Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Man who thought opening a TXT file is fine thought wrong

paulosyibelo.com

Post reply on HN
Print view View original

161–170 of 316 posts

Re: Man who thought opening a TXT file is fine thought wrong

#161

Post by jolux »

philistine wrote: post #157
jolux wrote: post #83

Earlier quoted context omitted.

>you'd be surprised by how few people actually "target" Windows devices What do you mean by this? As a percentage of malware it's not even close, Windows is far and away the most targeted platform: https://www.pcmag.com/news/windows-computers-account-for-83-...

Wow. I would have expected Android to be so much higher. For all the poorest people in the world who never owned a computer and have Internet access through an Android device, this is a great statistic.

Phones are much more secure than desktops.

Re: Man who thought opening a TXT file is fine thought wrong

#162

Post by 13of40 »

userbinator wrote: post #56

Two words: excessive complexity. It's always seemed strange that an application called TextEdit is actually more than a text editor. I strongly believe that content-type autodetection, much less HTML rendering(!), most certainly does not belong in a text editor.

Here's an interesting quirk in Windows: There are two APIs to execute external programs, CreateProcess and ShellExecute. CreateProcess is the older of the two and only runs executables. ShellExecute opens the target with whatever app is associated with the extension.

When they shoehorned the ShellExecute behavior into cmd.exe, they basically just said "if (!CreateProcess(foo)) {ShellExecute (foo)}"

As a result, if you take "foo.exe" and rename it "foo.txt" then try to run it like "C:\>foo.txt" from the command line, it will run as an executable instead of opening in Notepad like you would expect. Do the same with a real text file (that doesn't start with "MZ") and it opens in Notepad.

Re: Man who thought opening a TXT file is fine thought wrong

#163

Post by 1MachineElf »

ethbr0 wrote: post #125
jjtheblunt wrote: post #108

Earlier quoted context omitted.

I think it carries over from NeXTstep, iirc.

It feels like a choice when "net" meant "my campus network", not "the internet." Because why would you be connected to the internet all the time? And how could you even afford those long distance calls?

Because why would you be connected to the internet all the time? And how could you even afford those long distance calls?

That one East German guy in Cliff Stoll's The Cuckoo's Egg found a creative answer for both of those.

Re: Man who thought opening a TXT file is fine thought wrong

#165

Post by jrochkind1 »

perryizgr8 wrote: post #114
jrochkind1 wrote: post #106

Earlier quoted context omitted.

I too have been annoyed to not have a simple bundled paint program (I remmeber MacPaint!), but bundled application software is not really what determines whether an OS is a decent desktop OS.

It's not the only factor, but definitely one of the most important ones.

Why would the quality of an OS be determined by what apps come bundled with it? An OS is a different thing than applications, it's what the applications run on. I think you have an unusual viewpoint.

Re: Man who thought opening a TXT file is fine thought wrong

#166

Post by jrochkind1 »

slrz wrote: post #127
jrochkind1 wrote: post #102

Earlier quoted context omitted.

From the OP it sounds like there is a very weird feature/component in MacOS called "AutoMount" and/or "AutoFS" that lets HTTP GET network requests be made via reading file system locations... and it may somehow escape other access controls? I too am curious for more details about this. Where did this feature come from, how has it been used, has it actually been used? Is AutoMount/AutoFS still there after this CVE pat…

I don't think this is doing any HTTP. Autofs is generally used to mount remote file systems like NFS shares. It's pretty common on Unix-like systems (especially in multi-user environments) and not at all specific to macOS. References: https://wiki.archlinux.org/index.php/autofs https://www.freebsd.org/cgi/man.cgi?query=autofs&sektion=5 https://access.redhat.com/documentation/en-us/red_hat_enterp...

The only thing I know about this is what I learned from the OP reporting the vulnerability. Maybe I was mistaken the request was HTTP? Anyway, rest applies, assuming the article is correct in describing the nature of the vulnerability.

Anyway, if this is how TextEdit got around macos access controls related to network activity, I wonder if this is a route for other apps, including malicious ones, to get around it too?

> After digging into OSX internals, I came across the AutoMount feature that lets file:/// urls make remote requests. AutoFS is a program on OSX that uses the kernel to make a mounting request to a drive. Automount can also make remote requests to an external drive. Doing 'ls /net/EXAMPLE.com' forces OSX send a remote request to EXAMPLE.com

> While they did a good job blocking TextEdit from making external requests, this was the one thing they forgot when they allowed file:/// scheme, on OSX file:///net/11.22.33.44/a.css connects to 11.22.33.44.

Re: Man who thought opening a TXT file is fine thought wrong

#167

Post by Wowfunhappy »

jaxn wrote: post #137
Wowfunhappy wrote: post #101

Earlier quoted context omitted.

Text ≠ Plain Text. TextEdit defaults to rtf. It supports html as an alternative to rtf, which is to say it can do basic formatting and nothing else. It's perfectly reasonable to expect a text editor to support more than literal unicode, and to work with a variety of commonly-used formats.

But is it reasonable to treat a .txt as anything other than plain text?

No, it’s definitely not, that’s a separate problem!

Re: Man who thought opening a TXT file is fine thought wrong

#168

Post by unnouinceput »

Oh, what do you know, Apple is using the same shitty playbook that Microsoft used and outgrew off from 90's. Remember when opening and interpreting everything by default was the source of all kind of malware because Microsoft thought usability/convenience must trump security? I remember. Nowadays they toned that down: - no more macros enabled by default, no more default autoplay, no more automatically opening mail attachments in Outlook, and definitely Notepad doesn't interpret HTML tags within anything you threw at, including .html files.
Post reply on HN