Man who thought opening a TXT file is fine thought wrong • Hacker News Board

Re: Man who thought opening a TXT file is fine thought wrong

#201

Post by jspash » Sat, Apr 03, 2021, 8:51 AM UTC

Thorentis wrote: post #134

Meta comment: The custom scroll behaviour on that site is awful. I hate sites that try to "improve" the behaviour of scrolling by making it faster/slower than normal.

I've been racking my brain trying to figure out just what "benefit" is had by this type of scroll-jacking but to no avail. It does seem to help in any way and all it does is frustrate the user.

Luckily the spacebar behaviour remains untouched, but you shouldn't have to experiment with each and every snowflake webpage just to have the default actions act as you would expect.

It's not the author's fault necessarily. Well, they _did_ choose the template and decided to keep it. But the template comes from a company who targets WP templates towards Female Entrepreneurs, most likely in a bid to win some slice of Google's keyword share with "Feminine Blogger Templates". Not sure what my point is, except that maybe they are incredibly out of touch with a lot of things these days. And I'll it there. This is turning into an unintended stream-of-though rant. Sorry!

Re: Man who thought opening a TXT file is fine thought wrong

#202

Post by _0ffh » Sat, Apr 03, 2021, 8:57 AM UTC

Heh, the observation from the "zones of thought" universe comes to mind: If you want to be safe, don't even try to sneak a peek!

Re: Man who thought opening a TXT file is fine thought wrong

#203

Post by tetha » Sat, Apr 03, 2021, 9:01 AM UTC

bawolff wrote: post #145

crazygringo wrote: post #105

Oh, man. The idea that TextEdit automatically parsed .txt files as HTML if they started with a certain file signature is problematic... ...but the fact that file:// schemes can access remote files by appending /net/ followed by a domain name is pretty shocking. I mean, the entire purpose of "file://" would seem to be to provide access to local/mounted files and only those. The fact that a Mac engineer thought it woul…

> ...but the fact that file:// schemes can access remote files by appending /net/ followed by a domain name is pretty shocking. Not that shocking. Windows has had that with SMB networking for ages file://SMBSERVERNAME/path/file . Linux somewhat supports /dev/tcp/HOSTNAME/PORT (technically that's application level in bash so not everywhere), and im sure there's daemons you could run to automount things on the fly.

> Linux somewhat supports /dev/tcp/HOSTNAME/PORT (technically that's application level in bash so not everywhere), and im sure there's daemons you could run to automount things on the fly.

Do note that this has been disabled in the major distributions at compile time for pretty much ever. The debian bug to build bash with that feature by default is ~20 years old (and was closed as wontdo).

Re: Man who thought opening a TXT file is fine thought wrong

#204

Post by zimpenfish » Sat, Apr 03, 2021, 9:03 AM UTC

bobbylarrybobby wrote: post #111

userbinator wrote: post #56

Two words: excessive complexity. It's always seemed strange that an application called TextEdit is actually more than a text editor. I strongly believe that content-type autodetection, much less HTML rendering(!), most certainly does not belong in a text editor.

It seems like the only real issue here is that a file:// URL can make a network request. Who could ever think that that would be a good idea?

> a file:// URL can make a network request. Who could ever think that that would be a good idea?

Anyone with networked filesystems, I should imagine?

Re: Man who thought opening a TXT file is fine thought wrong

#205

Post by DyslexicAtheist » Sat, Apr 03, 2021, 9:29 AM UTC

tmp538394722 wrote: post #136

crazygringo wrote: post #105

Oh, man. The idea that TextEdit automatically parsed .txt files as HTML if they started with a certain file signature is problematic... ...but the fact that file:// schemes can access remote files by appending /net/ followed by a domain name is pretty shocking. I mean, the entire purpose of "file://" would seem to be to provide access to local/mounted files and only those. The fact that a Mac engineer thought it woul…

“Everything’s a file!”

> In Unix everything is a file. Files are files, folders are files, disks are files, your keyboard is a file, your mouth is a file, the air is a file, you can't breathe, your file lungs fill with files and you try to scream but only files come out oh god Dennis how could you do this

-- https://twitter.com/TartanLlama/status/1375045731644538882

Re: Man who thought opening a TXT file is fine thought wrong

#206

Post by aenario » Sat, Apr 03, 2021, 9:32 AM UTC

rcrisan wrote: post #186

tmp538394722 wrote: post #136

Earlier quoted context omitted.

“Everything’s a file!”

perhaps this is the worst possible abstraction to be protected by a security framework.

I can see a way this would be useful to use the same abstraction to limit app/user web access to a single domain.

For instance the dropbox binary can only access "/home/dropbox" and "/net/dropbox.com" if this was more well-known/used.

Re: Man who thought opening a TXT file is fine thought wrong

#207

Post by DyslexicAtheist » Sat, Apr 03, 2021, 9:32 AM UTC

Jabbles wrote: post #196

extropy wrote: post #195

Earlier quoted context omitted.

IMO not so much. Just assume all files are malicious unless accompanied by metadata saying otherwise. That is pretty much the status quo already. Except we have some grandfathered file types that are implicitly trusted.

In the article, the remote file's contents were not malicious, but merely trying to access it was. That would require a very different security posture to "assume all files are malicious".

> the remote file's contents were not malicious

until ... one day ... they are!

Re: Man who thought opening a TXT file is fine thought wrong

#208

Post by tim44 » Sat, Apr 03, 2021, 9:37 AM UTC

crazygringo wrote: post #105

Oh, man. The idea that TextEdit automatically parsed .txt files as HTML if they started with a certain file signature is problematic... ...but the fact that file:// schemes can access remote files by appending /net/ followed by a domain name is pretty shocking. I mean, the entire purpose of "file://" would seem to be to provide access to local/mounted files and only those. The fact that a Mac engineer thought it woul…

holy batman

Re: Man who thought opening a TXT file is fine thought wrong

#209

Post by boomlinde » Sat, Apr 03, 2021, 9:50 AM UTC

rcrisan wrote: post #186

tmp538394722 wrote: post #136

Earlier quoted context omitted.

“Everything’s a file!”

perhaps this is the worst possible abstraction to be protected by a security framework.

How is that? Per-process namespaces in Plan 9 seem like a good idea for isolation. "Everything is a file," but what is and isn't accessible can be managed on a per-process level.

In POSIX we only generally get a user/group level of granularity which seems to practically mean that only daemons are completely isolated.

Re: Man who thought opening a TXT file is fine thought wrong

#210

Post by boomlinde » Sat, Apr 03, 2021, 9:52 AM UTC

Jabbles wrote: post #196

extropy wrote: post #195

Earlier quoted context omitted.

IMO not so much. Just assume all files are malicious unless accompanied by metadata saying otherwise. That is pretty much the status quo already. Except we have some grandfathered file types that are implicitly trusted.

In the article, the remote file's contents were not malicious, but merely trying to access it was. That would require a very different security posture to "assume all files are malicious".

The remote file is only one of two files in the story.