Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

  > The same class of issue can occur for any other project
This class of issues sounds like the prolific class of

  DON'T WRITE TO /tmp
Which is why systemd has a private tmp option

https://salvatoresecurity.com/the-many-perils-of-tmp/

https://systemd.io/TEMPORARY_DIRECTORIES/



Safely writing to /tmp/ was solved in 1986. Personally I would consider this class of bug the "idiot software developer" class (or to be more charitable: "security-illiterate software developer"). My evidence? There are (at least) six different OS primitives that will avoid this bug.


  > Safely writing to /tmp/ was solved in 1986
If you RTFA you'll read (under "What is the issue?")

  > This file, /tmp/framer.txt, may be readable by other users on the remote host.
This is EXACTLY a non-safe writing to /tmp

Yes, there are safe ways to write to /tmp, as described in the systemd link I provided, but no, it is not safe to naively write to /tmp. Same issue as the "Many Perils of /tmp" link I provided.

A solution that no one uses is not a solution.

If you're gonna be arrogant, you better also be right.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: