in reply to scripts posing as data files, nitch nitch or uber cool?

what about <img src="get_image.cgi"> instead? makes it pretty obvious that it's dynamically created by a script .. though of course anyone taking this over would also see in the web server config that there's some sort of handler set up for .png files that runs a script ..

Replies are listed 'Best First'.
Re^2: scripts posing as data files, nitch nitch or uber cool?
by leocharre (Priest) on Apr 12, 2006 at 16:51 UTC

    see.. it's just.. this is a multi platform networked environment.. we have windows machines also- yup.
    So.. A windows machine may make a call to say; list.txt - it won't like list.cgi- The printer software is looking for a flat file- (residing on a linux box). So the other option would be a cron or a manual call to regenerate the list.txt file, something like [user:cli]$  make_list.pl > list.txt

    actually that idea is great for webstuffs.. the browser seems to have no problems interpreting <img src="image.cgi">
    Won't this cause any freakies , i mean, doesn't that attract unwated attention to what i'm doing? If this is a sensitive site, for example.

      A windows machine may make a call to say; list.txt - it won't like list.cgi

      What does the client have to do with how the server handles a given resource? Names don't matter. URIs don't matter. All that matters is that the server does something for a given request and returns something that the client can handle.

      actually that idea is great for webstuffs.. the browser seems to have no problems interpreting
      right .. cause it's the mime-type that matters, not the extension ..

      Won't this cause any freakies , i mean, doesn't that attract unwated attention to what i'm doing? If this is a sensitive site, for example.
      Well, your concern was that if there was a behind-the-scenes handler for image.png that a future maintainer wouldn't realize it. That aside, if you think that naming it "image.png" vs "image.cgi" is going to protect you, you're relying on security-through-obfuscation and that's a Bad Thing (TM). Either you trust that your script is secure or you don't (and since there's no user input here, shouldn't be that hard to secure it... might want to worry about throttling though) ..