Re: [9fans] Debian bug 737206 - rc shell uses insecurely /tmp

2014-12-06 Thread erik quanstrom
> > +1. this is really an important point. think of all the mega person > > years you could save by doing the simple, systemic things to make > > the job of maintaining system easier. > > You are missing an even more important issue here: imagine how much > beneficial impact such a radical break

Re: [9fans] Debian bug 737206 - rc shell uses insecurely /tmp

2014-12-06 Thread lucio
> +1. this is really an important point. think of all the mega person > years you could save by doing the simple, systemic things to make > the job of maintaining system easier. You are missing an even more important issue here: imagine how much beneficial impact such a radical break with tradit

Re: [9fans] Debian bug 737206 - rc shell uses insecurely /tmp

2014-12-06 Thread Bruce Ellis
As in "I have ties older than your /tmp". On 7 December 2014 at 05:29, Charles Forsyth wrote: > > On Sat, Dec 6, 2014 at 5:22 AM, wrote: > >> 40 years on, you'd think someone would deal with it. > > > The point I was trying to make is that it was realised early on (eg, when > time-sharing at un

Re: [9fans] Debian bug 737206 - rc shell uses insecurely /tmp

2014-12-06 Thread Wes Kussmaul
On 12/06/2014 01:41 PM, erik quanstrom wrote: instead of fixing it, once for all. After 40 years (more than a generation). +1. this is really an important point. think of all the mega person years you could save by doing the simple, systemic things to make the job of maintaining system eas

Re: [9fans] Debian bug 737206 - rc shell uses insecurely /tmp

2014-12-06 Thread erik quanstrom
> Now look at that number: 40. Four decades. During that time there > has been any amount of foolish crud added to this or that kernel, > distribution ,graphics subsystem, standards, ... but instead of > fixing it after 4 0 years, we get notes explaining that it's the > application's business, i

Re: [9fans] Debian bug 737206 - rc shell uses insecurely /tmp

2014-12-06 Thread Charles Forsyth
On Sat, Dec 6, 2014 at 5:22 AM, wrote: > 40 years on, you'd think someone would deal with it. The point I was trying to make is that it was realised early on (eg, when time-sharing at universities) that a shared /tmp was a problem. Hacks such as +s or special schemes for allocating files don't

Re: [9fans] Debian bug 737206 - rc shell uses insecurely /tmp

2014-12-05 Thread lucio
> I'd still fix /tmp, myself. It does nothing but fester. Even the PDP-11 it > was a nuisance. > 40 years on, you'd think someone would deal with it. Are you being intentionally ambiguous, Charles? /tmp/ in Unix (my guess) or /tmp/ in Plan 9 (quantum forbid!) as Unix aficionados may choose to int

Re: [9fans] Debian bug 737206 - rc shell uses insecurely /tmp

2014-12-05 Thread Bruce Ellis
Well I hope he has fun fixing a sandwich. Your words ... "because Debian people are not very good at doing things correctly". On 5 December 2014 at 15:14, Kurt H Maier wrote: > Quoting Bruce Ellis : > > Don't these people have better things to do than finding non-bugs in >> systems they don't

Re: [9fans] Debian bug 737206 - rc shell uses insecurely /tmp

2014-12-05 Thread Charles Forsyth
> Aren't they talking about rc when running on their operating system? I'd still fix /tmp, myself. It does nothing but fester. Even the PDP-11 it was a nuisance. 40 years on, you'd think someone would deal with it.

Re: [9fans] Debian bug 737206 - rc shell uses insecurely /tmp

2014-12-05 Thread David L. Craig
On 14Dec04:2238-0500, s...@9front.org wrote: > Aren't they talking about rc when running on their operating system? Certainly. It serves as a textbook example of inadequate software porting due to insufficient understanding of the differences between the source and target environments. Once the

Re: [9fans] Debian bug 737206 - rc shell uses insecurely /tmp

2014-12-04 Thread Kurt H Maier
Quoting Bruce Ellis : Don't these people have better things to do than finding non-bugs in systems they don't understand? brucee This bug is being reported against 9base, which is a port of stuff to unix similar to (and based on) plan9port. He is reporting it to 9fans and 9trouble because De

Re: [9fans] Debian bug 737206 - rc shell uses insecurely /tmp

2014-12-04 Thread sl
Aren't they talking about rc when running on their operating system? sl

Re: [9fans] Debian bug 737206 - rc shell uses insecurely /tmp

2014-12-04 Thread Skip Tavakkolian
+1 😄 > On Dec 4, 2014, at 7:08 PM, Bruce Ellis wrote: > > Don't these people have better things to do than finding non-bugs in systems > they don't understand? > > brucee > >> On 5 December 2014 at 13:33, Charles Forsyth >> wrote: >> >>> On Wed, Dec 3, 2014 at 11:49 PM, Stéphane Aulery w

Re: [9fans] Debian bug 737206 - rc shell uses insecurely /tmp

2014-12-04 Thread Bruce Ellis
Don't these people have better things to do than finding non-bugs in systems they don't understand? brucee On 5 December 2014 at 13:33, Charles Forsyth wrote: > > On Wed, Dec 3, 2014 at 11:49 PM, Stéphane Aulery wrote: > >> discovered that rc >>creates temporary files in an insecure way: >

Re: [9fans] Debian bug 737206 - rc shell uses insecurely /tmp

2014-12-04 Thread Charles Forsyth
On Wed, Dec 3, 2014 at 11:49 PM, Stéphane Aulery wrote: > discovered that rc >creates temporary files in an insecure way: > rc was built for a system that made /tmp secure by not sharing it (it's always private to a user and even sometimes to a set of processes). That way not every app has t

[9fans] Debian bug 737206 - rc shell uses insecurely /tmp

2014-12-04 Thread Stéphane Aulery
Hello, I make you pass an open bug report on the Debian bts about rc. I do not know to whom I should speak. The code comes from 9base, who just plan9port, etc. Here is the report [1]: Package: 9base Version: 1:6-6 Severity: important Tags: security Murray McAllister from Red Hat