On Tue, 18 Jun 2013 05:10:23 +0200 Cyrille Lefevre wrote:
> Le 18/06/2013 04:34, Glenn Fowler a écrit :
> >
> > ast-ksh alpha 2013-06-13 source posted to
> >     http://www.research.att.com/sw/download/alpha/

> FYI http://www2.research.att.com/~gsf/cgi-bin/download.cgi?action=intro
> raise : CGIWrap Error: Real UID could not be changed!

I've wasted good hacking time time in the last week trying to get around that
7Ki line gitweb.cgi perl script which doesn't play nice with apache cgi per-user
process limits

as far as I can tell its a perl feature that smells like a DOS attack waiting 
to happen
apparently perl system() and open("|") on detecting EAGAIN repeat indefinitely
no exponential backoff, no let the user check errno and do something sane

also apparently an msn bot, about 2x/day floods the ast gitweb url
and trips the per-user process limit and voila DOS

try this at home kids with your own perl cgi

I believe a fix is finally in place (for tomorrow) that wraps the perl with a 
ksh script

now I need a shower after rolling around in all that perl

> also, ast beta packages seems to be somewhat obsolete right now,
> there are 1 year old !

> http://www2.research.att.com/~gsf/download/beta/beta.html

from the alpha page:

    Packages with size - are no longer alpha and can be downloaded
    (most likely with a different release YYYY-MM-DD) from the beta
    package download page or the official package download page.

from the beta page:

    Packages with size - are either still alpha or can be
    downloaded (most likely with a different release YYYY-MM-DD)
    from the official package download page.

2012-08-06 went from beta to official, emptying out beta
since then we have been in alpha mode with a lot of new code
pending another week of testing the alphas will go beta

_______________________________________________
ast-developers mailing list
[email protected]
http://lists.research.att.com/mailman/listinfo/ast-developers

Reply via email to