4 ms·

Did this article make you angry? Why do you call it a trainwreck?

by ajkjk 11y ago

rylee 11y ago
The article is literally "If you tell these utilities to execute this script, they'll execute this script". NONE of these should be "unexpected".
- jjoonathan 11y ago
  Not the point. Of course it's not surprising that these utilities will execute scripts if you tell them to. The unexpected fact is that you can tell them to -- and that this is documented behavior which probably isn't going away. If your argument was that no programmer should be surprised that you can tell an archive utility to execute an arbitrary script, then you and the author of the post are in complete agreement. The remaining difference is that the article actually does something to fix the problem while you merely hurl an implicit insult at anyone who hasn't seen this type of privilege escalation yet. One of these actions is more constructive than the other.
  - d23 11y ago
    > you merely hurl an implicit insult at anyone who hasn't seen this type of privilege escalation yet You and I have vastly different opinions on what constitutes privilege escalation.
    - jjoonathan 11y ago
      I'm not a security researcher. Care to recommend a more appropriate term for the data -> execution stage as opposed to the user -> root stage which is more commonly associated with the term "privilege escalation"?
- ajkjk 11y ago
  I don't disagree, but, as a relative novice with shell scripts, I definitely did not realize so many tools could execute arbitrary code. The parent post's anger and disgust is misplaced, though. This article is informative at a novice level, and well-written to that level. Not a trainwreck.
jcape 11y ago
Because it is treating all of these intended side-effects of using a shell as though they are security vulnerabilities. The problem is that there is a way for untrusted user input to ever touch a shell in the first place. Seriously, I challenge you to find a language reference that doesn't decry the use of their version of system(3)---because all that does is run the given command under the user's shell.
- ajkjk 11y ago
  Sure, fine, but why the anger? Why the 'trainwreck'? that's not constructive at all. The article definitely didn't claim these were security vulnerabilities - only that they were surprising. Some of these were surprising to me too. Am I an idiot for not knowing these? (no, I'm not, I'm just a novice). It's really aggravating to learn something from an article that is making someone more knowledgeable this angry without explanation.

Did this article make you angry? Why do you call it a trainwreck?

by ajkjk 11y ago

Did this article make you angry? Why do you call it a trainwreck?

rylee 11y ago

The article is literally "If you tell these utilities to execute this script, they'll execute this script". NONE of these should be "unexpected".

jjoonathan 11y ago
Not the point. Of course it's not surprising that these utilities will execute scripts if you tell them to. The unexpected fact is that you can tell them to -- and that this is documented behavior which probably isn't going away. If your argument was that no programmer should be surprised that you can tell an archive utility to execute an arbitrary script, then you and the author of the post are in complete agreement. The remaining difference is that the article actually does something to fix the problem while you merely hurl an implicit insult at anyone who hasn't seen this type of privilege escalation yet. One of these actions is more constructive than the other.
- d23 11y ago
  > you merely hurl an implicit insult at anyone who hasn't seen this type of privilege escalation yet You and I have vastly different opinions on what constitutes privilege escalation.
  - jjoonathan 11y ago
    I'm not a security researcher. Care to recommend a more appropriate term for the data -> execution stage as opposed to the user -> root stage which is more commonly associated with the term "privilege escalation"?
ajkjk 11y ago
I don't disagree, but, as a relative novice with shell scripts, I definitely did not realize so many tools could execute arbitrary code. The parent post's anger and disgust is misplaced, though. This article is informative at a novice level, and well-written to that level. Not a trainwreck.

jcape 11y ago

Because it is treating all of these intended side-effects of using a shell as though they are security vulnerabilities. The problem is that there is a way for untrusted user input to ever touch a shell in the first place. Seriously, I challenge you to find a language reference that doesn't decry the use of their version of system(3)---because all that does is run the given command under the user's shell.

ajkjk 11y ago
Sure, fine, but why the anger? Why the 'trainwreck'? that's not constructive at all. The article definitely didn't claim these were security vulnerabilities - only that they were surprising. Some of these were surprising to me too. Am I an idiot for not knowing these? (no, I'm not, I'm just a novice). It's really aggravating to learn something from an article that is making someone more knowledgeable this angry without explanation.