Path: csiph.com!usenet.pasdenom.info!aioe.org!news.stack.nl!newsfeed.xs4all.nl!newsfeed4.news.xs4all.nl!xs4all!newsgate.cistron.nl!newsgate.news.xs4all.nl!post.news.xs4all.nl!not-for-mail
Return-Path: <rosuav@gmail.com>
X-Original-To: python-list@python.org
Delivered-To: python-list@mail.python.org
X-Spam-Status: OK 0.002
X-Spam-Evidence: '*H*': 1.00; '*S*': 0.00; 'scripts': 0.03; 'that?': 0.05; '(b)': 0.07; 'binary': 0.07; 'steve': 0.09; '22,': 0.09; 'executable': 0.09; 'worked,': 0.09; 'worse': 0.09; 'cc:addr :python-list': 0.11; 'random': 0.14; "wouldn't": 0.14; '"hello': 0.16; '(windows': 0.16; 'from:addr:rosuav': 0.16; 'from:name:chris angelico': 0.16; 'hayes': 0.16; 'pity': 0.16; 'wrote:': 0.18; 'user.': 0.19; 'cc:addr:python.org': 0.22; '(a)': 0.24; 'initial': 0.24; 'mon,': 0.24; '(or': 0.24; 'cc:2**0': 0.24; 'second': 0.26; 'downloaded': 0.26; 'header:In-Reply-To:1': 0.27; "doesn't": 0.30; 'dec': 0.30; 'message-id:@mail.gmail.com': 0.30; 'code': 0.31; "d'aprano": 0.31; 'men': 0.31; 'steven': 0.31; 'run': 0.32; 'running': 0.33; 'but': 0.35; 'received:google.com': 0.35; 'really': 0.36; 'disk': 0.36; "didn't": 0.36; 'should': 0.36; 'pm,': 0.38; 'though,': 0.39; 'major': 0.40; 'how': 0.40; "you're": 0.61; 'save': 0.62; 'kind': 0.63; 'maximum': 0.63; 'internet': 0.71; 'subject:Hello': 0.72; 'malicious': 0.84; 'safe.': 0.84; 'scary.': 0.84; 'subject:World': 0.91; 'to:none': 0.92
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:cc :content-type; bh=WrTOhBewvEmf82A1+PJVSPpaL2ej6CE53ZKYTUUF4Uw=; b=rF9p6H/lFDkptVYU/7iO++37bgnUQA6Gfw/FFtdn0sAi5qH9Ar/4dtYBen0gHTLIpW oNYfwuKH1+F4fX3L9pV3DXt6BXQJ5hmVI4sCrIpzPaZcjFYFpaT32nk5zfCZrQioYx9i 1bXj2AIu7w4Tx+ziyVKk5qTNsyies3R44fDdUXan7uvEZnzlqA538wBpxLNKQjJz5+Qc ZpezS2KJgIhZJhD083yseZWC38QMR8xqbkbyrGlNo2CMsE2XYkp2ojGOlzQD/8+qMKJn pCLKuisSKm0yoUubj9991d8o6cFzFTbhvrAOUqbDASYkVHaz1zKUXfgTEAp3Ssl3LxpB ttVQ==
MIME-Version: 1.0
X-Received: by 10.107.7.94 with SMTP id 91mr18630524ioh.27.1419229990801; Sun, 21 Dec 2014 22:33:10 -0800 (PST)
In-Reply-To: <0udf9a1m3n02rt06a5ib58mvifm7sdeg31@4ax.com>
References: <54957226$0$12975$c3e8da3$5496439d@news.astraweb.com> <54971df7$0$30820$b1db1813$ba2d9d20@news.astraweb.com> <54974ed7$0$12986$c3e8da3$5496439d@news.astraweb.com> <0udf9a1m3n02rt06a5ib58mvifm7sdeg31@4ax.com>
Date: Mon, 22 Dec 2014 17:33:10 +1100
Subject: Re: Hello World
From: Chris Angelico <rosuav@gmail.com>
Cc: "python-list@python.org" <python-list@python.org>
Content-Type: text/plain; charset=UTF-8
X-BeenThere: python-list@python.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: General discussion list for the Python programming language <python-list.python.org>
List-Unsubscribe: <https://mail.python.org/mailman/options/python-list>, <mailto:python-list-request@python.org?subject=unsubscribe>
List-Archive: <http://mail.python.org/pipermail/python-list/>
List-Post: <mailto:python-list@python.org>
List-Help: <mailto:python-list-request@python.org?subject=help>
List-Subscribe: <https://mail.python.org/mailman/listinfo/python-list>, <mailto:python-list-request@python.org?subject=subscribe>
Newsgroups: comp.lang.python
Message-ID: <mailman.17110.1419229999.18130.python-list@python.org>
Lines: 26
NNTP-Posting-Host: 2001:888:2000:d::a6
X-Trace: 1419229999 news.xs4all.nl 2934 [2001:888:2000:d::a6]:52565
X-Complaints-To: abuse@xs4all.nl
Xref: csiph.com comp.lang.python:82755

On Mon, Dec 22, 2014 at 5:21 PM, Steve Hayes <hayesstw@telkomsa.net> wrote:
> Yes, my initial reaction was "that's awesome".
>
> And my second thought was that it was scary.
>
> I ran it. It worked, and printed "Hello world". I was awed.
>
> But what if I had run it and it reformatted my hard disk?
>
> How would I have known that it would or wouldn't do that?

You trust that (a) Steven D'Aprano isn't going to give you outright
malicious code (or that he trusts that the original author won't), and
that (b) your hard disk cannot be reformatted by a non-root user.
Every major platform has this kind of privilege separation (Windows
doesn't call it "root" but "Administrator", but the effect is, AIUI,
equivalent), so unless you're running random scripts from the internet
with maximum privileges, you should be safe.

Frankly, though, it's no worse than downloading binary code from the
internet and running it. How do you know that the executable you just
downloaded really is what it claims to be, that you didn't get some
MITM shipping you a malicious binary? Yet men and women do this every
day, with none to say "Oh the pity of it", save me and fools like me.

ChrisA