Lacking cryptographic hashes used by most DVCS software, SVN repositories need some external mechanism to be pretty sure the source repository hasn't been compromised. For instance, one might have snapshots of the SVN tree taken every week.
It's much easier with git or hg, even in the single-master-repo model, even if all developers are using the CVS gateway so they don't have local copies of commit history. All such a project would need in order to protect against compromise (ignoring physical redundancy) is a backup git or hg repo, kept offline except for periodic pulls. As long as there are no warnings about upstream rebases, and you trust all visible commits, then everything's fine[1].
With SVN, as long as there's no built-in cryptographically secure way to connect one snapshot to the next when backing up SVN repos, determining the existence of a backdoor requires comparing entire backup SVN repos against the live main repo. Even if sufficient backups exist, the process is slow and requires taking the main SVN repo offline if there's any chance of a root compromise.
[1] Caveat 1: in any RCS, there could be backdoors masquerading as legitimate-looking commits if the attacker had commit access. Caveat 2: The security is subject to the cryptographic security of SHA-1.
In this FreeBSD case, if they're certain the svn repo wasn't compromised, all they have to do is validate the checkout on the two compromised machines against the svn repo.
Nothing, if you don't mind using a centralized development model.
The BSD's tend to be ultra-conservative in regard to version control systems - for example OpenBSD is still on CVS and developed their own version: http://www.opencvs.org
I also find the ability to branch and stash easily two super-useful features. Also, I like not having to go to the server to do diffs, merge, or pull files from other branches. bisect is nice, as well.
I use git-svn at work, so I have everything but easy (svn) branching and I find it super useful.
The [[:print:]] will match any printable characters like åä, while the [ -~] will not.
I used this once as another safeguard against pushing binary data into the database. It was a poor system to begin with where you even have that possibility... and it happened at least once before the fix and my safeguard was in place.
There will be situations where you need to check specifically for 7-bit ASCII printable characters only. I've worked with APIs that require everything outside that range to be escaped/encoded into it.
Email could be an example, I guess, although I haven't worked with it enough to know whether the whole "7-bits only" thing is still an issue these days.
Whats the thing with saying "Only 2 files" what if it is only 1 file, like bottle.py, but the 1 or 2 files contain 10 000 lines of code? Im just saying.
Yeah, seriously. I just did some work with the s7 implementation of Scheme. "Only two files!"
I think in all fairness, I think the idea is that you should just drop it in your source without needing to worry about git subrepos (or whatever). But it would be perhaps more elegant to split it up in the repo and have a script stitch it together into the "only two files".
Also s7 turned out to be much easier to include than the other ones I was considering, so I guess I shouldn't be mocking it.
Well, as in the case with bottle, it's probably meant to imply that you can just use it in your project as files, not as a complete library. No need to complicate your Makefiles (or worry about your package framework).
Somebody is mad about their book being read. Cry me a river. If you didnt want your book to be "stolen" then dont write it. You, as author, will not control what I read, how I read and where. So yes, I am gonna "steal" that book from you, just to steal from you, and then delete it from my computer. Its probably not worthy of being read anyway.
And furthermore, nobody is sharing your book illegally, they are sharing a digital copy of your book as a data-file, which is very quite different from a real book. You cant hold it you see, you cant smell it, you cant borrow it to your friend, only make another copy.
A substantial difference between "a car" and "a file on a computer". One main difference is that one actually can steal a car: if I steal a car, I possess it, and the owner does not possess it. He or she can no longer use the car, while I can.
The book in question exists as a file on a computer. If I copy that file, then the owner is not deprived of the use of the file: he or she still possesses it, and can still use it. That's not theft in any traditional sense.
The other raping and pillaging scenarios are equally nonsensical, pretty much on the same logical grounds. Please try a new argument next time.
If the owner of the file makes his living by selling copies of the works he created, taking a copy and putting it on the web (where they can be had for free) reduces the value of his works. In other words, the owner is deprived of the use of his works because you've diluted their value.
The argument that "you still have the original so you are undamaged" is false. If the startup you work for dilutes your 5%=100shares of equity down to 0.0001% and the value of your stock is reduced to near zero, I can asure you, you won't feel comforted by the fact that you still have 100 shares.
Shares are different: they're like money, they represent value. A copy is a copy. Humans copy: that's how we made technological progress. Someone didn't invent agriculture while out on a hunt and then coast for the rest of his/her natural life on the "intellectual property" and then have his/her descendants coast on the proceeds. People copied what they saw that worked. Copying is how humans make progress, trying to stop or inhibit that is going to warp society beyond belief.
> they are sharing a digital copy of your book as a data-file, which is very quite different from a real book. You cant hold it you see, you cant smell it, you cant borrow it to your friend, only make another copy.
You can read it, yes?
I'm among the first to complain when people conflate "make a digital copy of" and "steal". However, you're going to the opposite extreme - pretending that because it's digital, it has none of the qualities of the original book. You're omitting quite a bit - he (and perhaps his editor) wrote every word in it, chose every image, researched the technology, and typeset the whole thing. Just because it ended up as both a PDF and a printed copy does not diminish the author's labor.
(It certainly diminishes the printer's labor, which is why we raise a stink when printed copies are cheaper than electronic ones.)
But you're hurting the entire ecosystem if you tell authors "stop writing if you don't like it". There's a middle ground somewhere.
The argument I was trying to make is to bring attention to the difference between a file and a book, they are different beasts, sure you can read them, but its not the same thiing to read a book and to read from a computer screen or kindle. Its just not the same.
The author has no right decide how I am going to read the book. Its the redistribution which he holds a right to. Lets take the discussion to what form of distribution copyright should apply to. Lets discuss who can decide when to read and how to read a text. Who has the right and who has copyright?
Its not just so simple, oh hey copyright, do as I almighty author say. Where is the consumer-rights in all this debate?
"The thing is when I used internet cafes, the first thing I would always open would be email."
Seriously? Intenet cafes are the least secure computers to give your email and password to. Sure for junk and spam-email accounts, that you dont care about anyway. But logging in to your personal email account on an internet caffe!? Thats madness.
It works even when you have "passive observation". All you need is two things 1) to make the victim run your JavaScript, irregardless where you make your victim fetch and run your script. And 2) sniff his packets to see what is going over the wire. You can do both things very easily for example in a caffe on an open WiFi network. Or in a caffe with WPA2 where you and your victim are on the same wifi, using the same password from the caffe. (Arp poisoning your victim...)
Take the "you and victim are at secure wpa2 caffe", the bartender gives both of you the wifi password. You perform an ARP poisoning on your victim, now all his communication goes through your computer, you act as gateway for him. Now you have 2 from above. Then you can for example replace his request for a http://cdn.google.com/jquery.js with your own jquery.js spiced with this new CRIME fancy JavaScrip as well, in which you just create a lot of img elements with src set to say https://facebook.com. And so on as described in CRIME you can reveal the victims session cookie for example.
The tools to perform arp have been around since the stone age, the tools to serve your victim your own .js for some random request of his over http have also been around since the stone age. And now we have crime to reveal parts of the victims supposedly secure communication channel as well.
