Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!news.mixmin.net!feeds.phibee-telecom.net!newsfeed.xs4all.nl!newsfeed3.news.xs4all.nl!xs4all!newsgate.cistron.nl!newsgate.news.xs4all.nl!post.news.xs4all.nl!not-for-mail Return-Path: X-Original-To: python-list@python.org Delivered-To: python-list@mail.python.org X-Spam-Status: OK 0.017 X-Spam-Evidence: '*H*': 0.97; '*S*': 0.00; 'subject:text': 0.05; 'subject:Python': 0.06; 'subject:file': 0.07; 'subject:script': 0.09; 'cc:addr:python-list': 0.11; 'fetch': 0.16; 'from:addr:rosuav': 0.16; 'from:name:chris angelico': 0.16; 'wrote:': 0.18; 'code.': 0.18; 'all,': 0.19; 'thu,': 0.19; 'cc:addr:python.org': 0.22; 'exists': 0.24; 'scroll': 0.24; 'cc:2**0': 0.24; 'header:In-Reply-To:1': 0.27; 'chris': 0.29; 'dec': 0.30; 'message-id:@mail.gmail.com': 0.30; 'agreed.': 0.31; "d'aprano": 0.31; 'steven': 0.31; 'file': 0.32; 'probably': 0.32; 'run': 0.32; 'another': 0.32; 'text': 0.33; 'open': 0.33; 'linux': 0.33; 'third': 0.33; 'could': 0.34; 'editor': 0.35; 'but': 0.35; 'received:google.com': 0.35; 'there': 0.35; 'subject:data': 0.36; 'effort': 0.37; 'problems': 0.38; 'pm,': 0.38; 'skip:u 10': 0.60; 'worth': 0.66; 'believe': 0.68; 'benefit': 0.68; 'gain': 0.79; 'discovered': 0.83; 'to:none': 0.92 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:cc :content-type; bh=FxKv32/C+LITGT3SuTZUe+gvg1IXZ+vSAXtTc0wpJBs=; b=NS6ViDOASKoD6oImfvSRyOfGchbb9nFdQrpOoapBwNbQPQqGV1H9I2crZw8mFjXnBs Gg0/k7TCt/a71MCGScrsGXrEQePKOMEayFtqinHDthzLZwqNJxKTogHVjFf/p9uzDHXa byXVF05fIFPu1n0wDPD8QUbGKN9Ob6WfDpCOHkSOxgjn5PnKZDKFkw01eH4/EU52MRQE 30YviBPBvlc+ZzF9LR19XohCyVknnSmUqoYL2OO9GG8iaf9SX8RSra/kamUxl87Tu2Cs zCqhMB8oJPK/slsl/KeQM3/cqRVeVzZFunrBbfrN8AoROMse+4bpCvDGAe3dwc3R/Jnl kSyQ== MIME-Version: 1.0 X-Received: by 10.50.61.140 with SMTP id p12mr11561099igr.34.1418266209366; Wed, 10 Dec 2014 18:50:09 -0800 (PST) In-Reply-To: <54890472$0$2817$c3e8da3$76491128@news.astraweb.com> References: <6da205c3-f6b9-411a-b880-0b0386ea09ac@googlegroups.com> <54890472$0$2817$c3e8da3$76491128@news.astraweb.com> Date: Thu, 11 Dec 2014 13:50:09 +1100 Subject: Re: Python script isn't producing text in data file From: Chris Angelico Cc: "python-list@python.org" Content-Type: text/plain; charset=UTF-8 X-BeenThere: python-list@python.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: General discussion list for the Python programming language List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Newsgroups: comp.lang.python Message-ID: Lines: 20 NNTP-Posting-Host: 2001:888:2000:d::a6 X-Trace: 1418266212 news.xs4all.nl 2968 [2001:888:2000:d::a6]:33504 X-Complaints-To: abuse@xs4all.nl Xref: csiph.com comp.lang.python:82325 On Thu, Dec 11, 2014 at 1:41 PM, Steven D'Aprano wrote: > On Thu, 11 Dec 2014 12:44:51 +1100, Chris Angelico wrote: > >> Agreed. There are ways around some of those problems (eg using wget to >> fetch something, and then looking at it in a text editor - it's hard to >> get pwned through a text editor... though I won't say impossible), but >> there are other issues too, and all in all, it's just best to include >> the text in-line. > > I believe that there was a recently discovered exploit on Linux where > viewing a file with "less" could run arbitrary code. Which is why I refused to say "impossible" :) Although you gain the additional benefit of an unpredictable attack vector; one person might use 'less', another might open it in SciTE, a third might just cat the file and scroll through it some other way. It's hard to aim at a target that exists in so many pieces, and probably isn't worth the effort of attacking. ChrisA