Man who thought opening a TXT file is fine thought wrong • Hacker News Board

Re: Man who thought opening a TXT file is fine thought wrong

#291

Post by Wowfunhappy » Sat, Apr 03, 2021, 11:43 PM UTC

medstrom wrote: post #274

Wowfunhappy wrote: post #112

Earlier quoted context omitted.

I don't actually think file extensions are such a bad system. Filenames exist to provide context for the data inside. "Draft 2020 Quarterly Report.txt" and "Draft 2020 Quarterly Report.csv" could contain the exact same data, but the file extension indicates how the file is intended to be used, just as "2020" indicates the relevant year and "Draft" indicates completeness.

But we have file timestamps, permissions and other attributes. There could easily be a "file type" field too, that seems more natural than shoving this metadata into the title.

As I see it, a timestamp is "non-negotiable". The file was last modified on April 22, 2001. There's no difference of opinion, the time is what it is.

But the file extension partially reflects a user's intentions. A stylesheet named "style.css" is intended to be used by a browser directly, whereas one named "style.scss" is expected to go through a preprocessor, but the two might have the exact same contents, and I might decide to just change one to the other, and that's okay.

I take your point about permissions, which are expected to be set by the user. Of course, I actually run into problems caused by incorrect permissions all the time. Maybe it would be better to encode those in the file name! (Although I don't know how you'd do it without creating a mess, and potentially security issues.)

Re: Man who thought opening a TXT file is fine thought wrong

#292

Post by thought_alarm » Sun, Apr 04, 2021, 12:07 AM UTC

Wowfunhappy wrote: post #256

thought_alarm wrote: post #126

Earlier quoted context omitted.

Edit.app is the original NeXTSTEP text editor from the 1989. It supported plain text and rich text files. Famously, the first web browser was based on the rich text capabilities built into NeXSTEP. TextEdit.app is the OpenStep rewrite of Edit.app and dates to the mid 1990s. It was likely one of the first OpenStep apps. It supported the same rich text files as the original Edit.app. Apple bought NeXT, OpenStep became…

> TextEdit was ported to Java Wait, what? Wow, that’s nuts!

Java was supposed to be the primary programming language for OS X. That's why they renamed OpenStep to Cocoa (Java and Cocoa go great together).

But AppKit was still pure Objective-C, and bridging between AppKit's Obj-C APIs and the Java language presented problems. 3rd-party developers (eventually) preferred the write directly in Objective-C and Apple dropped the Java bridge some years later.

Re: Man who thought opening a TXT file is fine thought wrong

#293

Post by BlueTemplar » Sun, Apr 04, 2021, 3:16 AM UTC

icedchai wrote: post #290

BlueTemplar wrote: post #280

Earlier quoted context omitted.

These days too, IPv6 tends to be firewall-free. In theory there are protections though, like regularly changing suffixes. Do MacOS and Ubuntu ship with firewalls?

Most consumer routers should at least be doing basic inbound connection filtering for IPv6. Are they not? MacOS and Ubuntu ship with firewalls, though not sure if they're enabled by default.

I checked one big ISP, boasting 99% IPv6 coverage, and the IPv6 firewall is opt-in, and considering how many people change their settings...

(For those that might not be aware of it : with IPv6, there's no NAT, since there's no need for it.)

Re: Man who thought opening a TXT file is fine thought wrong

#294

Post by ComodoHacker » Sun, Apr 04, 2021, 5:30 AM UTC

bawolff wrote: post #279

crazygringo wrote: post #268

Earlier quoted context omitted.

SMB is more understandable though, since you have more trust for things on your local network, and an attacker usually won't have control over those resources. And it's a fairly common and reasonable expectation in a business environment that network drives appear as part of the filesystem. Whereas a domain name over the open internet is an entirely different story.

Its been a while since i've done windows stuff, but i thought you could use IP addresses in addition to netbios names for smb - \\1.2.3.4\share\file

You can use \\domain.name\share\ as well.

Re: Man who thought opening a TXT file is fine thought wrong

#295

Post by withinboredom » Sun, Apr 04, 2021, 7:09 AM UTC

BlueTemplar wrote: post #282

smoldesu wrote: post #86

Earlier quoted context omitted.

>I understand why they would do it, but it makes you wonder how much better our systems could be if it weren't for concerns about legacy. Concern for legacy is the only thing keeping the field of computing sane these days. If every operating system worked with radically different standards for basic things like filesystems, a significant amount of bespoke work would need to go into each build of every piece of softwa…

They still kind of do : WSL is kind of useless because of incompatible file systems between Windows and Linux...

I’ve not had any issues opening a file from WSL in my IDE, which is running from Windows.

Re: Man who thought opening a TXT file is fine thought wrong

#296

Post by ben_w » Sun, Apr 04, 2021, 11:09 AM UTC

rualca wrote: post #255

jaxn wrote: post #137

Earlier quoted context omitted.

But is it reasonable to treat a .txt as anything other than plain text?

You should read the article before commenting. The blog post states that the contents of said "text file" were quite literally This is not a mere text file. At all. This is a HTML document that might be deemed valid by a very permissive validator. Just because HTML might be stored in a text file that does not mean that a noncompliant HTML file ceases to be a HTML file.

If the file extension is .txt, I always expect it to be opened as plain text. The file extension is, rightly or wrongly[0], the metadata declaring the file type — nobody would consider it reasonable for an .exe to remain executable if the extension is changed to .txt, after all.

One might, possibly, still argue about the text encoding of a .txt file (I’m old enough to remember Unicode being a new fancy alternative to ASCII), but that’s about it.

[0] Sometimes I reminisce about the good old days of classic Mac OS, with resource forks and separate file type metadata: https://en.wikipedia.org/wiki/Resource_fork

Re: Man who thought opening a TXT file is fine thought wrong

#297

Post by BlueTemplar » Sun, Apr 04, 2021, 12:27 PM UTC

withinboredom wrote: post #295

BlueTemplar wrote: post #282

Earlier quoted context omitted.

They still kind of do : WSL is kind of useless because of incompatible file systems between Windows and Linux...

I’ve not had any issues opening a file from WSL in my IDE, which is running from Windows.

Oh, right, IIRC WSL 2.0 uses a complete different method?

Re: Man who thought opening a TXT file is fine thought wrong

#298

Post by IshKebab » Sun, Apr 04, 2021, 2:07 PM UTC

Wowfunhappy wrote: post #112

bellyfullofbac wrote: post #17

File extensions are a kludge anyway. (And Windows 10 still hides them by default, because hey, backwards compatibility, and you wouldn't want to confuse Grandma who's seen the file be called "grandkids" since Windows 95..). Why should the filetype be dependent on the name? People even think renaming a .BMP to .JPG means now it's a compressed file! Old school Macs stored the filetype outside of a file, so you can rena…

I don't actually think file extensions are such a bad system. Filenames exist to provide context for the data inside. "Draft 2020 Quarterly Report.txt" and "Draft 2020 Quarterly Report.csv" could contain the exact same data, but the file extension indicates how the file is intended to be used, just as "2020" indicates the relevant year and "Draft" indicates completeness.

But you could just name one of the files `Draft 2020 Quarterly Report CSV`. That's a terrible reason to use file extensions.

Re: Man who thought opening a TXT file is fine thought wrong

#299

Post by Tepix » Sun, Apr 04, 2021, 3:45 PM UTC

kergonath wrote: post #226

Tepix wrote: post #211

Earlier quoted context omitted.

No, the fact that .TXT files got interpreted as HTML is worse.

Rigidly interpreting documents depending on their file extension is worse than trying to figure out the type of a document before interpreting it. File extensions are a brittle and primitive system that does not fix any security issue.

I disagree, especially in the context of email attachments or web uploads. It isn't rocket science.

The problems occur when a file, that is said to be of a certain filetype, is erronously treated as something else.

Re: Man who thought opening a TXT file is fine thought wrong

#300

Post by hamstergene » Sun, Apr 04, 2021, 4:39 PM UTC

boomlinde wrote: post #209

rcrisan wrote: post #186

Earlier quoted context omitted.

perhaps this is the worst possible abstraction to be protected by a security framework.

How is that? Per-process namespaces in Plan 9 seem like a good idea for isolation. "Everything is a file," but what is and isn't accessible can be managed on a per-process level. In POSIX we only generally get a user/group level of granularity which seems to practically mean that only daemons are completely isolated.

Per process won’t be good enough in a different app that does legitimately need `/net`, just not when displaying file:/// links inside HTML pages.