Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Man who thought opening a TXT file is fine thought wrong

paulosyibelo.com

Post reply on HN
Print view View original

181–190 of 316 posts

Re: Man who thought opening a TXT file is fine thought wrong

#181

Post by Thorrez »

benatkin wrote: post #173
crazygringo wrote: post #105

Oh, man. The idea that TextEdit automatically parsed .txt files as HTML if they started with a certain file signature is problematic... ...but the fact that file:// schemes can access remote files by appending /net/ followed by a domain name is pretty shocking. I mean, the entire purpose of "file://" would seem to be to provide access to local/mounted files and only those. The fact that a Mac engineer thought it woul…

The extension is meaningless outside of Windows...

It doesn't sound like that from the article:

>the default text reader on OSX, TextEdit is used to open files with TXT extension by default.

>Gatekeeper doesn’t quarantine TXT files

Re: Man who thought opening a TXT file is fine thought wrong

#182

Post by schmidp »

bawolff wrote: post #148
upofadown wrote: post #74

The link provided in the article to HTTPLeaks required some sort of login for me. Here is the direct link: * https://github.com/cure53/HTTPLeaks There are a lot of ways HTML can leak information. HTTPLeaks is an attempt to create a test for all such leaks. Unfortunately, people keep inventing new ways for HTML interpretation to leak data. The article describes a particularly clever approach accidentally implemented b…

I don't know what people expect - don't run code you don't trust. There is also lots of ways for python to leak data if you execute a malicious python script.

It's not about running code, it's about opening a TXT file with the operating system default handler for TXT files.

So you what you are saying is basically 'do not open any files or websites you don't trust' - which is usually not what people expect as that would basically mean 'don't use your computer'

Re: Man who thought opening a TXT file is fine thought wrong

#183

Post by Thorrez »

crazygringo wrote: post #109
userbinator wrote: post #56

Two words: excessive complexity. It's always seemed strange that an application called TextEdit is actually more than a text editor. I strongly believe that content-type autodetection, much less HTML rendering(!), most certainly does not belong in a text editor.

It's a rich text editor by default. Rich text is still text. Opening HTML files and converting them to rich text certainly does belong as a valid feature for a rich text editor. It'll open and convert Word files too, which is super useful. The content-type autodetection, however, I agree was a bad idea. Still, this vulnerability presumably existed with an .html file opened in TextEdit.

>Still, this vulnerability presumably existed with an .html file opened in TextEdit.

It wouldn't have been as bad though. From the article:

>Gatekeeper doesn’t quarantine TXT files

Re: Man who thought opening a TXT file is fine thought wrong

#184

Post by comex »

lupire wrote: post #93

Why is TextEdit accessing the Internet without permission? Does Big Sur's Access Control block stuff like this?

Well, /net is entirely disabled by default as of recently, so this entire method is no longer applicable.

However, since you asked, here is some useless information:

With /net or remote filesystems in general (NFS and SMB), the network accesses are performed by the kernel directly, rather than by the application using networking syscalls. Therefore, sandboxing network access from specific applications won't affect it.

Big Sur doesn't actually have a permission dialog for network access. But TextEdit does use the (long-existing) App Sandbox system, which is based on applications statically declaring permissions they need. Since TextEdit doesn't request a networking entitlement, it's prohibited from accessing the network directly; as I said, that doesn't include remote filesystems.

Re: Man who thought opening a TXT file is fine thought wrong

#185

Post by indigodaddy »

renox wrote: post #180
userbinator wrote: post #56

Two words: excessive complexity. It's always seemed strange that an application called TextEdit is actually more than a text editor. I strongly believe that content-type autodetection, much less HTML rendering(!), most certainly does not belong in a text editor.

Yesterday grep didn't work because it 'autodetected' that the target file was a binary.. So I 1) cursed whoever made this non backward compatible change 2) used man to find the '-a' option..

Hah, looks like I’ve been needlessly typing quite a few extra keystrokes, as I’ve always done —binary-files=text. I should have looked at the man page more closely..

Re: Man who thought opening a TXT file is fine thought wrong

#186

Post by rcrisan »

tmp538394722 wrote: post #136
crazygringo wrote: post #105

Oh, man. The idea that TextEdit automatically parsed .txt files as HTML if they started with a certain file signature is problematic... ...but the fact that file:// schemes can access remote files by appending /net/ followed by a domain name is pretty shocking. I mean, the entire purpose of "file://" would seem to be to provide access to local/mounted files and only those. The fact that a Mac engineer thought it woul…

“Everything’s a file!”

perhaps this is the worst possible abstraction to be protected by a security framework.

Re: Man who thought opening a TXT file is fine thought wrong

#187

Post by [deleted] »

techrat wrote: post #10
VectorLock wrote: post #6

Earlier quoted context omitted.

I don't think it can be worse than Windows. Not immune, but definitely not worse.

Depends on how you want to set the goalposts. By version, MacOSX is faring worse. By total history despite a good chunk of old Windows malware not being net capable or able to run in current modes... perhaps. https://www.vox.com/recode/2020/2/12/21134681/mac-pc-virus-m... Safety by virtue of running MacOSX isn't enough anymore. Not that I'd argue it ever was totally safe/enough in the first place. Bad habits are what…

[deleted]

Re: Man who thought opening a TXT file is fine thought wrong

#188

Post by perryizgr8 »

philistine wrote: post #151
perryizgr8 wrote: post #55

Earlier quoted context omitted.

It also doesn't ship with a paint program. OSx has a lot of ground to cover before it can function as a decent desktop OS.

One of the big reasons I switched in 2007 was the absence of absolute dreck like Paint.exe on a Mac. Instead, Apple focused on providing other types of apps for free, and now macOS comes with a full office suite and a prosumer sound editing program as things Windows doesn't have on first launch. Out of the box, macOS offers so much stuff today it's kind of incredible. You want to draw? Use Notes, which has very littl…

> absolute dreck like Paint.exe

mspaint.exe is as close to a perfect software as I have ever seen. I'm curious to know which program you think is better, because I'm sure very few exist.

Re: Man who thought opening a TXT file is fine thought wrong

#190

Post by raverbashing »

Thorentis wrote: post #134

Meta comment: The custom scroll behaviour on that site is awful. I hate sites that try to "improve" the behaviour of scrolling by making it faster/slower than normal.

Yeah, it's ironic in a way. TXT files should open as TXTs and scroll should scroll naturally and not be tampered with.
Post reply on HN