Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Does this break those self-extracting script/tar files? I forget how those are done, I haven't seen one in many years.


From the article: "It remains possible to put arbitrary bytes AFTER the parts of the shell script that get parsed & executed (like some Solaris patch files do). "


If you don't know anything about OpenBSD, here's a fun thing:

1. Randomly choose "yes" or "no" to this question.

2. Read the post and get the answer.

3. Repeat until you begin to get a tingly "Spidey sense" that overrides your random-choice.

My Spidey sense here was, "Yes, because OpenBSD would have already thought about and covered that use-case." And indeed, toward the end of the post, that contingency is covered and documented.

Note: if you try this at your job and sense that the company will almost always choose the worst option, you should probably leave that job.



That was a neat idea back in the day but should disallowed now. Running downloaded executables considered harmful.


> Running downloaded executables considered harmful

Most executables are downloaded. :)


Not in the "Installation: just run `docker run kekw/our-shiny-ai-chatbot` in your shell" world we're living today.


I think the better example is the all-too-common: “Installation: Just run `curl -sL http://goo.gl/hsjdiNgtehsn | sudo bash`”


They were generally uuencoded or similar




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: