Erik Curiel <[EMAIL PROTECTED]>:
:
:>      The lack of "./" in this says to me that root has "." in his
:>      path;  this is a *very* bad thing.
:>
:>      Root should always fully qualify every program or script
:>      run and should NEVER have "." in his path.
:
:Get off your fucking high-horse.  You're not the last word in how
:everyone must administer their boxes.  There are different approaches,
:with good arguments on many sides.

Actually, he's got a point there.  Not having "." in your path as root
is pretty much Sysadmin 101, as far as I know*.  I, as an obnoxious
user, may have a hostile binary sitting in a directory named something
innocuous like "ls".  You, as root, go to that directory for some
reason and type "ls".  The binary then gives me a rootshell or
something equally bad, and gives you the directory listing, and you
are fuxored.  I can't think of any legitimate reason to have "." in
your path as root, or as any other user, actually.  The dangers seem
to outweigh the convenience in almost every case.  


DVS


* Mind you, this is coming from someone who hasn't patched ssh yet,
  and who recently had an Incident with Romanian script kiddies, so.

_______________________________________________
Bits mailing list
[EMAIL PROTECTED]
http://www.sugoi.org/mailman/listinfo/bits

Reply via email to