3 ms·
Scratching my head a bit but ... isn't this old news (the underlying issue, not the github doc)? The modelines issue (this exact issue) was widely publicised w
by isr 7y ago
Scratching my head a bit but ... isn't this old news (the underlying issue, not the github doc)?
The modelines issue (this exact issue) was widely publicised well over a decade ago (long enough that I don't remember when).
I vaguely recall it showing up in an early gentoo security alert (pre-2005?) which is how I became aware of it.
How does this become a new security issue now?
- marshray 7y agoSimple: Modelines come from a time before we understood that ordinary user applications working with ordinary files needed to be engineered securely.
- isr 7y agoI think you missed my question :) I understand the security concerns (arbitrary code execution just by loading an arbitrary file into vim). My question was: this issue was caught, diagnosed, widely publicised and the configuration fix for it was widely deployed - nearly 15 (fifteen!) years ago. So why is it cropping up as a "new" security issue now?