4 ms·

Of course this exploits XPC. I really hate all the desktop IPC bullshit. IPC frameworks are pure fucking evil. COM, D-Bus, XPC, everything SUCKS. If you want

Of course this exploits XPC. I really hate all the desktop IPC bullshit. IPC frameworks are pure fucking evil. COM, D-Bus, XPC, everything SUCKS. If you want completely separate programs on one machine to talk, use UNIX domain sockets (with something like ZeroMQ or HTTP), FIFOs (named pipes), anything that you can chmod and chown, not a daemon that reinvents access control, badly.

deleted 12y ago
[deleted]
catern 12y ago
Well, this is a very trivial "exploit" of XPC. The real problem is that such an API even exists at all. I mean, a method to create an arbitrary file in an arbitrary location with arbitrary attributes? That is completely braindead. That is clearly equivalent to root privileges, and therefore such an API shouldn't exist - sudo should be used instead, or other OS X methods of explicitly gaining root privileges. This method wouldn't pass the most cursory of security checks. It's clear that it was never actually reviewed, and that the original programmer was relying on the proprietary nature of the OS X system for security. Something like this would never happen with Linux IPC - reviewing the methods published on dbus by services running as root by default is a basic check that any sane distro will do. Something as straightforwardly exploitable as this (literally just call the method while running as an admin user!) would never go in to Debian.
kenferry 12y ago
Hm? This wouldn't have been any better if implemented using sockets.
- FooBarWidget 12y ago
  Indeed, it wouldn't. It's just another typical example of someone who doesn't understand why a complicated IPC system exists, and thus blames all possible problems on its mere existence. It's like users who encounter a random problem in a program, and then blame it on the fact that the program is written in C++, simply because they do not like C++.
asanagi 12y ago
Is this a systemd thread? This looks like a systemd thread!
- ossreality 12y ago
  Full of emotional, uninformed, off-topic FUD-fueled rants? Yup, definitely a systemd thread!
awalton 12y ago
> I really hate all the desktop IPC bullshit. IPC frameworks are pure fucking evil. COM, D-Bus, XPC, everything SUCKS. > If you want completely separate programs on one machine to talk, use UNIX domain sockets D-Bus does use UNIX domain sockets. Your ruthless hate should probably try harder at informing itself.

deleted 12y ago

[deleted]

catern 12y ago

Well, this is a very trivial "exploit" of XPC. The real problem is that such an API even exists at all. I mean, a method to create an arbitrary file in an arbitrary location with arbitrary attributes? That is completely braindead. That is clearly equivalent to root privileges, and therefore such an API shouldn't exist - sudo should be used instead, or other OS X methods of explicitly gaining root privileges. This method wouldn't pass the most cursory of security checks. It's clear that it was never actually reviewed, and that the original programmer was relying on the proprietary nature of the OS X system for security. Something like this would never happen with Linux IPC - reviewing the methods published on dbus by services running as root by default is a basic check that any sane distro will do. Something as straightforwardly exploitable as this (literally just call the method while running as an admin user!) would never go in to Debian.

kenferry 12y ago

Hm? This wouldn't have been any better if implemented using sockets.

FooBarWidget 12y ago
Indeed, it wouldn't. It's just another typical example of someone who doesn't understand why a complicated IPC system exists, and thus blames all possible problems on its mere existence. It's like users who encounter a random problem in a program, and then blame it on the fact that the program is written in C++, simply because they do not like C++.

asanagi 12y ago

Is this a systemd thread? This looks like a systemd thread!

ossreality 12y ago
Full of emotional, uninformed, off-topic FUD-fueled rants? Yup, definitely a systemd thread!

awalton 12y ago

> I really hate all the desktop IPC bullshit. IPC frameworks are pure fucking evil. COM, D-Bus, XPC, everything SUCKS. > If you want completely separate programs on one machine to talk, use UNIX domain sockets D-Bus does use UNIX domain sockets. Your ruthless hate should probably try harder at informing itself.