Date: Wed, 1 Mar 2006 16:19:32 -0500 From: Wesley Shields <wxs@csh.rit.edu> To: Lowell Gilbert <freebsd-current-local@be-well.ilk.org> Cc: arch@freebsd.org, current@freebsd.org Subject: Re: HEADS UP: Importing csup into base Message-ID: <20060301211932.GA42815@csh.rit.edu> In-Reply-To: <44mzg9ucpm.fsf@be-well.ilk.org> References: <20060301170306.GZ55746@elvis.mu.org> <4405F673.8060907@samsco.org> <44mzg9ucpm.fsf@be-well.ilk.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, Mar 01, 2006 at 03:33:41PM -0500, Lowell Gilbert wrote: > Scott Long <scottl@samsco.org> writes: > > > Maxime Henrion wrote: > > > Hey all, > > > I have released a new snapshot of csup a few minutes ago, > > > > [...] > > > > > - Executes (shell commands sent by the server, even more rarely > > > used), > > > > Are you joking? > > Are you asking whether he's joking about (1) the idea of ever > implementing it, (2) the fact that he hasn't done it yet, or > (3) the idea that it's rarely used? All of those sound > reasonable to me... I'm questioning (1) myself. This just seems like a bad idea from a security perspective. Of course, some kind of sanitization could mitigate the issue. -- WXS
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20060301211932.GA42815>