5 ms·

So in theory if you wanted to take down a web server that allows for creating files in a directory structure you just have to nest less than 1k of them to start

So in theory if you wanted to take down a web server that allows for creating files in a directory structure you just have to nest less than 1k of them to start wreaking havoc? Yikes if so.

Alphasite_ 11y ago
Its not really a big issue when you consider that no one does any serious web hosting on OSX server. Maybe if you relied on it for profiles?
- tajen 11y ago
  Not very related, but it reminds me that there are a lot of people who rack Mac Pros in data centers. Not Mac Mini. Mac Pros. Yes, the cylinder one. I guess it's mostly for graphics and rendering capabilities or when testing requires the original machines. People come up with all sorts of tricks because it is very inefficient - like vents [1] - or this other company who 3D-printed pieces to keep the Macbook Pros open at 7mm (=0,05 banana) [2]. [1] I especially liked this blog: http://photos.imgix.com/racking-mac-pros http://photos.imgix.com/racking-mac-pros [2] https://simbimbo.wordpress.com/2015/07/24/well-im-at-it-again-this-time-with-macbook-pros/ https://simbimbo.wordpress.com/2015/07/24/well-im-at-it-agai...
huuu 11y ago
What about sending someone a zip with such a directory structure?
- dogma1138 11y ago
  That's possible many AV products do not look into archives past a certain limit sending out a zip file with say a PDF and a hidden payload in a sub directory beyond the lookup depth of the AV software used to be a common way to achieve AV avoidance. commercial ZIP software however usually limits the maximum depth and file path name to the lowest common denominator which is 250 chars for compatibility with Windows, some software will have a "unix" mode in which the max limit is increased to 1024.
trengrj 11y ago
An OS X web server... As another comment mentioned OS X is hindered by the fact they refuse to use GPL 3 code http://meta.ath0.com/2012/02/05/apples-great-gpl-purge/ http://meta.ath0.com/2012/02/05/apples-great-gpl-purge/. This results in their userspace code being out of date (i.e. they still use bash version 3.2) and having bugs like these.
- the_mitsuhiko 11y ago
  > As another comment mentioned OS X is hindered by the fact they refuse to use GPL 3 code They do not refuse, they cannot include it from a legal point of view.
  - hedwall 11y ago
    What is the difference between GPL2 and GPL3 that makes this impossible from a legal POV?
    - Someone 11y ago
      I don't think anybody knows whether there is a real difference, but the increased strictness of GPL3 such as its anti-TIVOization (https://en.m.wikipedia.org/wiki/Tivoization https://en.m.wikipedia.org/wiki/Tivoization) clauses certainly make a lot of lawyers concerned. Where exactly the border lies between and not linking is a grey area, legally, that hasn't become clearer with GPL3. It wouldn't surprise me to see bash go from the standard install, too. Apple is slowly removing all GPL code from its OS.
      - autoreleasepool 11y ago
        I hope they make ZSH the standard shell. It's similar enough to bash to not disrupt most workflows and Apple has been able to update it due to its permissive license. I use ZSH as my main shell on OS X. I find it superior to bash in almost every way (especially with oh-my-zsh) except in ubiquity. Even so, I have no problem using bash if that's all that's available, the two shells are fairly compatible.

So in theory if you wanted to take down a web server that allows for creating files in a directory structure you just have to nest less than 1k of them to start wreaking havoc? Yikes if so.

Alphasite_ 11y ago

Its not really a big issue when you consider that no one does any serious web hosting on OSX server. Maybe if you relied on it for profiles?

tajen 11y ago
Not very related, but it reminds me that there are a lot of people who rack Mac Pros in data centers. Not Mac Mini. Mac Pros. Yes, the cylinder one. I guess it's mostly for graphics and rendering capabilities or when testing requires the original machines. People come up with all sorts of tricks because it is very inefficient - like vents [1] - or this other company who 3D-printed pieces to keep the Macbook Pros open at 7mm (=0,05 banana) [2]. [1] I especially liked this blog: http://photos.imgix.com/racking-mac-pros http://photos.imgix.com/racking-mac-pros [2] https://simbimbo.wordpress.com/2015/07/24/well-im-at-it-again-this-time-with-macbook-pros/ https://simbimbo.wordpress.com/2015/07/24/well-im-at-it-agai...

huuu 11y ago

What about sending someone a zip with such a directory structure?

dogma1138 11y ago
That's possible many AV products do not look into archives past a certain limit sending out a zip file with say a PDF and a hidden payload in a sub directory beyond the lookup depth of the AV software used to be a common way to achieve AV avoidance. commercial ZIP software however usually limits the maximum depth and file path name to the lowest common denominator which is 250 chars for compatibility with Windows, some software will have a "unix" mode in which the max limit is increased to 1024.

trengrj 11y ago

An OS X web server... As another comment mentioned OS X is hindered by the fact they refuse to use GPL 3 code http://meta.ath0.com/2012/02/05/apples-great-gpl-purge/ http://meta.ath0.com/2012/02/05/apples-great-gpl-purge/. This results in their userspace code being out of date (i.e. they still use bash version 3.2) and having bugs like these.

the_mitsuhiko 11y ago
> As another comment mentioned OS X is hindered by the fact they refuse to use GPL 3 code They do not refuse, they cannot include it from a legal point of view.
- hedwall 11y ago
  What is the difference between GPL2 and GPL3 that makes this impossible from a legal POV?
  - Someone 11y ago
    I don't think anybody knows whether there is a real difference, but the increased strictness of GPL3 such as its anti-TIVOization (https://en.m.wikipedia.org/wiki/Tivoization https://en.m.wikipedia.org/wiki/Tivoization) clauses certainly make a lot of lawyers concerned. Where exactly the border lies between and not linking is a grey area, legally, that hasn't become clearer with GPL3. It wouldn't surprise me to see bash go from the standard install, too. Apple is slowly removing all GPL code from its OS.
    - autoreleasepool 11y ago
      I hope they make ZSH the standard shell. It's similar enough to bash to not disrupt most workflows and Apple has been able to update it due to its permissive license. I use ZSH as my main shell on OS X. I find it superior to bash in almost every way (especially with oh-my-zsh) except in ubiquity. Even so, I have no problem using bash if that's all that's available, the two shells are fairly compatible.