News for hackers. Stuff that matters.
Re:Xonsh: Python-powered, cross-platform, Unix-gazing shell by ilyagr on Friday September 14, 2018 @04:55PM (#17990860)
Sounds neat. However, the fact that `ls -l` either subtracts two numbers or calls a shell command, depending on whether there exist valriables 'ls' and 'l' in the Pythom environment, looks like a security nightmare waiting to happen. What if I create a python object 'ls' deep inside a script that does Evil when subtracted from?
Re:Xonsh: Python-powered, cross-platform, Unix-gazing shell by scopatz on Friday September 14, 2018 @05:04PM (#17990919)
Python variables are scoped as normal, so the security story for xonsh is the same as for Python. We are always open to suggestions and PRs to harden the code base as needed.
Re:Xonsh: Python-powered, cross-platform, Unix-gazing shell by bitwize on Friday September 14, 2018 @05:58PM (#17991343)
It could be worse. It could be a Wolfram shell, in which case 'ls -l' would return 'l(s - 1)'.
Re:Xonsh: Python-powered, cross-platform, Unix-gazing shell by Norther on Friday September 14, 2018 @06:08PM (#17991432)
What's stopping a Bash script from doing something similar? You could alias ls to a malicious actor for example.
Re:Xonsh: Python-powered, cross-platform, Unix-gazing shell by kbd on Friday September 14, 2018 @06:23PM (#17991552)
Well, aliases are ignored in scripts usually, but you could prepend something to the PATH so your script/exe gets found before built-ins, no? I agree, I don't see that this is a problem unique to Xonsh.
Re:Xonsh: Python-powered, cross-platform, Unix-gazing shell by djsumdog on Saturday September 15, 2018 @02:13AM (#17993233)
I mean, that's the underlying concept behind the fork bomb isn't it? With ":() { :|:&}" you're essentially redefining the bash noop to be a function that pipes/forks itself into itself recursively.

It's the reason './' is not in the default path as well (so you can't place an 'ls' in your home directory and have the admin run your command instead of the real ls).

Re:Xonsh: Python-powered, cross-platform, Unix-gazing shell by daveFNbuck on Friday September 14, 2018 @06:46PM (#17991705)
Why not just do the evil directly in the script if you can do that?
Re:Xonsh: Python-powered, cross-platform, Unix-gazing shell by bmer on Friday September 14, 2018 @07:05PM (#17991798)
Obfuscation minimizes time to discovery? Indirection is a possible technique for obfuscation?
Re:Xonsh: Python-powered, cross-platform, Unix-gazing shell by ryanlol on Saturday September 15, 2018 @04:54AM (#17993572)
This is a super silly concern.
Re:Xonsh: Python-powered, cross-platform, Unix-gazing shell by m45t3r on Friday September 14, 2018 @06:10PM (#17991447)
You