Earlier quoted context omitted.
I’ve not had any issues opening a file from WSL in my IDE, which is running from Windows.
Oh, right, IIRC WSL 2.0 uses a complete different method?
yeah, I think it creates a file share that you can access.
Man who thought opening a TXT file is fine thought wrong
301–310 of 316 posts
Re: Man who thought opening a TXT file is fine thought wrong
#302Im trying to hack my girlfriends phone??????
Re: Man who thought opening a TXT file is fine thought wrong
#303Earlier quoted context omitted.
perhaps this is the worst possible abstraction to be protected by a security framework.
I can see a way this would be useful to use the same abstraction to limit app/user web access to a single domain. For instance the dropbox binary can only access "/home/dropbox" and "/net/dropbox.com" if this was more well-known/used.
This can be done with a proper capability system.
Re: Man who thought opening a TXT file is fine thought wrong
#304Earlier quoted context omitted.
You should read the article before commenting. The blog post states that the contents of said "text file" were quite literally This is not a mere text file. At all. This is a HTML document that might be deemed valid by a very permissive validator. Just because HTML might be stored in a text file that does not mean that a noncompliant HTML file ceases to be a HTML file.
If the file extension is .txt, I always expect it to be opened as plain text. The file extension is, rightly or wrongly[0], the metadata declaring the file type — nobody would consider it reasonable for an .exe to remain executable if the extension is changed to .txt, after all. One might, possibly, still argue about the text encoding of a .txt file (I’m old enough to remember Unicode being a new fancy alternative to…
> If the file extension is .txt, I always expect it to be opened as plain text. The file extension is, rightly or wrongly[0], the metadata declaring the file type — nobody would consider it reasonable for an .exe to remain executable if the extension is changed to .txt, after all.
That statement is quite wrong and shows a good dose of ignorance. To start off in UNIX systems the extension means nothing regarding whether a file is an executable or not. All it takes is a +x flag and a file format (header, magic number) that can be executed.
Also, file extensions mean nothing. In fact, a popular and very basic trick to fool clueless users to run malware (and one which any anti-malware tool checks) is to sneak executables with a different extension, because it only means something to clueless users.
And a file with a txt file extensions means nothing at all. The only thing that matters is the file content and it's file permissions.
Re: Man who thought opening a TXT file is fine thought wrong
#305Earlier quoted context omitted.
perhaps this is the worst possible abstraction to be protected by a security framework.
I don't think "everything is a file" is necessarily bad. What's worse is "every application I run has access to every resource that the OS gives my user access to". Would be nice if the operating system could set up a fresh, temporary "user" for each application installed, and instead run the application as that user, who starts out with no access to computing resources. Maybe some existing systems already sandbox ap…
I believe this is how Qubes OS is supposed to operate.
Re: Man who thought opening a TXT file is fine thought wrong
#306Earlier quoted context omitted.
>but was horrible for interoperability This makes me sad - it was dropped because of problems with other operating systems , not because it was necessarily a bad architecture. I understand why they would do it, but it makes you wonder how much better our systems could be if it weren't for concerns about legacy.
> This makes me sad - it was dropped because of problems with other operating systems, not because it was necessarily a bad architecture. No, it was dropped because it was designed without enough forethought given to how that metadata would be transmitted over the wire or when multiple files were bundled consistently . Even if every OS used this scheme a better solution to these problems would have to have been devis…
Microsoft removed the file type manager in Vista(?), so it's no longer as simple to change what software opens arbitrary file extensions. You now need to have a file with the extension you want to change the default for, use 'open with', and check the 'use by default' button. If you want to change a bunch of file types by copy/ pasting exe path, sorry, you can't do that without editing the registry. And the new method of changing programs that open groups of file types (ie documents or html), the program you're running needs to be registered as something that can do so, or it won't appear in the list. Want to change all image formats except gif (jpg, png, tiff, bmp, wmf, emf, and so on) to a different image viewer? Your options are to change them all then change gif back, or to change them individually.
I think there's a location in the new settings for listing all file type associations, but it still doesn't allow copy/pasting paths for multiple fast modifications. If you want to change the name of a file type as it appears in the file type column in explorer, or want to change the icon used for a type of file to something other than that of the application used to open it, that's no longer possible without editing the registry.
Re: Man who thought opening a TXT file is fine thought wrong
#307Earlier quoted context omitted.
I mean, unless you're host is extremely locked down you'll probably also have telnet,netcat, etc installed, so no great difference.
I'm no specialist but I'm inclined to disagree, for me it's the difference between the ability to run an arbitrary binary and the ability to read/write an arbitrary filepath
They are imaginary paths in the bash executable.
They aren't usable outside it. Thus the netcat analogy.
Re: Man who thought opening a TXT file is fine thought wrong
#308Earlier quoted context omitted.
Except permissions aren't granular enough / are too confusing, it's a giant footgun with the current Linux architecture, which doesn't have all the nice things Plan9 does
I mean, unless you're host is extremely locked down you'll probably also have telnet,netcat, etc installed, so no great difference.
Anything you can do in telnet or netcat can also be done in python, perl, ruby. One of those is likely installed, most probably python.
Re: Man who thought opening a TXT file is fine thought wrong
#309Earlier quoted context omitted.
How is that? Per-process namespaces in Plan 9 seem like a good idea for isolation. "Everything is a file," but what is and isn't accessible can be managed on a per-process level. In POSIX we only generally get a user/group level of granularity which seems to practically mean that only daemons are completely isolated.
Per process won’t be good enough in a different app that does legitimately need `/net`, just not when displaying file:/// links inside HTML pages.
I disagree. Use a second process that has a limited namespace where you've mounted only the local files you want an HTML document to be able to refer to and an IPC socket marked for exclusive use. The first process resolves file links and reads file contents via IPC to the second process.
Re: Man who thought opening a TXT file is fine thought wrong
#310Earlier quoted context omitted.
Rigidly interpreting documents depending on their file extension is worse than trying to figure out the type of a document before interpreting it. File extensions are a brittle and primitive system that does not fix any security issue.
File extensions are simple and, crucially, visible and understandable to the user. They're far better than any proposed alternative.
They are also trivial to get wrong, can be mangled when the files are moved around, and are easy to use as an attack vector.
They are not far better than the alternatives, it's just that no alternative reached a critical mass due to them not being how Windows works.