16 ms·
Are you sure that you understood djb's statement about the principle of least privilege? It's not about attacking the rest of the app, but about violating the u
by irundebian 9y ago
Are you sure that you understood djb's statement about the principle of least privilege?
It's not about attacking the rest of the app, but about violating the user's security requirements.
- peterwwillis 9y agoI don't understand what this has to do with my comment.
- irundebian 9y ago> it would then have to find a way to attack the rest of the app (which qmail makes difficult). It's not necessary to attack the rest of the app as soon as user's security requirements are violated. So if an attacker had been able to have an impact on confidentiality, integrity or availability because of your masquerading patch, user's requirements would have been broken. For an impact on availability controlling control flow isn't necessary, you just need to crash components.
- peterwwillis 9y agoYes, you are right. An exploit is still viable even if it doesn't attack other parts of a system. My point was that with a default of secure design, even small exploits added via plugins are better defended against than my alternative option, which was sendmail (i'm sure Exim wouldn't have been quite as horrible as sendmail, and Postfix wasn't quite mature yet).