Re: [dev] [sbase] [patch] Adding tar v2

2013-07-17 Thread Nick
On Wed, Jul 17, 2013 at 04:50:03PM +, Bjartur Thorlacius wrote: > If you're just interacting with > a shell, you should be using a simple I/O text window, with or > without autocompletion. I would very much like this to exist, using non-monospaced fonts. It wouldn't be hard to knock something

Re: [dev] [sbase] [patch] Adding tar v2

2013-07-17 Thread Bjartur Thorlacius
On 07/17/2013 01:52 PM, Markus Wichmann wrote: I do partially. That is, I usually list the archive before unpacking, but I don't visually scan each and every entry, because, for one, I use st, so no scrollback buffer (I refuse to run a terminal multiplexer in an environment, were it is never goin

Re: [dev] [sbase] [patch] Adding tar v2

2013-07-17 Thread Truls Becken
On 2013-07-17, at 15:52, Markus Wichmann wrote: > Speaking of which, is anyone up for some suckless binutils? Rob Landley has some vaporware here: http://landley.net/qcc/ -Truls

Re: [dev] [sbase] [patch] Adding tar v2

2013-07-17 Thread Markus Wichmann
On Tue, Jul 16, 2013 at 08:58:49AM +0100, Nick wrote: > Quoth Chris Down: > > On 14 July 2013 20:42, Nick wrote: > > > I'd be inclined to check for and filter out leading .. and / > > > characters, to avoid tarballs doing unexpectedly evil things. > > > > I think all security onus for stuff like

Re: [dev] [sbase] [patch] Adding tar v2

2013-07-16 Thread Dmitrij Czarkoff
On Jul 16, 2013 9:58 AM, "Nick" wrote: > > Going back to the workflow question, then, who here always checks > the list of all files in an archive to check that there's nothing > with a suspicious path? I always check to see whether content is going to be placed into separate directory. Dmi

Re: [dev] [sbase] [patch] Adding tar v2

2013-07-16 Thread Thorsten Glaser
Nick dixit: >What other evil things can tar creators do? Symlinks with st_nlink ≠ 1 for one ☹ need to fix that in paxmirabilis (MirCPIO) too. bye, //mirabilos -- 17:08⎜«Vutral» früher gabs keine packenden smartphones und so 17:08⎜«Vutral» heute gibts frauen die sind facebooksüchtig 17:10⎜«Vutra

Re: [dev] [sbase] [patch] Adding tar v2

2013-07-16 Thread Carlos Torres
On Jul 16, 2013 3:58 AM, "Nick" wrote: > > Quoth Chris Down: > > On 14 July 2013 20:42, Nick wrote: > > > I'd be inclined to check for and filter out leading .. and / > > > characters, to avoid tarballs doing unexpectedly evil things. > > > > I think all security onus for stuff like that should b

Re: [dev] [sbase] [patch] Adding tar v2

2013-07-16 Thread Nick
Quoth Chris Down: > On 14 July 2013 20:42, Nick wrote: > > I'd be inclined to check for and filter out leading .. and / > > characters, to avoid tarballs doing unexpectedly evil things. > > I think all security onus for stuff like that should be on the user -- > they can still do unexpectedly evi

Re: [dev] [sbase] [patch] Adding tar v2

2013-07-14 Thread Chris Down
On 14 July 2013 20:42, Nick wrote: > Quoth Galos, David: >> Thanks in large part to your information about how you invoke tar, I >> believe I have come up with a decent solution. I also was able to >> find the structified version of tar I had worked on in the past. > > I'd be inclined to check for

Re: [dev] [sbase] [patch] Adding tar v2

2013-07-14 Thread Nick
Quoth Galos, David: > Thanks in large part to your information about how you invoke tar, I > believe I have come up with a decent solution. I also was able to > find the structified version of tar I had worked on in the past. I'd be inclined to check for and filter out leading .. and / characters

Re: [dev] [sbase] [patch] Adding tar v2

2013-07-12 Thread Truls Becken
On 2013-07-12, at 17:30, David Galos wrote: > The argument parsing is a bit ugly, so simplifications are welcome, > provided they keep the current functionality The goto seems uncalled for. An ordinary if does the job equally well. Also, I wonder if a mode variable isn't just as simple as the flg