PabloFanque

Fascinating and educational information from Ilya, as always, especially about improved mobile latency in North America.

Regarding the format of the webpage: The video completely blocks my laptop browser window in Firefox v. 31.0, making it almost impossible to read the transcript. Sticky HTML elements on text-content heavy pages drive me crazy. Awhile ago I made a simple bookmarklet that makes me a much happier consumer of such pages. One version of it walks the DOM and unaffixes fixed DOM elements. The other changes them to display: none. You can roll your own pretty easily, or try out the ones I made at StaticDing.org. They both make it easy for me to read the transcript of Ilya's presentation. Without them, I probably would have given up.

Your site currently (2pm EST) lists two exploits, but omits a third variant which "Mitchell" posted in your site's comments 8 hours ago. I've tested two fully updated Ubuntu servers. Both are not vulnerable to the two exploits you posted, but both are vulnerable to the exploit listed in Mitchell's comment. I suggest you post Mitchell's variant prominently as well.

The two exploits you've posted:

  1. env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

  2. env X='() { (a)=>\' bash -c "echo date"; cat echo

The third variant Mitchell posted in his comment:

  3. env -i X=' () { }; echo hello' bash -c 'date'

The systems I've tried these on both have been updated with "sudo apt-get update"; "sudo apt-get dist-upgrade".

The systems are:

  A.  Ubuntu 12.04.5 LTS, running Bash version 4.2.25(1)-release (x86_64-pc-linux-gnu)

  B.  Ubuntu 10.04.4 LTS, running version 4.1.5(1)-release (x86_64-pc-linux-gnu)

I share your dislike of fixed headers for text-heavy pages, and I'm relieved to see other kindred spirits have made similar comments in this discussion. (I was concerned it was just me.) The NY Times' new fixed headers in particular prompted me to try making a bookmarklet. One version converts position:fixed html elements to position:relative. A second version converts them to display:none. I've been using them for the last few months, and it has made me a much happier reader of the NY Times and similar sites. You're most welcome to try it too -- staticding.org .

I see @tripzilch has commented below that he uses a bookmarklet that changes position:fixed elements to position:static. That's probably a better solution than my version which changes them to position:relative. I will have to try that method too.