3 ms·
Eh, an attacker would simply do all of those things, like copying types from the rust source. I don't disagree this is minor, but an actual attacker will certai
by tedunangst 8y ago
Eh, an attacker would simply do all of those things, like copying types from the rust source. I don't disagree this is minor, but an actual attacker will certainly not be thwarted because a vulnerable feature is not documented.
- steveklabnik 8y agoThe attacker would, of course, but unless you’re also doing it to, it won’t work. The plugin existing isn’t enough, you have to pass a flag with the name to try to activate it. If it just loaded them without the user needing to also use a flag, the chances would go way up, for sure.
- tedunangst 8y agoAh, the post is kinda unclear on the command line requirement. It says they're loaded by default.
- steveklabnik 8y agoAh so, yeah it’s poorly worded. If you don’t pass —plugin-path, the default location is the /tmp prefixed one. But you need —plugins for it to attempt to load them at all. I’ll re-work the wording when I’m at a computer, thanks :)