, it made
perfect sense. While it was a excellent way to demonstrate his
argument, it failed to prove his point, because, while top-to-bottom may
be the way he reads things, it isn't the way _everyone_ reads things.
So, as far as I'm concerned, post your posts in whatever manner works
for you. If it's in English, I'll figure it out. If not, well, there's
always Babelfish. ;^)
Regards,
Barry
barry.carroll@p sc.com
541-302-1107
_______________ _________
We who cut mere stones must always be envisioning cathedrals.
-Quarry worker's creed
programs
Please don't top-post.
A: Because it messes up the order that we read things.
Q: Why?
A: Top-posting.
Q: What is the most annoying newsgroup habit?
That's hardly the same sort of vulnerability the article was talking
about, but it is a potential bug waiting to bite.
In a serious application, you should keep user-inputted strings
separate
been
Personally, I don't think top-posting is the most annoying newsgroup
habit. I think it's making a big fuss about minor inconveniences.
One of the nicest things about being human is the amazing flexibility of
our brains. For example, if a block of text isn't arranged in the order
we're used to, we can easily rearrange it mentally and read it anyway.
Oriental and Arabic peoples, for example, do this each time they read
something written in English. It's EASY, once you get used to it!
It took me about 3 seconds to realize that Mr. D'Aprano' Q&A session was
laid out bottom-to-top instead of top-to-bottom. After that, it made
perfect sense. While it was a excellent way to demonstrate his
argument, it failed to prove his point, because, while top-to-bottom may
be the way he reads things, it isn't the way _everyone_ reads things.
So, as far as I'm concerned, post your posts in whatever manner works
for you. If it's in English, I'll figure it out. If not, well, there's
always Babelfish. ;^)
Regards,
Barry
barry.carroll@p sc.com
541-302-1107
_______________ _________
We who cut mere stones must always be envisioning cathedrals.
-Quarry worker's creed
-----Original Message-----
From: Steven D'Aprano [mailto:steve@RE MOVE.THIS.cyber source.com.au]
Sent: Friday, January 19, 2007 11:30 AM
To: python-list@python.org
Subject: Re: when format strings attack
On Fri, 19 Jan 2007 10:43:53 -0800, John Zenger wrote:
From: Steven D'Aprano [mailto:steve@RE MOVE.THIS.cyber source.com.au]
Sent: Friday, January 19, 2007 11:30 AM
To: python-list@python.org
Subject: Re: when format strings attack
On Fri, 19 Jan 2007 10:43:53 -0800, John Zenger wrote:
Perhaps it is not as severe a security risk, but pure Python
can run into similar problems if they don't check user input for %
codes.
codes.
A: Because it messes up the order that we read things.
Q: Why?
A: Top-posting.
Q: What is the most annoying newsgroup habit?
Example:
Try to trick me: How about %s this?
Traceback (most recent call last):
File "<pyshell#8 >", line 1, in ?
print j % "John"
TypeError: not enough arguments for format string
>>k = raw_input("Try to trick me: ")
>>j = "User %s just entered: " + k
>>print j % "John"
>>print j % "John"
File "<pyshell#8 >", line 1, in ?
print j % "John"
TypeError: not enough arguments for format string
about, but it is a potential bug waiting to bite.
In a serious application, you should keep user-inputted strings
from application strings, and never use user strings unless they've
made safe. See Joel Spolsky's excellent article about one way of doing
that:
--
Steven.
that:
--
Steven.
Comment