[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20171031181842.m3dltnyokqvf6csd@sentinelchicken.org>
Date: Tue, 31 Oct 2017 11:18:43 -0700
From: Tim <tim-security@...tinelchicken.org>
To: oss-security@...ts.openwall.com
Subject: Re: Fw: Security risk of vim swap files
> > Sure, you can argue that maybe some systems should ignore these files,
> > block access, etc, but it is pretty absurd to expect every other piece
> > of software in the universe to work around very unsafe defaults of text
> > editors.
>
> It's also fairly absurd to insist that people can run whatever program
> they want, wherever they want, on a production web server, without being
> familiar enough with the program to understand the risks.
>
> Anyone who edits files in the deployment path with an insufficient
> education is going to have problems, and not having noswapfile set is
> the least of them.
I don't disagree. But this isn't just about exposures via web
servers.
tim
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
