The FCC.gov Website Lets You Upload Malware Using Its Own Public API Key

Re:The FCC.gov Website Lets You Upload Malware Using Its Own... by nucleardog on Thursday August 31, 2017 @06:46PM (#15144625)

It's not even a standard. At best you could call it a convention. And a much more narrowly defined one than you seem to think.

The `~` or `~username` is expanded by your shell (but not necessarily all shells) and has nothing to do with the operating system. If you pass a filename like `~myusername/test.txt` to any unix's open() syscall, it's going to either fail or open a file in a directory literally called `~myusername`. This means anywhere you're passing a filename into a program that isn't your shell does not generally support that syntax.

A narrowly defined, poorly recognized convention is not a great thing to rely on for security purposes.

[ Parent | on HN ]

Re:The FCC.gov Website Lets You Upload Malware Using Its Own... by Alex3917 on Thursday August 31, 2017 @07:21PM (#15144849)

Fair enough. What's the process for submitting it as a proposed standard? I'll write it up.

[ Parent | on HN ]

Re:The FCC.gov Website Lets You Upload Malware Using Its Own... by inetknght on Friday September 01, 2017 @08:20AM (#15147719)

It depends on where you want to make the proposal. I'd make a guess with the POSIX standard. At that point, I think you'd submit a proposal somewhere around http://www3.opengroup.org/content/posix®

Also, that ® at the end of posix is part of the URL, you will unfortunately get a 404 if you don't copy-paste it right. You might be better to search for "site:opengroup.org posix"

Good luck, man

[ Parent | on HN ]