11–20 of 107 posts
I'm amazed that he's being bashed for this. There are a LOT of security flaws out there, this one is - as Stallman says - a blip on the radar.
So is it wrong to criticize bad code for being bad if it was written by Mother Theresa? I think that if code is bad, it should be pointed out. Some will take it as bashing. Doesn't matter. We all want to run well written, secure software. When you're getting exploited, it doesn't matter if the code was written by a saint.
Earlier quoted context omitted.
What you're missing here, is that bash wasn't the software with an error. It's like you use ice cubes for building a house, observing your house is melting and then blaming the developers of ice cubes for making such horible building blocks. Ice cubes were never meant to be used to build houses with.
> What you're missing here, is that bash wasn't the software with an error. Is the FSF wrong for issuing a statement which says A major security vulnerability has been discovered in the free software shell GNU Bash. The most serious issues have already been fixed, and a complete fix is well underway ? I think you missed the news that there's a bug in bash. And if you're making the argument that bash should've not bee…
So is it wrong to criticize bad code for being bad if it was written by Mother Theresa? I think that if code is bad, it should be pointed out. Some will take it as bashing. Doesn't matter. We all want to run well written, secure software. When you're getting exploited, it doesn't matter if the code was written by a saint.
The problem is not that people call out bad code but that they attack the person who wrote it. I bet that the voices criticizing Stallman now will not praise him for GNU next time they cash in on projects built on it.
If that's happening, I completely agree with you. I was mostly addressing the "bashing bash" part. Because the bashing of bash is what I've seen in the recent discussion. Not the bashing of RMS.
So is it wrong to criticize bad code for being bad if it was written by Mother Theresa? I think that if code is bad, it should be pointed out. Some will take it as bashing. Doesn't matter. We all want to run well written, secure software. When you're getting exploited, it doesn't matter if the code was written by a saint.
I think it's more of a point that if you are using something for free, you should think more in terms of "What did I do wrong to cause this? Who did I not support that put us in this situation?". People pointed out that OpenSSL had a miniscule budget and provided tons of value to the world. Once again, all you can say is mea culpa. Either that or they should be creating alternatives and moving away from poorly writte…
Earlier quoted context omitted.
> What you're missing here, is that bash wasn't the software with an error. Is the FSF wrong for issuing a statement which says A major security vulnerability has been discovered in the free software shell GNU Bash. The most serious issues have already been fixed, and a complete fix is well underway ? I think you missed the news that there's a bug in bash. And if you're making the argument that bash should've not bee…
I know about Shellshock and I know what it means. However, I think it's wrong to blame bash for the fact that almost everything seems to be vulnerable. Those developers were wrong by using untrusted user input in places where it didn't belong. It's the FSF's responsibility to release a fix simply because the whole world depends on their (the world's) own stupid mistakes when developing their programs.
Environment variables are text. So long as you control the name of them, and the name doesn't conflict with any other name in the system, there should be absolutely no issue with putting user input into environment variables.
Programs like bash should only be executing things that are explicitly marked as trusted code through a flag that is not contained in the value. Some distros have implemented a patch to this effect already in bash, disallowing bash from treating any environment variable whose name doesn't start with BASH_FUNC_ as anything but text. This resolves every single related vulnerability out there.
Earlier quoted context omitted.
What you're missing here, is that bash wasn't the software with an error. It's like you use ice cubes for building a house, observing your house is melting and then blaming the developers of ice cubes for making such horible building blocks. Ice cubes were never meant to be used to build houses with.
> What you're missing here, is that bash wasn't the software with an error. Is the FSF wrong for issuing a statement which says A major security vulnerability has been discovered in the free software shell GNU Bash. The most serious issues have already been fixed, and a complete fix is well underway ? I think you missed the news that there's a bug in bash. And if you're making the argument that bash should've not bee…
Say that a car manufacturer builds a car for city driving and doesn't warrant or recommend it's use for off roading. However it just so happens that the car is tough enough that it makes a good offroader anyway and soon people start to buy the car for the express purpose of offroading even though the manufacturer does not recommend this use.
Some time later it becomes apparent that there is a weakness in the braking system that manifests itself after extensive offroad use but not with regular road use, and this becomes the cause of many accidents. The manufacturer then does a recall and refits the cars with an improved braking system more suitable for offroading even though they never intended (and still do not) for people to use it offroad they are just forced to accept this use case.
Is it actually the case that Stallman has no permanent home? If so, is that by choice or circumstance? He has done so much .
So is it wrong to criticize bad code for being bad if it was written by Mother Theresa? I think that if code is bad, it should be pointed out. Some will take it as bashing. Doesn't matter. We all want to run well written, secure software. When you're getting exploited, it doesn't matter if the code was written by a saint.
He doesn't think the code is bad. Shellshock is not a critical failure in bash. It is a critical failure in thousands of people who knew a tool so useful that they decided to deploy it far beyond its scope. A tool so resilient that it it did not fall over when everyone deployed against best practices. Everyone knew in the nineties that when you execute a UNIX command with untrusted input, you clear away the environme…
CGI was standardised in 1997 to use environment variables to pass information into the CGI program. I'm sure software existed before that that does the same - procmail, perhaps?
No software that's been touched in the past two decades should assume that the environment variable is safe. Especially not a shell, which gets used for all sorts of network-processing-related things.