Matthew R. Dempsky wrote:
One possibility is that between the first ls -l and the rm that joe changed just-testing to a symlink to /etc. However, I think this attack scenario relies too much on joe's ability to blindly predict when the sysadmin is about to run rm.
We do not know if joe is intentionally evil. It may have been a coincidence.
