5 ms·

Remove perl, have less security issues. Some scanning tools flag it, too. Awk is found in more places, in my experience.

ajross 3y ago
Sorry, but that's ridiculous. Any general purpose programming language is a vector for bugs and security problems, but come on: you're genuinely trying to say that a kludge of bash+sed+awk is objectively more "secure" than a single perl script to solve the same problem?
- coliveira 3y ago
  In the case of awk, actually yes, it is safer. The reason is that awk is a very limited language. It has only enough functionality to provide text matching and substitution. It is very difficult to use awk to do anything of high security risk, compared to a language like perl.
  - ajross 3y ago
    But awk is never used alone. You don't solve whole problems with awk, you squish it into a script with a bunch of other junk. My point is that you're making an apples-to-oranges comparison. Sure, "awk" isn't the problem, but "bash" is, and bash is undeniably a more error-prone language than perl. You surely agree with that much, right? And if you disallow "bash" for security reasons, where does that leave "awk" in the category of useful tools? See my point?
    - pletnes 3y ago
      You’re right. But the alternative might be bash + perl or just bash. Or none of them. Perl is anyway the first one to go.
      - TeMPOraL 3y ago
        Is it completely gone, or rather just for you, blocked by sysadmins who know Perl is the magic pixie dust for total control, and want to keep it for themselves? In Windows-land, compare how PowerShell access may be restricted, and you won't be allowed to run macros in Office, all while your computer is "managed" by a horrible hodge-podge of PowerShell and VBA scripts that make Perl code look like high literature.
    - coliveira 3y ago
      Just use awk for what it was designed: text search and substitution. You can run shell scripts along with awk, but that is clearly not what you should be doing if you want to design secure systems. The first rule of security is not to abuse your tools.
  - rascul 3y ago
    > It has only enough functionality to provide text matching and substitution. Gawk at least can do a lot more than that. Reading and writing files, network communications, and run arbitrary shell commands, for example. It's certainly not as powerful as perl but it's also not limited to just text matching and substitution. Edit: figured I would provide some examples. Here's an http server and a first person shooter in gawk. Maybe not so practical but they show some of gawk's capabilities. https://github.com/kevin-albert/awkserver https://github.com/kevin-albert/awkserver https://github.com/TheMozg/awk-raycaster https://github.com/TheMozg/awk-raycaster
    - vbrandl 3y ago
      There is a virus written in awk that infects other awk scripts[0]. And according to wikipedia, the language is Turing complete. [0]: https://github.com/SPTHvx/ezines/tree/main/dc5/CODES/Perforin/AWKward https://github.com/SPTHvx/ezines/tree/main/dc5/CODES/Perfori...

ajross 3y ago

Sorry, but that's ridiculous. Any general purpose programming language is a vector for bugs and security problems, but come on: you're genuinely trying to say that a kludge of bash+sed+awk is objectively more "secure" than a single perl script to solve the same problem?

coliveira 3y ago
In the case of awk, actually yes, it is safer. The reason is that awk is a very limited language. It has only enough functionality to provide text matching and substitution. It is very difficult to use awk to do anything of high security risk, compared to a language like perl.
- ajross 3y ago
  But awk is never used alone. You don't solve whole problems with awk, you squish it into a script with a bunch of other junk. My point is that you're making an apples-to-oranges comparison. Sure, "awk" isn't the problem, but "bash" is, and bash is undeniably a more error-prone language than perl. You surely agree with that much, right? And if you disallow "bash" for security reasons, where does that leave "awk" in the category of useful tools? See my point?
  - pletnes 3y ago
    You’re right. But the alternative might be bash + perl or just bash. Or none of them. Perl is anyway the first one to go.
    - TeMPOraL 3y ago
      Is it completely gone, or rather just for you, blocked by sysadmins who know Perl is the magic pixie dust for total control, and want to keep it for themselves? In Windows-land, compare how PowerShell access may be restricted, and you won't be allowed to run macros in Office, all while your computer is "managed" by a horrible hodge-podge of PowerShell and VBA scripts that make Perl code look like high literature.
  - coliveira 3y ago
    Just use awk for what it was designed: text search and substitution. You can run shell scripts along with awk, but that is clearly not what you should be doing if you want to design secure systems. The first rule of security is not to abuse your tools.
- rascul 3y ago
  > It has only enough functionality to provide text matching and substitution. Gawk at least can do a lot more than that. Reading and writing files, network communications, and run arbitrary shell commands, for example. It's certainly not as powerful as perl but it's also not limited to just text matching and substitution. Edit: figured I would provide some examples. Here's an http server and a first person shooter in gawk. Maybe not so practical but they show some of gawk's capabilities. https://github.com/kevin-albert/awkserver https://github.com/kevin-albert/awkserver https://github.com/TheMozg/awk-raycaster https://github.com/TheMozg/awk-raycaster
  - vbrandl 3y ago
    There is a virus written in awk that infects other awk scripts[0]. And according to wikipedia, the language is Turing complete. [0]: https://github.com/SPTHvx/ezines/tree/main/dc5/CODES/Perforin/AWKward https://github.com/SPTHvx/ezines/tree/main/dc5/CODES/Perfori...