evan_tech -- mime sniffing

09:12 pm, 11 Feb 09

mime sniffing

I post about (in part) the ancient IE mime sniffing hole over on Chromium Notes, and ten days later a 600-reddit-vote article shows up on the same subject. Coincidence? You decide!

(Unfortunately, the defenses proposed in the article are not sufficient for protecting your site. I leave figuring out why to you.)

Anonymous	When do you suppose there ever going to be upload helper apps? <input ... > would be nice if it could launch camera and scanner capture, instead of just [Browse...]
reply to this

Anonymous LJ ate my example: input ... -> input type=file name=pic accept="image/*"

reply to this
- evan That's a good idea! I'd bet there's a Firefox extension that does it.
  
  reply to this

eqe

(Hmm, I don't see anywhere to comment on Chromium Notes, so...)

(You could reasonably argue that you shouldn't care about milliseconds, but a lot of these measurements are done when all the disk caches are warm. What takes 40ms now could take seconds if your disk is loaded. There are tools in the tree that attempt to flush the disk cache for the relevant data before running so we can try to estimate performance in the cold disk case.) - 40 milliseconds

On Linux you can clear all the caches with a sudo sysctl -w vm.drop_caches=3 aka echo 3 > /proc/sys/vm/drop_caches. Since there's absolutely no correlation between how long things take with warm caches and how long they take with cold caches, measuring the thing you're actually trying to measure is incredibly important. (but you know that already.)

reply to this

evan	(I am anti internet comments from strangers, the target audience of it all...) Yeah, the tools we have are for Windows. :< And there is a correlation between hot and cold if the processes are CPU-bound!
reply to this

eqe

Hmm, I was thinking of correlation one derivative out -- a change that improves hot-cache performance by 20% may well have no effect, a small positive effect, or a large positive effect on cold-cache performance, and changes to improve cold-cache performance often negatively impact hot-cache performance. There's a tool called Bootchart that generates really cool visualizations of CPU-versus-IO for one specific problem on Linux, but AFAIK there isn't anything similar for profiling random applications.

reply to this

Anonymous	LJ ate my example: input ... -> input type=file name=pic accept="image/*"
reply to this

evan	That's a good idea! I'd bet there's a Firefox extension that does it.
reply to this