Windows Vista To Support Symbolic Links (Symlinks)

I can’t even count the number of times over the last 9+ years that I would have been thrilled to have symbolic links (symlinks) in Windows. After all these years it looks like I might finally get my wish, the Windows Vista/Longhorn NTFS filesystem is supposed to include symlinks. Beyond that the new SMB2 network filesystem protocol is supposed to include support for this.

This is another situation where even though Microsoft is doing the right thing here by adding a feature that their system needs to have, many folks will be laughing and making fun of them for it. Why? Well, the FreeBSD symlink(2) manpage claims that it first appeared in 4.2BSD, in 1983. It is rather hard to save face while explaining that it would be more than 20 years later before Microsoft would get around to including this feature in their filesystem.

This makes you really reconsider the wisdom of the saying “better late than never”.

Keep The Change

Bank of America has a new feature/service called Keep The Change. The idea is that every time that you use your Visa debit card it will automatically round the transaction up to the nearest dollar and deposit the difference in your savings account. I thought this was interesting not so much for getting people to save, but as possible donation method. Imagine being able configure this Keep The Change feature so that the change is directly deposited to The Red Cross, your kids school or any number of good and worthy causes.

Perhaps Gus Gorman was on to something after all.

Blog Value

With the sale of Weblogs Inc. to AOL came the inevitable break down of the dollar value per link to a blog based on the money AOL spent. Using Technorati to determine the links to a site you knew that it was only a matter of time before someone put them all together so that you can just enter your URL and calculate how much your blog is worth.

I’d have a hard time believing that there is anyone who would be willing to pay the $19,194.36 my blog is calculated to be worth today.

Fake Fork in PHP

If you aren’t using the Apache module then using pcntl_fork() to fork a PHP process works fine. There are times when it would be really handy to perform a fork in PHP when it is running as an Apache module. There is a way to fake this, sort of.

Instead of forking your PHP script you can exec() another process to run in the background. This obviously isn’t the same as forking, but it is about as close as you can get when running as an Apache module. While reading through the comments on the PHP exec() page I was able to piece together enough information to make execing a background process work. Here’s an example:

exec("/usr/local/bin/myprog 2>/dev/null >&- /dev/null &");

This will execute /usr/local/bin/myprog and redirect STDOUT and STDERR to /dev/null and run the process in the background. You can even pass arguments to your program like this:

$safe_arg["arg_1"] = escapeshellarg($arg_1);
$safe_arg["arg_2"] = escapeshellarg($arg_2);
exec("/usr/local/bin/myprog {$safe_arg["arg_1"]} {$safe_arg["arg_2"]} 2>/dev/null >&- /dev/null &");

Make sure that you escape any data you get from outside your script when using it in exec().

Google Update

I get more hits on this blog via Google than any other site or search engine, by a huge margin. I noticed that somewhere around the 13th or 14th of October 2005 the page views on my blog dropped to about 40% of what it was before. It wasn’t until I came across this SitePoint article, Google Update Update, that I realized what exactly was going on.

It seems that Google is going through another update and lots of people are seeing their site traffic shift dramatically. I wonder if this is part of Google’s response to complaints about splogs. Perhaps Google is ranking this site lower just because it is blog?

OpenOffice 2.0

OpenOffice 2.0 is out today. I’ve installed it on Windows XP to do some basic comparisons to Microsoft Office 2003. One of the things I’m most excited about is the new Base program, basically a Microsoft Access clone. It is unfortunate that doesn’t natively support PostgreSQL, but it does support MySQL natively. So I’m playing with Base connecting to a PostgreSQL database via ODBC.

I’m hoping that Base is cross platform, it would be nice to have an easy to design front end tool for databases that could be used on Windows, Un*x and Mac OS X. This is assuming the native port gets done, running OO in X under Mac isn’t so great.

With any luck the new abilities of OpenOffice 2.0 will win over a few more converts at work.

What Ever Happened To The Double Feature?

When I was a kid going to the movies usually involved looking through the theater ads in the newspaper to see what double features were playing. Just like today we complained about the price of a movie ticket and double features were usually a good deal. Today I look at movies.yahoo.com instead of the newspaper to see what is playing, but I don’t remember the last time that I saw a double feature offered.

Are there just so many movies coming out that there aren’t enough screens available to make double features worthwhile for the theaters? Maybe this is localized issue, perhaps California is just to busy for double features? Or large city issue, where places like Sacramento might be more interested in getting as many movies out there as possible? For Sacramento it seems like none of those should be problems, there are more than enough theaters in the region. I can think of at least 6 that are a 20 minute drive or less from my home.

I’ll guess that money is the driving force here, as it is in so many other things. They probably discovered that people will still go to the theater to see movies even if they stop offering double features.

Guide to PHP Security

The chapter on SQL Injection from the book Guide to PHP Security by Ilia Alshanetsky is available in PDF format. This can be a rather fun topic so I downloaded a copy of the PDF and started reading. I’d read less two pages before I was ready to toss this chapter out the window.

The first example showed a very simple inject that terminated the original query with a ; and appended another query that deleted some data. The example used MySQL functions and the author noted the following after explaining the injection:

Fortunately, if you use MySQL, the mysql_query() function does not permit query stacking, or executing multiple queries in a single function call. If you try to stack queries, the call fails.

However, other PHP database extensions, such as SQLite and PostgreSQL, happily perform stacked queries, executing all of the queries provided in one string and creating a serious security problem.

The emphasis is mine. I couldn’t believe that the author was basically claiming that MySQL is more secure than SQLite and PostgreSQL because they allowed you to run multiple SQL statements in one string. Then something else came to mind, didn’t MySQL add this feature not too long ago? So I went hunting around and came up with the C API Handling of Multiple Query Execution in MySQL, which was introduced in version 4.1. Although still correct, the mysql_query() function in PHP doesn’t allow for multiple statements, the underlying C libraries do. I’d expect that at somepoint in the future PHP will catch up and support that feature for MySQL 4.1 and above.

But back to my first point, being able to run multiple queries in a single string is not a security threat. Not proplerly filtering data before using in an SQL statement is. If you allow unfiltered data to be injected into your SQL statement then you’ve got problems, even if you database doesn’t support multiple statements in a single string.

I hope that this isn’t typical of the rest of the book.

The Twilight Zone

I’ve been watching the old original The Twilight Zone on the SciFi Channel lately. Even after all these years most of the episodes are still great to watch. Rod Serling did an awesome job as a narrator/host for the show. Attempts to do modern versions have been tried a few times, but I don’t think that any of them have been able reach the level of efficient story telling as the original.

Although having the episodes in black and white are an immediate clue to their age, I can’t image ever wanting to see them colorized. There is something pleasant about seeing these stories in their original black and white.