Re:SigSpoof: Spoofing signatures in GnuPG, Enigmail, GPGTool...
by chopin on Friday June 15, 2018 @06:51AM
(#17318817)
As I am mainly a Java guy it has burnt into me to never rely on .toString() output for code flow. It seems to me that this is somewhat similar (or has the Unix world a gentlemans agreement that output has an API contract). I'd never touch anything where I couldn't enforce (preferably typed) output to rely on especially in a security context. I think I have already seen command line tools which can return structured content (json, xml) with a switch (I don't remember which, though).
[ Parent
| on HN ]
Re:SigSpoof: Spoofing signatures in GnuPG, Enigmail, GPGTool...
by bjpbakker on Friday June 15, 2018 @09:35AM
(#17319642)
> I have already seen command line tools which can return structured content (json, xml) with a switch
That happens. It doesn't need to a standard format like that however. Some command like tools add a porcelain option that produces output for scripting (ie no ansi color codes, easy to parse, etc). That works well too.