4 ms·
Yes, programs are free to interpret arguments any way they want. (See dd(1).) But in practice, almost all programs interpret a leading dash in an argument word
by quotemstr 10y ago
Yes, programs are free to interpret arguments any way they want. (See dd(1).) But in practice, almost all programs interpret a leading dash in an argument word to mean "here be options". By banning filenames with leading dashes, we close a large number of security holes at minimal cost. Of course it's not a total solution, but from a pragmatic perspective, it's the right thing to do, because it goes a long way toward solving a real problem.
- hueving 10y agoClose what security holes? If someone isn't escaping input they are still screwed if you ban dashes. It's like suggesting we don't allow sql to store quotes so we can use quotes to enclose data.
- quotemstr 10y agoIt's harm reduction. Yes, everyone should be escaping input. Yes, everyone should be using "./.foo" instead of just ".foo". But people don't, and they're not going to start. If we ban leading dashes, we stop these bugs from turning into security vulnerabilities. Your stance is like being against ASLR because developers just shouldn't have buffer overflow vulnerabilities in their code.