Re:Show HN: Patchwork – Real-time notifications for OSS vuln...
by DoubleMalt on Wednesday January 13, 2016 @03:49PM
(#10897381)
Would you bet you live on the assumptionthat there is no way a network problem could truncate the script into something, that does something unintended but harmful?
Re:Show HN: Patchwork – Real-time notifications for OSS vuln...
by kentonv on Wednesday January 13, 2016 @04:13PM
(#10897541)
That problem is easily avoided by wrapping the whole script in a function and then calling it on the last line.
It looks like Patchwork's script doesn't quite do that, but it does put _most_ of its functionality into functions, and AFAICT there is no particular place in the script where a connection loss could lead to anything bad happening. Admittedly this appears to be a lucky accident rather than following best practice.
https://github.com/PatchworkSecurity/cleansweep/blob/master/...
The comments explain what is happening at each step.