Small typo - it is Tavis Ormandy, not Ormary
> we have previously seen memory corruption bugs leading to RCE by Tavis Ormary in Microsoft Notepad
Man who thought opening a TXT file is fine thought wrong
71–80 of 316 posts
Re: Man who thought opening a TXT file is fine thought wrong
#72Earlier quoted context omitted.
Not really outside. The metadata was stored in a so-called "resource fork", with the file contents proper in a "data fork", both of which belonged to the file per se. Part of the resource fork was the "creator code", four bytes identifying the application which had created or could open the file, and the "type code", four more bytes defining which, among the potentially many kinds of files a given application could o…
I was in my tweens/early teens when I learned about ResEdit. I thought it was some kind of hacker tool, and I was amused at the various things I could change.
I used to add menu items (that didn’t do anything), I was able to change picture/icon resources inside apps, all kinds of fun stuff. Change command mapping, etc
Re: Man who thought opening a TXT file is fine thought wrong
#73Earlier quoted context omitted.
I disagree. Many of Apple's user-base believes that the platform is immune from viruses and malware. It's important to get the message out that it's no better (and may be worse) than other popular platforms. Especially since Apple claims their platform is "secure by design."
I don't think it can be worse than Windows. Not immune, but definitely not worse.
Windows has a very good built-in antivirus now that protects you from pretty much all but 0-day vulnerabilities.
Really I don't think you can draw any big comparisons here anymore nowadays - Apple's security on mac OS is sandboxing and signing, the latter of which power users will have turned off and the prior being inapplicable in this case.
Re: Man who thought opening a TXT file is fine thought wrong
#74The link provided in the article to HTTPLeaks required some sort of login for me. Here is the direct link:
* https://github.com/cure53/HTTPLeaks
There are a lot of ways HTML can leak information. HTTPLeaks is an attempt to create a test for all such leaks. Unfortunately, people keep inventing new ways for HTML interpretation to leak data. The article describes a particularly clever approach accidentally implemented by Apple.
Re: Man who thought opening a TXT file is fine thought wrong
#75File extensions are a kludge anyway. (And Windows 10 still hides them by default, because hey, backwards compatibility, and you wouldn't want to confuse Grandma who's seen the file be called "grandkids" since Windows 95..). Why should the filetype be dependent on the name? People even think renaming a .BMP to .JPG means now it's a compressed file! Old school Macs stored the filetype outside of a file, so you can rena…
On the contrary, it's a simple and explicit (when not stupidly hidden...) way of denoting the file type, which is great for interoperability and information interchange.
Proprietary, opaque mechanisms like resource forks only serve to keep users uninformed (and thus unlearning) and impede the free interchange of information between different applications.
Re: Man who thought opening a TXT file is fine thought wrong
#76Two words: excessive complexity. It's always seemed strange that an application called TextEdit is actually more than a text editor. I strongly believe that content-type autodetection, much less HTML rendering(!), most certainly does not belong in a text editor.
shoulda used 'cat
Re: Man who thought opening a TXT file is fine thought wrong
#77Earlier quoted context omitted.
Huh, I didn’t experience this problem. The problem appears to be unique to Chrome. It doesn't show up in Firefox or Safari.
That's really rare! Someone take a photo!
It's not really rare. Chrome tends to be a bit more "adventurous" and experimental, while Safari and Firefox are a bit more conservative. So it's not uncommon to see a few weird issues show up in Chrome.
Re: Man who thought opening a TXT file is fine thought wrong
#78To this day osx still doesn't ship with a true plaintext gui editor.
It also doesn't ship with a paint program. OSx has a lot of ground to cover before it can function as a decent desktop OS.
preview's basic annotation functions cover most of what paint can do, or am i missing something?
Re: Man who thought opening a TXT file is fine thought wrong
#79Earlier quoted context omitted.
I don't really understand why browsers allow it!
the browsers cannot control a dev that uses AJAX to continually redraw the page without causing the browser to update the history/location. typically a sign of a) a dev new to AJAX or b) a solo dev that created a PoC that got turned into a product with very little thought about things like history/state/etc. I myself am an option B person.
Thanks; I definitely don’t and can’t claim to understand the “front end” at this point. Your comment was enlightening.
Re: Man who thought opening a TXT file is fine thought wrong
#80Earlier quoted context omitted.
Yes, and it sounded great on paper but was horrible for interoperability because a file was not self contained from the POV of filesystems that didn't support the resource fork. Every file you wanted to distribute cross platform needed 2 versions. One with all that metadata bundled up for Mac, one without it for everything else. It was a nightmare OS-X dropped it for good reason.
>but was horrible for interoperability This makes me sad - it was dropped because of problems with other operating systems , not because it was necessarily a bad architecture. I understand why they would do it, but it makes you wonder how much better our systems could be if it weren't for concerns about legacy.
> This makes me sad - it was dropped because of problems with other operating systems, not because it was necessarily a bad architecture.
No, it was dropped because it was designed without enough forethought given to how that metadata would be transmitted over the wire or when multiple files were bundled consistently. Even if every OS used this scheme a better solution to these problems would have to have been devised.
Are extensions perfect? No, they suck. But yet solve this metadata transfer problem "good enough" and therefore won the war.
PS - There was also a lack of user management tools/feedback on a lot of systems, for example changing the "file type" was often impossible out of the box, and the file types often unclear unless you went into details/properties on purpose (a potential security headache, up there with hidden extensions ala Windows).