News for hackers. Stuff that matters.
Re:OS X 10.11 buffer overflow with deep filesystem hierarchy by reilly3000 on Saturday October 24, 2015 @04:41AM (#10442927)
So in theory if you wanted to take down a web server that allows for creating files in a directory structure you just have to nest less than 1k of them to start wreaking havoc? Yikes if so.
Re:OS X 10.11 buffer overflow with deep filesystem hierarchy by trengrj on Saturday October 24, 2015 @06:27AM (#10443126)
An OS X web server... As another comment mentioned OS X is hindered by the fact they refuse to use GPL 3 code http://meta.ath0.com/2012/02/05/apples-great-gpl-purge/. This results in their userspace code being out of date (i.e. they still use bash version 3.2) and having bugs like these.
Re:OS X 10.11 buffer overflow with deep filesystem hierarchy by the_mitsuhiko on Saturday October 24, 2015 @06:40AM (#10443153)
> As another comment mentioned OS X is hindered by the fact they refuse to use GPL 3 code

They do not refuse, they cannot include it from a legal point of view.

Re:OS X 10.11 buffer overflow with deep filesystem hierarchy by belorn on Saturday October 24, 2015 @12:04PM (#10443972)
Apple could agree to any software licenses they wish, but they choose not to with GPLv3. There is nothing legally that prevent them from giving users access to source code, nor giving users permission to change software running on devices that they have bought from Apple.

Apple refuse to do this. No one know for sure but the common suspicion is that they want to avoid competition by locking users to a single platform where apple has a artificial created monopoly.

Re:OS X 10.11 buffer overflow with deep filesystem hierarchy by matt4077 on Saturday October 24, 2015 @01:03PM (#10444176)
Or maybe they just don't want to give away one of their core products for free.
Re:OS X 10.11 buffer overflow with deep filesystem hierarchy by belorn on Saturday October 24, 2015 @04:32PM (#10444752)
Which core product would that be? GPL require that you give out source code of derivative works (work based on someone else work).

One could be accused to think that the core products of Apple is the devices that they sells. What clause in GPLv3 require that they give devices out for free?

Re:OS X 10.11 buffer overflow with deep filesystem hierarchy by anonbanker on Saturday October 24, 2015 @02:34PM (#10444438)
yeah, best not use free software if you get the willies from the word "free".
Re:OS X 10.11 buffer overflow with deep filesystem hierarchy by geofft on Saturday October 24, 2015 @10:20AM (#10443668)
Does that affect regular OS X desktops/laptops? It makes sense for Apple TVs and iOS devices (well, as much sense as locking them down in the first place) but for OS X, the anti-TiVoization clause merely requires that the end user be able to replace those binaries. And there's always a way to turn off System Integrity Protection.

Or are they worried about something else, like the patent clauses?

Re:OS X 10.11 buffer overflow with deep filesystem hierarchy by msbarnett on Saturday October 24, 2015 @11:37AM (#10443889)
The patent clauses. They're so vague and untested a lot of corporate lawyers balk at having anything to do with them.
Re:OS X 10.11 buffer overflow with deep filesystem hierarchy by hedwall on Saturday October 24, 2015 @08:13AM (#10443358)
What is the difference between GPL2 and GPL3 that makes this impossible from a legal POV?
Re:OS X 10.11 buffer overflow with deep filesystem hierarchy by Someone on Saturday October 24, 2015 @08:31AM (#10443399)
I don't think anybody knows whether there is a real difference, but the increased strictness of GPL3 such as its anti-TIVOization (https://en.m.wikipedia.org/wiki/Tivoization) clauses certainly make a lot of lawyers concerned.

Where exactly the border lies between and not linking is a grey area, legally, that hasn't become clearer with GPL3.

It wouldn't surprise me to see bash go from the standard install, too. Apple is slowly removing all GPL code from its OS.

Re:OS X 10.11 buffer overflow with deep filesystem hierarchy by autoreleasepool on Saturday October 24, 2015 @08:47AM (#10443428)
I hope they make ZSH the standard shell. It's similar enough to bash to not disrupt most workflows and Apple has been able to update it due to its permissive license.

I use ZSH as my main shell on OS X. I find it superior to bash in almost every way (especially with oh-my-zsh) except in ubiquity. Even so, I have no problem using bash if that's all that's available, the two shells are fairly compatible.

Re:OS X 10.11 buffer overflow with deep filesystem hierarchy by mitchty on Saturday October 24, 2015 @12:19PM (#10444029)
It was the primary shell in 10.2 or 10.3 after tcsh or csh (its been a while I can't remember well).
Re:OS X 10.11 buffer overflow with deep filesystem hierarchy by anonbanker on Saturday October 24, 2015 @02:38PM (#10444450)
if someone uses your software in a way that is honoring the GPLv3, but you don't like, you lose any ability to sue or further restrict them. Even though the ghost of Steve Jobs (Forstall) is no longer haunting the building, Apple learned the lesson of "sue early, sue often", and Stallman/Moglen sort of got in the way of that with GPLv3.

Tivoization was another issue, especially with Apple's tendency to lock down their platform.

Re:OS X 10.11 buffer overflow with deep filesystem hierarchy by tedunangst on Saturday October 24, 2015 @06:55AM (#10443182)
So all BSD systems have the same bug??
Re:OS X 10.11 buffer overflow with deep filesystem hierarchy by pmarin on Saturday October 24, 2015 @07:40AM (#10443276)
Most BSD systems not include GPL code in their base system if it is not necesary but you can install it from ports or whatever they have.
Re:OS X 10.11 buffer overflow with deep filesystem hierarchy by anonbanker on Saturday October 24, 2015 @02:41PM (#10444464)
ITT: tedunangst asks a question he already knows the answer to. upvoted.
Re:OS X 10.11 buffer overflow with deep filesystem hierarchy by huuu on Saturday October 24, 2015 @05:56AM (#10443067)
What about sending someone a zip with such a directory structure?
Re:OS X 10.11 buffer overflow with deep filesystem hierarchy by dogma1138 on Saturday October 24, 2015 @12:52PM (#10444143)
That's possible many AV products do not look into archives past a certain limit sending out a zip file with say a PDF and a hidden payload in a sub directory beyond the lookup depth of the AV software used to be a common way to achieve AV avoidance.

commercial ZIP software however usually limits the maximum depth and file path name to the lowest common denominator which is 250 chars for compatibility with Windows, some software will have a "unix" mode in which the max limit is increased to 1024.

Re:OS X 10.11 buffer overflow with deep filesystem hierarchy by Alphasite_ on Saturday October 24, 2015 @04:51AM (#10442943)
Its not really a big issue when you consider that no one does any serious web hosting on OSX server. Maybe if you relied on it for profiles?
Re:OS X 10.11 buffer overflow with deep filesystem hierarchy by tajen on Saturday October 24, 2015 @05:25AM (#10443005)
Not very related, but it reminds me that there are a lot of people who rack Mac Pros in data centers. Not Mac Mini. Mac Pros. Yes, the cylinder one. I guess it's mostly for graphics and rendering capabilities or when testing requires the original machines. People come up with all sorts of tricks because it is very inefficient - like vents [1] - or this other company who 3D-printed pieces to keep the Macbook Pros open at 7mm (=0,05 banana) [2].

[1] I especially liked this blog: http://photos.imgix.com/racking-mac-pros

[2] https://simbimbo.wordpress.com/2015/07/24/well-im-at-it-agai...