This goes directly to the PDF. It seems to be a useful research paper for people who want to get academic insights into setuid. For those who would like to rea

This goes directly to the PDF. It seems to be a useful research paper for people who want to get academic insights into setuid. For those who would like to read the first part of the introduction, here it is: "Access control in Unix systems is mainly based on user IDs, yet the system calls that modify user IDs (uid-setting system calls), such as setuid , are poorly designed, insufficiently documented, and widely misunderstood and misused. This has caused many security vulnerabilities in application programs. We propose to make progress on the setuid mystery through two approaches. First, we study kernel sources and compare the semantics of the uid-setting system calls in three major Unix systems: Linux, Solaris, and FreeBSD. Second, we develop a for- mal model of user IDs as a Finite State Automaton (FSA) and develop new techniques for automatic construction of such models." For guys like me, the way this concept is explained and how it tackles the supposed problem is a bit too difficult; it probably doesn't help that English isn't my first language and that I'm not an academic. The document also does not seem to contain a date of when it was written. Do I need to figure this out on my own? What would be nicer imo is if the poster can explain please, what makes this paper qualify as 'news.' Why did it end up here? After all, well you know, this place is called "Hacker News." But even beyond that -- Understanding why this was posted could already provide some useful context. Without that, when there's just a link (to a PDF!), the effect it has on me is the same as those "link-only comments": 99% of the time I skip right over them.