5 ms·
That's why I like DBJs method. You still use a command line program, but you pass a filehandle that the authentication data can be read from.. this seems muc
by akira2501 7y ago
That's why I like DBJs method. You still use a command line program, but you pass a filehandle that the authentication data can be read from.. this seems much safer than trying to parse and re-format that data as an intermediary. Also avoids any data leaks through the often unprotected 'cmdline'.
Is there some technical reason OpenBSD doesn't do this?
- mjevans 7y agoProbably historic compatibility. If making a breaking change this might be a good time to implement a design benefiting from decades of real world experiences.
- anthk 7y agoThat's literally what OpenBSD was doing over decades, starting with binary compatibility with Linux and a lot of legacy stuff which came from NetBSD and BSD 4.4 lite/BSD 4.3. You described OpenBSD with that comment. - Xenocara with rootless privileges as a fork of X - LibreSSL - Linux compat going away - Pledge/Unveil - Some daemons belonging to ports - HTTPD/SMTPD and so on as replacement of bloated daemons - OpenSSH itself - Retguard This vulnerability is bad, but pledge and unveil will have even more prominent roles in base soon, so even if you get privs, you can do either nil or just crash because of pledge.
- k_sze 7y agoWhat does “DBJ” stand for?
- gautamcgoel 7y agoI think he means Daniel Bernstein, a prominent cryptographer and coder.
- inferiorhuman 7y agoDaniel Bernstein, author of qmail, djbdns, and daemontools among others.
- kick 7y agoThat's DJB. DBJs is a Javascript database thing. There is possible ambiguity here.
- inferiorhuman 7y agoFair point. I associate DJB with security and coding best practices, Javascript not so much. I can only hope the comment I replied to meant DJB the person.
- kick 7y agoI hope so too.
- k_sze 7y agoAnd where does that auth-info-via-file-handle come from? I did a bit of duckduckgoing and couldn’t spot anything about that.
- simtel20 7y agoThe qmail source code has this convention.
- jstewartmobile 7y agoThank God for DJB. His entire website should be required reading for software developers.
- skunkpocalypse 7y agoI am convinced that DJB is actually the reincarnation of John von Neumann. Seriously, how many other people make contributions in areas ranging all the way from number theory to hand-written machine code?
- TheAceOfHearts 7y agoThanks for the recommendation, I'd previously heard of DJB but was unaware of his writings. Here's the link to his website: https://cr.yp.to/djb.html https://cr.yp.to/djb.html