From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from localhost (localhost [127.0.0.1]) by arlo.cworth.org (Postfix) with ESMTP id 396C06DE0B39 for ; Fri, 12 Aug 2016 12:25:50 -0700 (PDT) X-Virus-Scanned: Debian amavisd-new at cworth.org X-Spam-Flag: NO X-Spam-Score: -0.051 X-Spam-Level: X-Spam-Status: No, score=-0.051 tagged_above=-999 required=5 tests=[AWL=-0.051] autolearn=disabled Received: from arlo.cworth.org ([127.0.0.1]) by localhost (arlo.cworth.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jJHyLM2WiwXq for ; Fri, 12 Aug 2016 12:25:42 -0700 (PDT) Received: from che.mayfirst.org (che.mayfirst.org [162.247.75.118]) by arlo.cworth.org (Postfix) with ESMTP id CF44B6DE0B12 for ; Fri, 12 Aug 2016 12:25:41 -0700 (PDT) Received: from fifthhorseman.net (unknown [38.109.115.130]) by che.mayfirst.org (Postfix) with ESMTPSA id 95514F98B; Fri, 12 Aug 2016 15:25:39 -0400 (EDT) Received: by fifthhorseman.net (Postfix, from userid 1000) id D046820248; Fri, 12 Aug 2016 14:46:38 -0400 (EDT) From: Daniel Kahn Gillmor To: David Bremner , Notmuch Mail Subject: Re: [PATCH v4 01/16] add util/search-path.{c, h} to test for executables in $PATH In-Reply-To: <87y442phbm.fsf@maritornes.cs.unb.ca> References: <1467970047-8013-1-git-send-email-dkg@fifthhorseman.net> <1467970047-8013-2-git-send-email-dkg@fifthhorseman.net> <878tw2r0vf.fsf@maritornes.cs.unb.ca> <87k2fmse5h.fsf@alice.fifthhorseman.net> <87y442phbm.fsf@maritornes.cs.unb.ca> User-Agent: Notmuch/0.22.1+88~g8d09e96 (https://notmuchmail.org) Emacs/24.5.1 (x86_64-pc-linux-gnu) Date: Fri, 12 Aug 2016 14:46:38 -0400 Message-ID: <87mvkhrfjl.fsf@alice.fifthhorseman.net> MIME-Version: 1.0 Content-Type: text/plain X-BeenThere: notmuch@notmuchmail.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: "Use and development of the notmuch mail system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 12 Aug 2016 19:25:50 -0000 On Fri 2016-08-12 03:38:53 -0400, David Bremner wrote: > Daniel Kahn Gillmor writes: > >>> Should we distinguish between relative and absolute paths here? I can't >>> think of any security implications, but I'm wondering if a relative path >>> is likely just a user error. >> >> I don't think a relative path is necessarily a user error. I certainly >> use relative paths myself from time to time. > > As configuration values? That seems quite fragile, since it depends on > the current working directory when notmuch is run. rarely! but sometimes i do it because i'm testing things in strange ways, and it can be a bit frustrating to have a tool second-guess me when it seems like i ought to be able to drop the same string i'm using on the command line into the configuration. I don't feel strongly, though. if you want to say that bare words found in the $PATH and absolute filenames (starting with /) are fine in the notmuch config but relative paths are not, i'd be ok with that :) --dkg