Man who thought opening a TXT file is fine thought wrong • Hacker News Board

Re: Man who thought opening a TXT file is fine thought wrong

#251

Post by andylynch » Sat, Apr 03, 2021, 2:58 PM UTC

jrochkind1 wrote: post #102

lupire wrote: post #93

Why is TextEdit accessing the Internet without permission? Does Big Sur's Access Control block stuff like this?

From the OP it sounds like there is a very weird feature/component in MacOS called "AutoMount" and/or "AutoFS" that lets HTTP GET network requests be made via reading file system locations... and it may somehow escape other access controls? I too am curious for more details about this. Where did this feature come from, how has it been used, has it actually been used? Is AutoMount/AutoFS still there after this CVE pat…

It’s not that weird, but probably less widely used now; it’s wrapped up with NFS - SunOS had this starting back in the eighties and it’s really handy. You can also do much the same including HTTP access with UNC on Windows.

Both will follow normal network file access controls in their respective environments.

As for the why? It’s a really easy way of sharing resources between computers, and also way more efficient and easier to manage than static mounts.

Re: Man who thought opening a TXT file is fine thought wrong

#252

Post by rualca » Sat, Apr 03, 2021, 3:04 PM UTC

zimpenfish wrote: post #204

bobbylarrybobby wrote: post #111

Earlier quoted context omitted.

It seems like the only real issue here is that a file:// URL can make a network request. Who could ever think that that would be a good idea?

> a file:// URL can make a network request. Who could ever think that that would be a good idea? Anyone with networked filesystems, I should imagine?

>>Anyone with networked filesystems, I should imagine?

You're either missing the point made by GP or being disingenuous. Please keep in mind that you need to explicitly mount a NFS before you're able to open it, and mounting a NFS not only requires explicit authorization but also only provides access to a specific file system mounted in a specific point following specific permissions.

Accessing the whole internet through file:// without being prompted for permissions or consent or even awareness is an entirely different thing. For starters, the access is not explicit nor subjected to conditions.

Re: Man who thought opening a TXT file is fine thought wrong

#253

Post by rijoja » Sat, Apr 03, 2021, 3:05 PM UTC

amenod wrote: post #241

exikyut wrote: post #221

Earlier quoted context omitted.

On two different Debian 10 boxes bash seems to have it enabled: Terminal 1 $ echo hi > /dev/tcp/127.0.0.1/9999 Terminal 2 $ nc -vvvlp 9999 Listening on [0.0.0.0] (family 2, port 9999) Connection from 127.0.0.1 57540 received! hi $

For anyone wondering, it is enabled by default on Ubuntu too. I wonder what made someone think that this was a good idea?

If you follow the everything is a file philosophy it seems quite natural does it not?

Re: Man who thought opening a TXT file is fine thought wrong

#254

Post by arbirk » Sat, Apr 03, 2021, 3:06 PM UTC

The scroll event processing on the blog is super annoying. With all the js-errors I'm pretty sure we are all guinea pigs for op's hacking efforts lol

Re: Man who thought opening a TXT file is fine thought wrong

#255

Post by rualca » Sat, Apr 03, 2021, 3:08 PM UTC

jaxn wrote: post #137

Wowfunhappy wrote: post #101

Earlier quoted context omitted.

Text ≠ Plain Text. TextEdit defaults to rtf. It supports html as an alternative to rtf, which is to say it can do basic formatting and nothing else. It's perfectly reasonable to expect a text editor to support more than literal unicode, and to work with a variety of commonly-used formats.

But is it reasonable to treat a .txt as anything other than plain text?

You should read the article before commenting.

The blog post states that the contents of said "text file" were quite literally

This is not a mere text file. At all. This is a HTML document that might be deemed valid by a very permissive validator.

Just because HTML might be stored in a text file that does not mean that a noncompliant HTML file ceases to be a HTML file.

Re: Man who thought opening a TXT file is fine thought wrong

#256

Post by Wowfunhappy » Sat, Apr 03, 2021, 3:25 PM UTC

thought_alarm wrote: post #126

throwawayboise wrote: post #89

Earlier quoted context omitted.

TextEdit dates back to NeXTStep, so it was originally written in the late 1980s probably. Guessing it didn't render HTML originally, but it always had RTF capability. Not that it's an excuse in 2021, but very few applications from that era woudl be considered "safe" today.

Edit.app is the original NeXTSTEP text editor from the 1989. It supported plain text and rich text files. Famously, the first web browser was based on the rich text capabilities built into NeXSTEP. TextEdit.app is the OpenStep rewrite of Edit.app and dates to the mid 1990s. It was likely one of the first OpenStep apps. It supported the same rich text files as the original Edit.app. Apple bought NeXT, OpenStep became…

> TextEdit was ported to Java

Wait, what? Wow, that’s nuts!

Re: Man who thought opening a TXT file is fine thought wrong

#257

Post by dividuum » Sat, Apr 03, 2021, 3:35 PM UTC

TazeTSchnitzel wrote: post #223

sammax wrote: post #214

> I found another browser trick that lets force-downloaded TXT files to be opened without user interaction or warning I wish there was more elaboration on this. Opening a downloaded file without user interaction sounds pretty bad.

That is Safari's default behaviour for ZIP files. Only to extract them, though.

What happens with 42.zip and other zip bombs? https://www.bamsoftware.com/hacks/zipbomb/

Re: Man who thought opening a TXT file is fine thought wrong

#258

Post by elwell » Sat, Apr 03, 2021, 3:46 PM UTC

Thorentis wrote: post #134

Meta comment: The custom scroll behaviour on that site is awful. I hate sites that try to "improve" the behaviour of scrolling by making it faster/slower than normal.

Totally agree. Appears to be using a script called "SmoothScroll".

Re: Man who thought opening a TXT file is fine thought wrong

#259

Post by elwell » Sat, Apr 03, 2021, 3:47 PM UTC

raverbashing wrote: post #190

Thorentis wrote: post #134

Meta comment: The custom scroll behaviour on that site is awful. I hate sites that try to "improve" the behaviour of scrolling by making it faster/slower than normal.

Yeah, it's ironic in a way. TXT files should open as TXTs and scroll should scroll naturally and not be tampered with.

Love this comment

Re: Man who thought opening a TXT file is fine thought wrong

#260

Post by icedchai » Sat, Apr 03, 2021, 4:07 PM UTC

SquibblesRedux wrote: post #128

crazygringo wrote: post #105

Oh, man. The idea that TextEdit automatically parsed .txt files as HTML if they started with a certain file signature is problematic... ...but the fact that file:// schemes can access remote files by appending /net/ followed by a domain name is pretty shocking. I mean, the entire purpose of "file://" would seem to be to provide access to local/mounted files and only those. The fact that a Mac engineer thought it woul…

Looking in /etc/auto_master, which is the configuration for Autofs, the /net mount point is commented out by default. I do not know when (or if) it was ever turned on by default.

I'm stilling running Mojave (10.14.x) and it is uncommented. The file dates to 2014 so I suspect it was set up with the original OS that came with this machine.