Re:SigSpoof: Spoofing signatures in GnuPG, Enigmail, GPGTool...
by chopin on Friday June 15, 2018 @06:51AM
(#17318817)
As I am mainly a Java guy it has burnt into me to never rely on .toString() output for code flow. It seems to me that this is somewhat similar (or has the Unix world a gentlemans agreement that output has an API contract). I'd never touch anything where I couldn't enforce (preferably typed) output to rely on especially in a security context. I think I have already seen command line tools which can return structured content (json, xml) with a switch (I don't remember which, though).
Re:SigSpoof: Spoofing signatures in GnuPG, Enigmail, GPGTool...
by bjpbakker on Friday June 15, 2018 @09:35AM
(#17319642)
> I have already seen command line tools which can return structured content (json, xml) with a switch
That happens. It doesn't need to a standard format like that however. Some command like tools add a porcelain option that produces output for scripting (ie no ansi color codes, easy to parse, etc). That works well too.
Re:SigSpoof: Spoofing signatures in GnuPG, Enigmail, GPGTool...
by FredFS456 on Friday June 15, 2018 @07:56AM
(#17319073)
awscli tools can generally do so.
Re:SigSpoof: Spoofing signatures in GnuPG, Enigmail, GPGTool...
by evancox100 on Friday June 15, 2018 @10:05AM
(#17319840)
This is literally how all Linux and Unix CLI tools interoperate. Would be great to see wider adoption of something like PowerShell's ouput model.
I just want to add that if you have to parse command output, enforce the output format as well as you can. The --verbose bug really shouldn’t have happened.