Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 1 Mar 2006 16:19:32 -0500
From:      Wesley Shields <wxs@csh.rit.edu>
To:        Lowell Gilbert <freebsd-current-local@be-well.ilk.org>
Cc:        arch@freebsd.org, current@freebsd.org
Subject:   Re: HEADS UP: Importing csup into base
Message-ID:  <20060301211932.GA42815@csh.rit.edu>
In-Reply-To: <44mzg9ucpm.fsf@be-well.ilk.org>
References:  <20060301170306.GZ55746@elvis.mu.org> <4405F673.8060907@samsco.org> <44mzg9ucpm.fsf@be-well.ilk.org>

next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, Mar 01, 2006 at 03:33:41PM -0500, Lowell Gilbert wrote:
> Scott Long <scottl@samsco.org> writes:
> 
> > Maxime Henrion wrote:
> > > 	Hey all,
> > > I have released a new snapshot of csup a few minutes ago,
> > 
> > [...]
> > 
> > >   - Executes (shell commands sent by the server, even more rarely
> > > used),
> > 
> > Are you joking?
> 
> Are you asking whether he's joking about (1) the idea of ever
> implementing it, (2) the fact that he hasn't done it yet, or 
> (3) the idea that it's rarely used?  All of those sound 
> reasonable to me...

I'm questioning (1) myself.  This just seems like a bad idea from a
security perspective.  Of course, some kind of sanitization could
mitigate the issue.

-- WXS



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20060301211932.GA42815>