Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sources.redhat.com/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sources.redhat.com/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com
From: "Dave Korn" <dk AT artimi DOT com>
To: <cygwin AT cygwin DOT com>
Subject: RE: Problems with Indirect Interpretation (#!/bin/csh, #!/bin/tcsh, #!/bin/perl, etc...)
Date: Tue, 11 May 2004 19:09:08 +0100
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
In-Reply-To: <NUTMEGMZarnrIXD3dcc00000080@NUTMEG.CAM.ARTIMI.COM>
Message-ID: <NUTMEGsMlbm3LZzgh4H00000081@NUTMEG.CAM.ARTIMI.COM>
X-OriginalArrivalTime: 11 May 2004 18:09:08.0382 (UTC) FILETIME=[0DBB03E0:01C43783]

> -----Original Message-----
> From: cygwin-owner On Behalf Of Dave Korn
> Sent: 11 May 2004 18:51

> > -----Original Message-----
> > From: cygwin-owner On Behalf Of Rocket Boy
> > Sent: 11 May 2004 18:44

> > The FAQ says that it is not recommended to add . to
> > $PATH. Anyone, know a compelling reason not to?
> 
>   It's a security measure for the medium-to-fairly paranoid. :-O
> 

>   If you had '.' in the $PATH, as soon as you 
> log in and run
> ls, you'd end up executing the trojanned version; 


  And it occurs to me to mention that windoze *always* has . in the current
path, implicitly, and in fact that it's always the very *first* item in the
path.  And that was why it used to be possible to trojan a windoze
installation by putting a malicious file into C:\ and calling it
'explorer.exe'......

  And that, in turn, is why the windows slogan should be "Insecure by
design"!



    cheers, 
      DaveK
-- 
Can't think of a witty .sigline today....
 



--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Problem reports:       http://cygwin.com/problems.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/