3 ms·

And yet the linked article describes a useful application for this "forgotten code".

• GekkePrutser 6y ago
  A useful application sure, but something that 1 out of a 1000 people will ever use :) And that's overestimating it I'm sure. It's really fringe. Yet all of those 1000 are vulnerable to any vulnerabilities it contains. PS: By forgotten I don't mean useless. I mean out of the minds of developers. This kind of code was written decades ago before many new exploit techniques were invented and probably never touched again. It probably wasn't written with things like buffer overflow exploits in mind, yet it's still in this application which is often used to connect to various servers which may not be fully trusted, and sessions which are elevated to root. A lot of vulnerabilities in common software come from such legacy features. It's useful for sure. But it should be an elective compile option or something. Distros can package that version of Xterm for those who will actually use the Tektronix emulation. The rest will be safer off without it.
  • leephillips 6y ago
    Good points. One of the inspirations of the st terminal from suckless was, they say, to have a program without any of this legacy code. I even think they mention this tectronix stuff explicitly somewhere. Having it as an option makes sense.
  • ilaksh 6y ago
    Maybe just an option to disallow that mode? Seems like people see something awesome and just automatically want to kill it. If you want to remove overflow exploits there are a dozen other more common and less cool things you could check into first.