[Wolves] The rimming of Peter Oliver continues...

Tue Sep 23 12:24:00 2003

Looks quite cool, not doing SSIs is a major problem however. I guess you
could expand them by hand or run the code through some form of macro
expander (m4 perhaps or its a fairly trivial awk script). Does it support
server.execute? You can get round using SSIs with server.execute but you
have to be carefull because it has scoping "issues" (basically the code
executed does not pass back values to the calling code unless you use
session variables etc).

There must be a mod_SSI for apache, I wonder how easy it would be to
include... 

It might only run on windows but the road to freedom is made of many small
steps, asp/IIS/windows to asp/apache/windows to php/apache/windows to
php/apache/linux (or jsp if you prefer, or even mod_asp and perlscript),
with SQLServer to Mysql somewhere along the way.

chris

-----Original Message-----
From: Aquarius [mailto:aquarius-lists@kryogenix.org]
Sent: 23 September 2003 10:17
To: wolves@mailman.lug.org.uk
Subject: Re: [Wolves] The rimming of Peter Oliver continues...

Chris Procter spoo'd forth:
>> Soon I'll convince people that since we're
>>Apache on some boxen anyway that I should write code in something other
>>than ASP, and then the Day of the Aq begins...
> 
> You have ASP running on Apache? Is this some Sun/Chilisoft thing or have I
> misread that entirely? How did you persuade them to change over?

http://www.opensa.org/

You need the 1.x version, but, yes, it runs ASP. There are a few
unimportant things it doesn't do (Request.ClientConnected, that sort of
thing) and two very big caveats. Very Big Caveat no 1: it only runs on
Windows. This is because it doesn't do VBS/JS work itself, it just
wraps the MS scripting DLLs. Very Big Caveat no 2: it doesn't do SSI.
This is a big problem for ASPs, as you can imagine, since all your code
includes won't work. However, you can just copy the code inline and
that'll work; obviously this isn't suitable for a big complicated
application, but it'll work fine for small things.

Further ideas on this: 
Firstly, can anyone out there get cscript.exe and wscript.exe to run on
Linux using Wine? If they could, then it would be pretty easy to port
the OpenSA activescripting stuff to Linux Apache, and, pow, working ASP
on Linux (although using the MS scripting engines with Wine). This'd
break as soon as you did Server.CreateObject, since you wouldn't have a
COM object to create, but frankly you'd only need to emulate
Scripting.Dictionary, ADODB.*, and MSXML.*, and you'd cover 90% of ASP
applications in a heartbeat.

Secondly, my firm, at my instigation, offered to pay Daniel
Reichenbach, the lead (well, pretty much only) OpenSA developer to hack
SSI into the ASP code, but after agreeing to do it he went all quiet
and isn't responding to my emails about it :( So, is there anyone
around who is OK with C in a Windows environment? I can't imagine that
it's very difficult to do SSI stuff, and I'll only ask for 
, which makes it even easier. That way, although
we won't be getting people off Windows, we might get them off IIS,
which'd stop Code Red and so on -- imagine, a drop in replacement for
IIS with mod_rewrite and no vulnerabilities! I can't understand why the
guy won't hack this in...especially after we offered to pay :(

Thirdly, you can't get Apache 1.x to do the SSI for you and then pass
the SSIed code to mod_asp. You *can* get Apache 2.x to do this, but
OpenSA 2.x (based on Apache 2.x) doesn't include the ASP code! I asked
Dan Reichenbach why, and he said that he was working on some ASP.NET
thing and mod_asp would need loads of changes to fit into 2.x. Sigh.

Fourthly, I persuaded the firm by saying, look, IIS crashes more than
Apache, Apache is more powerful than IIS, and Apache is the industry
standard; a *lot* more people are using it than all competitors put
together, according to Netcraft.

Aq.

-- 
x^n + y^n = z^n where n > 2: no solutions
I have a wonderful proof of this but I can't write it now because my
train is coming.
	   -- Graffito on New York subway

_______________________________________________
Wolves LUG mailing list
Homepage: http://www.wolveslug.org.uk/
Mailing list: Wolves@mailman.lug.org.uk
Mailing list home: http://mailman.lug.org.uk/mailman/listinfo/wolves

**********************************************************************
Any opinions expressed in this email are those of the individual
and not necessarily those of Fox Online.
This email and any files transmitted with it, including replies and
forwarded copies (which may contain alterations) subsequently transmitted
from Fox Online, are confidential and solely for the use
of the intended recipient.
If you have received this email in error please notify Fox Online by
telephone on +44 (0)121 693 1424.
**********************************************************************