Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!1.eu.feeder.erje.net!eternal-september.org!feeder.eternal-september.org!mx02.eternal-september.org!.POSTED!not-for-mail From: Paul Rubin Newsgroups: comp.arch.embedded,comp.lang.forth Subject: Re: Mecrisp on the TI Stellaris Launchpad Date: Fri, 17 Apr 2015 07:56:45 -0700 Organization: A noiseless patient Spider Lines: 23 Message-ID: <87618u951u.fsf@jester.gateway.pace.com> References: <87618vyb8d.fsf@jester.gateway.pace.com> <5530e603$0$21217$e4fe514c@dreader37.news.xs4all.nl> Mime-Version: 1.0 Content-Type: text/plain Injection-Info: mx02.eternal-september.org; posting-host="bda44be170c76b3ef6d23fecd204a8fa"; logging-data="8171"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1+KsG2Baw/c6HMP8Mmq+ekW" User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.3 (gnu/linux) Cancel-Lock: sha1:IB1iGEPEQvssUdY4dG6gK5sKkj0= sha1:pEBlgnb5Nh6b0O01eQAs3O0RtrE= Xref: csiph.com comp.arch.embedded:20670 comp.lang.forth:38275 albert@spenarnc.xs4all.nl (Albert van der Horst) writes: > Not correct. The PATH for finding executables is fully under control. > It is urban legend that there is a security leak by having de current > directory in the PATH. ("someone could have sneaked an ls in your directory > that installs a rootkit.") No it wasn't an urban legend, it was a real issue. In the old days "." was the first thing on the path and there were actual incidents of what you described. E.g. you'd be a sysadmin of some university timesharing system, you'd get told that some student had porn in his home directory, you'd cd to the directory and type "ls" as root, and hilarity ensues. I think there is a paper by Fred Grampp about this, that introduced the practice of getting "." off of the standard path. > This is nonsensical for normal users. I'd say it's still not nonsensical: you unpack an archive, cd to it and type "ls", same situation. Or even in non-malicious cases, someone might have chosen a program name that wasn't a standard Unix command, but that happened to match something that you used and was on your path. Like I think there are at least 2 different Forth implementations called pforth. So maybe you use one of them and the directory you cd to has the other one, so you type "pforth" and get the wrong one, etc.