[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20171031175407.jcniviupwyab6qcl@sentinelchicken.org>
Date: Tue, 31 Oct 2017 10:54:08 -0700
From: Tim <tim-security@...tinelchicken.org>
To: oss-security@...ts.openwall.com
Subject: Re: Fw: Security risk of vim swap files
On Tue, Oct 31, 2017 at 01:23:52PM +0100, Hanno Böck wrote:
> I just sent this to the vim dev list, but I guess it's interesting for
> oss-security, too.
> ...
Good thing to point out. Same goes for other editors that drop ~ and
#...# files and the like. The default location shouldn't be an
exposure.
Sure, you can argue that maybe some systems should ignore these files,
block access, etc, but it is pretty absurd to expect every other piece
of software in the universe to work around very unsafe defaults of text
editors.
Also, it almost never makes sense to put things in /tmp, for several
reasons pointed out by others. Making ~/.vim/... the default location
clearly is the best solution.
Cheers,
tim
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
