4 ms·

I disagree. This bug is about trying to embed control commands into an arbitrary non-structured data stream. This is a bad idea, no matter if it's text or binar

I disagree. This bug is about trying to embed control commands into an arbitrary non-structured data stream. This is a bad idea, no matter if it's text or binary. The proper way to do this would be like the report says: open a separate channel from control commands. This is just like any other injection attack and not related to the unix philosophy.

naikrovek 6y ago
It's the "non-structured" part of what you said that I tried, and failed, to point out with my comment.
- pushrax 6y ago
  You don't need structure for secure control though, as long as the control channel is isolated. It's easier to make an insecure program when dealing with loosely described text streams, but it's by no means inevitable.
- saagarjha 6y ago
  Doesn't have to be text.