Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Man who thought opening a TXT file is fine thought wrong

paulosyibelo.com

Post reply on HN
Print view View original

241–250 of 316 posts

Re: Man who thought opening a TXT file is fine thought wrong

#241

Post by amenod »

exikyut wrote: post #221
tetha wrote: post #203

Earlier quoted context omitted.

> Linux somewhat supports /dev/tcp/HOSTNAME/PORT (technically that's application level in bash so not everywhere), and im sure there's daemons you could run to automount things on the fly. Do note that this has been disabled in the major distributions at compile time for pretty much ever. The debian bug to build bash with that feature by default is ~20 years old (and was closed as wontdo).

On two different Debian 10 boxes bash seems to have it enabled: Terminal 1 $ echo hi > /dev/tcp/127.0.0.1/9999 Terminal 2 $ nc -vvvlp 9999 Listening on [0.0.0.0] (family 2, port 9999) Connection from 127.0.0.1 57540 received! hi $

For anyone wondering, it is enabled by default on Ubuntu too. I wonder what made someone think that this was a good idea?

Re: Man who thought opening a TXT file is fine thought wrong

#242

Post by grishka »

bellyfullofbac wrote: post #17

File extensions are a kludge anyway. (And Windows 10 still hides them by default, because hey, backwards compatibility, and you wouldn't want to confuse Grandma who's seen the file be called "grandkids" since Windows 95..). Why should the filetype be dependent on the name? People even think renaming a .BMP to .JPG means now it's a compressed file! Old school Macs stored the filetype outside of a file, so you can rena…

In the age of the internet, file extensions are a good idea, they should be visible by default, and people need to learn to recognize them. There's a lot of malware that gets people to run it by being an executable with an icon of an innocent file type, like an image. If you don't see extensions, you have no idea it's an .exe instead of a .jpg.

Re: Man who thought opening a TXT file is fine thought wrong

#243

Post by Mordisquitos »

hnarn wrote: post #240

The title should be: > Man who thought opening a TXT file in TextEdit is fine thought wrong There are many, many text editors out there that would not attempt to parse HTML upon opening a text file.

Or even something like this:

> Man who thought TextEdit could be trusted as a plain text editor is wrong

This is one more example of what I find so frustrating about macOS, which is all those hidden little features trying to be "smart" and "user friendly" just in case I the user do not really know what I'm doing.

Re: Man who thought opening a TXT file is fine thought wrong

#244

Post by stavros »

crazygringo wrote: post #105

Oh, man. The idea that TextEdit automatically parsed .txt files as HTML if they started with a certain file signature is problematic... ...but the fact that file:// schemes can access remote files by appending /net/ followed by a domain name is pretty shocking. I mean, the entire purpose of "file://" would seem to be to provide access to local/mounted files and only those. The fact that a Mac engineer thought it woul…

Most likely nobody decided to have file:// access the network. Most likely, someone decided to make file:// the scheme for accessing files, and someone else decided to mount the network as a file.

Re: Man who thought opening a TXT file is fine thought wrong

#245

Post by andylynch »

benatkin wrote: post #173
crazygringo wrote: post #105

Oh, man. The idea that TextEdit automatically parsed .txt files as HTML if they started with a certain file signature is problematic... ...but the fact that file:// schemes can access remote files by appending /net/ followed by a domain name is pretty shocking. I mean, the entire purpose of "file://" would seem to be to provide access to local/mounted files and only those. The fact that a Mac engineer thought it woul…

The extension is meaningless outside of Windows...

Far from it. Even Mac OS stopped using type and creator codes in favour of file extensions, 11 years ago (with snow leopard).

Re: Man who thought opening a TXT file is fine thought wrong

#246

Post by fouric »

movedx wrote: post #232
azinman2 wrote: post #131

Earlier quoted context omitted.

According to you. I appreciate that TextEdit is a rich editor. I can use vim or countless other apps for plain text. Few do what TextEdit does with its simplicity.

Aye. According to me. I have a preference for tools doing one thing, and one thing well. That attitude has served me very well. Your opinion is that you like TextEdit for what it is. Neither opinion/feeling is relevant.

Neither is the opinion that "This problem exists because someone wrote a tool that should only do one (really well) and but instead made it do five different things."

You can make security bugs in simple tools - this security bug is not purely a function of the number of target use-cases.

Nor do you have any rational basis for asserting that the given app "should only do one [thing]".

Re: Man who thought opening a TXT file is fine thought wrong

#247

Post by rualca »

rcrisan wrote: post #186
tmp538394722 wrote: post #136

Earlier quoted context omitted.

“Everything’s a file!”

perhaps this is the worst possible abstraction to be protected by a security framework.

> perhaps this is the worst possible abstraction to be protected by a security framework.

I honestly don't understand how anyone with at least a basic understanding of how OSes are designed and operated could ever arrive at that conclusion. The layers of wrong assumptions required to support that assertion are in the level of "not even wrong" confusions.

Re: Man who thought opening a TXT file is fine thought wrong

#248

Post by fouric »

lmm wrote: post #231
kergonath wrote: post #226

Earlier quoted context omitted.

Rigidly interpreting documents depending on their file extension is worse than trying to figure out the type of a document before interpreting it. File extensions are a brittle and primitive system that does not fix any security issue.

File extensions are simple and, crucially, visible and understandable to the user. They're far better than any proposed alternative.

Optimizing for "simple" for the sake of robustness is exactly backward.

> visible and understandable

False. Something is neither visible nor understandable if it's misleading - which file extensions are. There are absolutely no guarantees that a file extension will match file contents, and that assumption can cause security risks - like in this article.

An actually good alternative is to encode file type as metadata, instead of inside the file contents or file-name, and then configure viewers to display it. That, while not "simple", is also visible and understandable to the user, while simultaneously being safe.

Re: Man who thought opening a TXT file is fine thought wrong

#249

Post by rualca »

tmp538394722 wrote: post #136
crazygringo wrote: post #105

Oh, man. The idea that TextEdit automatically parsed .txt files as HTML if they started with a certain file signature is problematic... ...but the fact that file:// schemes can access remote files by appending /net/ followed by a domain name is pretty shocking. I mean, the entire purpose of "file://" would seem to be to provide access to local/mounted files and only those. The fact that a Mac engineer thought it woul…

“Everything’s a file!”

> “Everything’s a file!”

I fail to see how HTTP and REST's "everything is a resource" paradigm is significantly different than UNIX's "everything is a file" paradigm, and I'm yet to see anyone claim that the freedom and power to open any HTML document (OMG a file!) made available through the internet is a mistake or a bad design decision.

Re: Man who thought opening a TXT file is fine thought wrong

#250

Post by rualca »

crazygringo wrote: post #105

Oh, man. The idea that TextEdit automatically parsed .txt files as HTML if they started with a certain file signature is problematic... ...but the fact that file:// schemes can access remote files by appending /net/ followed by a domain name is pretty shocking. I mean, the entire purpose of "file://" would seem to be to provide access to local/mounted files and only those. The fact that a Mac engineer thought it woul…

> I mean, the entire purpose of "file://" would seem to be to provide access to local/mounted files and only those.

This is the only story here. Everything else sounds like clueless hyperboles.

Post reply on HN