News for hackers. Stuff that matters.
Re:YAML: probably not so great after all (2017) by JdeBP on Thursday June 21, 2018 @08:57AM (#17364629)
This, and the security problems of executable code as configuration, are why the OpenBSD people mandate that /etc/rc.conf is not general-purpose shell script, and why the systemd people mandate that /etc/os-release is similarly not. People want to be able to parse configuration files like this with something other than fully-fledged shell language interpreters; and they want these things to not be vectors for command injections.

* https://unix.stackexchange.com/a/433245/5132

There are no comments on this comment yet.