3 ms·

It's hardly surprising, you can run into memory corruption bugs just using desktop mail.app the way it's intended (there's been a bug that corrupts the account

by swiley 6y ago

It's hardly surprising, you can run into memory corruption bugs just using desktop mail.app the way it's intended (there's been a bug that corrupts the account list for probably a decade which just hasn't been fixed.) Mutt may look old but at least it actually works.

slimsag 6y ago
Important to note this isn't a memory corruption bug, though. This is a case of the application working as designed, but in unintended ways. A logic flaw. I say this because I don't see a lot of effort being put into solving these types of security issues, compared to e.g. memory safety issues.
- brundolf 6y ago
  Unlike memory safety issues it's not really a category that tends to have category-wide solutions
  - eyelidlessness 6y ago
    V1: “This file we downloaded for your convenience is requesting access to [folder]. This may harm your computer or expose you to unknown security risk. Are you sure?” V2: “This file unexpectedly tried to access [folder].” The exact same mechanism Apple already used with GateKeeper and FS access for programs at runtime. Why does it need to be more complicated than that?
- saagarjha 6y ago
  Yep, it’s a confused deputy problem.
coder543 6y ago
Mutt has also had a number of remote code execution vulnerabilities over the years: https://www.cvedetails.com/product/274/Mutt-Mutt.html?vendor_id=158 https://www.cvedetails.com/product/274/Mutt-Mutt.html?vendor...
- megous 6y ago
  I don't use mutt with IMAP, so the last of those CVE issues that could have an effect was in 2005. And most of the rest of code execution bugs are related to IMAP. Pretty good. Though I certainly shouldn't trust mutt to be bug free, given that it processes data that someone can send me freely. Gladly TUI programs are fairly easy to isolate in their own UNIX user account.

3 ms·

It's hardly surprising, you can run into memory corruption bugs just using desktop mail.app the way it's intended (there's been a bug that corrupts the account

by swiley 6y ago

slimsag 6y ago
Important to note this isn't a memory corruption bug, though. This is a case of the application working as designed, but in unintended ways. A logic flaw. I say this because I don't see a lot of effort being put into solving these types of security issues, compared to e.g. memory safety issues.
- brundolf 6y ago
  Unlike memory safety issues it's not really a category that tends to have category-wide solutions
  - eyelidlessness 6y ago
    V1: “This file we downloaded for your convenience is requesting access to [folder]. This may harm your computer or expose you to unknown security risk. Are you sure?” V2: “This file unexpectedly tried to access [folder].” The exact same mechanism Apple already used with GateKeeper and FS access for programs at runtime. Why does it need to be more complicated than that?
- saagarjha 6y ago
  Yep, it’s a confused deputy problem.
coder543 6y ago
Mutt has also had a number of remote code execution vulnerabilities over the years: https://www.cvedetails.com/product/274/Mutt-Mutt.html?vendor_id=158 https://www.cvedetails.com/product/274/Mutt-Mutt.html?vendor...
- megous 6y ago
  I don't use mutt with IMAP, so the last of those CVE issues that could have an effect was in 2005. And most of the rest of code execution bugs are related to IMAP. Pretty good. Though I certainly shouldn't trust mutt to be bug free, given that it processes data that someone can send me freely. Gladly TUI programs are fairly easy to isolate in their own UNIX user account.