From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Eli Zaretskii Newsgroups: gmane.emacs.bugs,gmane.emacs.pretest.bugs Subject: bug#865: 23.0.60; The directory is unsafe today Date: Tue, 09 Sep 2008 21:52:49 +0300 Message-ID: References: <48BD642C.5050405@gmail.com> <48BDD155.8060005@gnu.org> <48BF2171.8040101@gnu.org> <48BF5671.1040705@gnu.org> Reply-To: Eli Zaretskii , 865@emacsbugs.donarmstrong.com NNTP-Posting-Host: lo.gmane.org X-Trace: ger.gmane.org 1220987272 30780 80.91.229.12 (9 Sep 2008 19:07:52 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Tue, 9 Sep 2008 19:07:52 +0000 (UTC) Cc: emacs-pretest-bug@gnu.org, 865@emacsbugs.donarmstrong.com To: Stefan Monnier Original-X-From: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Tue Sep 09 21:08:46 2008 Return-path: Envelope-to: geb-bug-gnu-emacs@m.gmane.org Original-Received: from lists.gnu.org ([199.232.76.165]) by lo.gmane.org with esmtp (Exim 4.50) id 1Kd8Zy-0005im-86 for geb-bug-gnu-emacs@m.gmane.org; Tue, 09 Sep 2008 21:08:46 +0200 Original-Received: from localhost ([127.0.0.1]:35835 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1Kd8Yy-0007vT-5O for geb-bug-gnu-emacs@m.gmane.org; Tue, 09 Sep 2008 15:07:44 -0400 Original-Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1Kd8Yu-0007uj-0e for bug-gnu-emacs@gnu.org; Tue, 09 Sep 2008 15:07:40 -0400 Original-Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1Kd8Yt-0007tU-1U for bug-gnu-emacs@gnu.org; Tue, 09 Sep 2008 15:07:39 -0400 Original-Received: from [199.232.76.173] (port=40284 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1Kd8Ys-0007tN-J6 for bug-gnu-emacs@gnu.org; Tue, 09 Sep 2008 15:07:38 -0400 Original-Received: from rzlab.ucr.edu ([138.23.92.77]:35684) by monty-python.gnu.org with esmtps (TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.60) (envelope-from ) id 1Kd8Yr-0004J5-6l for bug-gnu-emacs@gnu.org; Tue, 09 Sep 2008 15:07:38 -0400 Original-Received: from rzlab.ucr.edu (rzlab.ucr.edu [127.0.0.1]) by rzlab.ucr.edu (8.13.8/8.13.8/Debian-3) with ESMTP id m89J7W0i014061; Tue, 9 Sep 2008 12:07:32 -0700 Original-Received: (from debbugs@localhost) by rzlab.ucr.edu (8.13.8/8.13.8/Submit) id m89J050j010407; Tue, 9 Sep 2008 12:00:05 -0700 X-Loop: don@donarmstrong.com Resent-From: Eli Zaretskii Resent-To: bug-submit-list@donarmstrong.com Resent-CC: Emacs Bugs Resent-Date: Tue, 09 Sep 2008 19:00:05 +0000 Resent-Message-ID: Resent-Sender: don@donarmstrong.com X-Emacs-PR-Message: report 865 X-Emacs-PR-Package: emacs X-Emacs-PR-Keywords: Original-Received: via spool by 865-submit@emacsbugs.donarmstrong.com id=B865.12209863818252 (code B ref 865); Tue, 09 Sep 2008 19:00:05 +0000 Original-Received: (at 865) by emacsbugs.donarmstrong.com; 9 Sep 2008 18:53:01 +0000 Original-Received: from mtaout3.012.net.il (mtaout3.012.net.il [84.95.2.7]) by rzlab.ucr.edu (8.13.8/8.13.8/Debian-3) with ESMTP id m89IqvCg008246 for <865@emacsbugs.donarmstrong.com>; Tue, 9 Sep 2008 11:52:58 -0700 Original-Received: from HOME-C4E4A596F7 ([84.229.211.50]) by i_mtaout3.012.net.il (HyperSendmail v2004.12) with ESMTPA id <0K6X002VXZ5CFAO2@i_mtaout3.012.net.il> for 865@emacsbugs.donarmstrong.com; Tue, 09 Sep 2008 21:53:37 +0300 (IDT) In-reply-to: X-012-Sender: halo1@inter.net.il X-detected-kernel: by monty-python.gnu.org: Linux 2.6 (newer, 3) Resent-Date: Tue, 09 Sep 2008 15:07:39 -0400 X-BeenThere: bug-gnu-emacs@gnu.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Bug reports for GNU Emacs, the Swiss army knife of text editors" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Original-Sender: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Errors-To: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.bugs:20406 gmane.emacs.pretest.bugs:23028 Archived-At: > From: Stefan Monnier > Cc: 865@emacsbugs.donarmstrong.com, jasonr@gnu.org, emacs-pretest-bug@gnu.org > Date: Tue, 09 Sep 2008 10:37:57 -0400 > > > But I don't think we should dismiss the privacy issue just because it > > can be bypassed by an ill meaning program: the same can happen on > > Unix, given a program that deliberately gains root access. "Normal" > > programs don't use those special access flags and privileges, and so > > cannot access files in a private directory. > > Huh? Those programs that can deliberately gain root access are kept > under very tight control. For a normal user to be able to read > arbitrary files on the system is considered as a major security hole on > unixy systems (even if she has to go through contortions to do that). I'm not going to argue about merits and demerits of Unix vs Windows wrt security. My point was that using a private directory in server.el is important on Windows even if you think its security level is lower than that of Unix systems. And I hoped that you'd provide some guidance for implementing this on Windows.