News for hackers. Stuff that matters.
Re:SigSpoof: Spoofing signatures in GnuPG, Enigmail, GPGTool... by chopin on Friday June 15, 2018 @06:51AM (#17318817)
As I am mainly a Java guy it has burnt into me to never rely on .toString() output for code flow. It seems to me that this is somewhat similar (or has the Unix world a gentlemans agreement that output has an API contract). I'd never touch anything where I couldn't enforce (preferably typed) output to rely on especially in a security context. I think I have already seen command line tools which can return structured content (json, xml) with a switch (I don't remember which, though).
Re:SigSpoof: Spoofing signatures in GnuPG, Enigmail, GPGTool... by bjpbakker on Friday June 15, 2018 @09:35AM (#17319642)
> I have already seen command line tools which can return structured content (json, xml) with a switch

That happens. It doesn't need to a standard format like that however. Some command like tools add a porcelain option that produces output for scripting (ie no ansi color codes, easy to parse, etc). That works well too.

Re:SigSpoof: Spoofing signatures in GnuPG, Enigmail, GPGTool... by FredFS456 on Friday June 15, 2018 @07:56AM (#17319073)
awscli tools can generally do so.