4 ms·

Would it be possible to expand globs in a different way then? Say manually? Or with escaped backticks? I kind of think it's worth breaking people's workflows he

by im3w1l 6y ago

Would it be possible to expand globs in a different way then? Say manually? Or with escaped backticks? I kind of think it's worth breaking people's workflows here, but idk. Edit: I guess this is what the sftp-based scp does. But I wonder if the problems could be fixed without changing protocols.

josefx 6y ago
> I kind of think it's worth breaking people's workflows here, but idk. Why? As many times mentioned in these replies there are a dozen alternatives if you just want file transfer. Why break argument parsing in scp when those alternatives are readily available?
- im3w1l 6y ago
  Seems preferable to evolve it in line with how 99% of people are using it, rather than deprecate it because 1% of people are using it in a dangerous way. It's also a shame to waste a nice 3-char name that, as the article puts it "is deeply wired into the fingers of many Linux users and developers" > Finally, while the danger is remote, it is worth noting that a local file name containing `backticks` (a file named `touch you-lose`, for example) will be handled the same way on the other end; if a user can be convinced to perform a recursive copy of a directory tree containing a file with a malicious name, bad things can happen. And, is this really what anyone wants?
  - josefx 6y ago
    If tricking the user is the issue then we should also symlink ssh to chrome. Would be a waste to loose an otherwise fine three letter name to something as dangerous as giving someone direct remote access to a system.
  - pseudalopex 6y ago
    It was deprecated already. Seems simpler to just make the scp command use the SFTP protocol. Someone is already working on it.
pseudalopex 6y ago
They recommend SFTP or rsync instead.
deleted 6y ago
[deleted]
rurban 6y ago
Easier would be to disable backticks per default and only allow them with the new -T option which was added recently to permit case-insensitivity problems.

by im3w1l 6y ago

josefx 6y ago

> I kind of think it's worth breaking people's workflows here, but idk. Why? As many times mentioned in these replies there are a dozen alternatives if you just want file transfer. Why break argument parsing in scp when those alternatives are readily available?

im3w1l 6y ago
Seems preferable to evolve it in line with how 99% of people are using it, rather than deprecate it because 1% of people are using it in a dangerous way. It's also a shame to waste a nice 3-char name that, as the article puts it "is deeply wired into the fingers of many Linux users and developers" > Finally, while the danger is remote, it is worth noting that a local file name containing `backticks` (a file named `touch you-lose`, for example) will be handled the same way on the other end; if a user can be convinced to perform a recursive copy of a directory tree containing a file with a malicious name, bad things can happen. And, is this really what anyone wants?
- josefx 6y ago
  If tricking the user is the issue then we should also symlink ssh to chrome. Would be a waste to loose an otherwise fine three letter name to something as dangerous as giving someone direct remote access to a system.
- pseudalopex 6y ago
  It was deprecated already. Seems simpler to just make the scp command use the SFTP protocol. Someone is already working on it.

pseudalopex 6y ago

They recommend SFTP or rsync instead.

deleted 6y ago

[deleted]

rurban 6y ago

Easier would be to disable backticks per default and only allow them with the new -T option which was added recently to permit case-insensitivity problems.