Re: vixie cron possible local root compromise

[gabriel rosenkoetter <gr () ECLIPSED NET>]

On Tue, Feb 13, 2001 at 03:54:00PM -0500, Alan DeKok wrote:
>   I find this attitude amazing.  You don't understand why other people
> would want to have usernames longer than 8 characters, so you're
> willing to blame *their* systems for security problems when insecure
> applications are executed on those systems.

Perhaps mine was not the most thought-out reply, but people who use
usernames longer than 8 characters should be aware that those
usernames are NOT unique under POSIX, and useradd programs that
allow them are at least *also* broken.

(No question that cron should do better bounds checking; my point
was that that bounds checking should be added out of paranoia, not
out of necessity.)

       ~ g r @ eclipsed.net