News for hackers. Stuff that matters.
Re:SigSpoof: Spoofing signatures in GnuPG, Enigmail, GPGTool... by bjpbakker on Friday June 15, 2018 @05:44AM (#17318579)
As already suggested output parsing here is necessary due to multiple possible outcomes.

I just want to add that if you have to parse command output, enforce the output format as well as you can. The --verbose bug really shouldn’t have happened.

Re:SigSpoof: Spoofing signatures in GnuPG, Enigmail, GPGTool... by chopin on Friday June 15, 2018 @06:51AM (#17318817)
As I am mainly a Java guy it has burnt into me to never rely on .toString() output for code flow. It seems to me that this is somewhat similar (or has the Unix world a gentlemans agreement that output has an API contract). I'd never touch anything where I couldn't enforce (preferably typed) output to rely on especially in a security context. I think I have already seen command line tools which can return structured content (json, xml) with a switch (I don't remember which, though).
Re:SigSpoof: Spoofing signatures in GnuPG, Enigmail, GPGTool... by bjpbakker on Friday June 15, 2018 @09:35AM (#17319642)
> I have already seen command line tools which can return structured content (json, xml) with a switch

That happens. It doesn't need to a standard format like that however. Some command like tools add a porcelain option that produces output for scripting (ie no ansi color codes, easy to parse, etc). That works well too.

Re:SigSpoof: Spoofing signatures in GnuPG, Enigmail, GPGTool... by FredFS456 on Friday June 15, 2018 @07:56AM (#17319073)
awscli tools can generally do so.
Re:SigSpoof: Spoofing signatures in GnuPG, Enigmail, GPGTool... by evancox100 on Friday June 15, 2018 @10:05AM (#17319840)
This is literally how all Linux and Unix CLI tools interoperate. Would be great to see wider adoption of something like PowerShell's ouput model.