| |||||||||||||
Exploiting symlinks and tmpfilesExploiting symlinks and tmpfilesPosted Sep 20, 2007 9:51 UTC (Thu) by epa (subscriber, #39769)In reply to: Exploiting symlinks and tmpfiles by intgr Parent article: Exploiting symlinks and tmpfiles
Indeed, why shouldn't O_CREAT and O_EXCL be the default (clunky but safe) behaviour - and if your program needs to overwrite an existing file rather than creating a new one, you can give a flag to specify this unusual behaviour.
Well, like C string functions, I guess it's too late to fix these design decisions now.
(Log in to post comments)
Exploiting symlinks and tmpfiles Posted Sep 20, 2007 11:58 UTC (Thu) by nix (subscriber, #2304) [Link] Way too late. I mean, even the insecure pre-stdio gets() function is still around, decades after deprecation.
This is the downside of code reuse and common interfaces: it's very hard to change stuff once it's been widely used. (This seems to be a common trait in all sorts of complex systems: consider the degree of conservation of ancient regulatory systems in metazoan genetics, for instance, simply because once it's set up it's too hard to change. Building foundations is easy: changing them once a house is built on top is really difficult.)
Exploiting symlinks and tmpfiles Posted Sep 20, 2007 15:05 UTC (Thu) by ken (subscriber, #625) [Link] Thank you for the clarification. I was a bit confused but once you made the link to metazoan genetics things cleared up. :-)
|
|||||||||||||