Re: [RFC] Dealing with World-writable Files in the Archive of CPAN Distributions

2008-11-13 Thread demerphq
2008/9/30 Andreas J. Koenig [EMAIL PROTECTED]: On Tue, 23 Sep 2008 11:40:09 +0200, Jos I. Boumans [EMAIL PROTECTED] said: And so I have implemented it now. If it breaks too much in too short time, we could probably revert it, but first I'd like to see how bad we really do. I agree

Re: [RFC] Dealing with World-writable Files in the Archive of CPAN Distributions

2008-09-29 Thread Andreas J. Koenig
On Tue, 23 Sep 2008 11:40:09 +0200, Jos I. Boumans [EMAIL PROTECTED] said: And so I have implemented it now. If it breaks too much in too short time, we could probably revert it, but first I'd like to see how bad we really do. I agree to this (first) solution; this will give us a

Re: [RFC] Dealing with World-writable Files in the Archive of CPAN Distributions

2008-09-22 Thread Eric Wilhelm
# from Ken Williams # on Monday 22 September 2008 13:45: (a) Have CPAN and CPANPLUS refuse to run 'perl *.PL' if the PL in question is world writable. That wouldn't completely solve the problem, since someone could quickly rewrite *.PL and change it to non-writable status.  Note that a

Re: [RFC] Dealing with World-writable Files in the Archive of CPAN Distributions

2008-09-22 Thread Ken Williams
On Mon, Sep 22, 2008 at 5:23 PM, Eric Wilhelm [EMAIL PROTECTED] wrote: Would that tracks-covering chmod not require *ownership* of the file? According to the man page for chmod(1), yes, but on Win32 doesn't a world-writable file mean it's world-replaceable too? In any case, I was also trying

Re: [RFC] Dealing with World-writable Files in the Archive of CPAN Distributions

2008-09-22 Thread David Golden
On Mon, Sep 22, 2008 at 6:23 PM, Eric Wilhelm [EMAIL PROTECTED] wrote: Yes. Would someone please explain to me how this issue is not already made a mostly non-issue by having a proper umask and running CPAN as non-root? Someone in the thread (sorry, forget who and I'm not going to search for