Re: xscreensaver package caps gets raw socket

[Ariadne Conill <ariadne () dereferenced org>]

Hello,

On Mon, 19 Apr 2021, David A. Wheeler wrote:

> > On Sat, 17 Apr 2021 at 07:41:15 -0700, Tavis Ormandy wrote:
> > > Oh, I also pitched using popen("/bin/ping" ..), but I think nobody is
> > > really convinced that will work, but I kinda like it :)
>
> On Apr 18, 2021, at 8:25 AM, Simon McVittie <smcv () debian org> wrote:
>
> > That's consistent with the principle of least-privilege, and the widely
> > cited Unix philosophy of having programs that do one thing well.
> >
> > If you need to gain privileges, then I think that's a much, much better
> > approach - ideally a new ping-like program that prints a machine-readable
> > syntax rather than having to screen-scrape human-readable output, but
> > if that's not available then ping itself is the next best thing.
>
>
> I agree, running “ping” in a separate process
> is FAR better than giving the “main” process
> extra permissions it doesn’t actually need.
> You’d have to be careful about the parameters sent, but that’s necessary anyway.
> I don’t see the problem of calling /bin/ping, that sounds like the right answer.
>
> Scraping is undesirable, but sometimes needed. If this is a common need, a
> long-term solution might be to create an option on ping to generate a standard
> format that’s easier to machine-parse.

This already exists as fping(1), for example:

$ fping -C4 -q google.com
google.com : 46.8 41.4 45.8 43.7

Ariadne