Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 3 May 2016 16:51:10 -0700
From: Tim <tim-security@...tinelchicken.org>
To: Seth Arnold <seth.arnold@...onical.com>, oss-security@...ts.openwall.com
Subject: Re: ImageMagick Is On Fire -- CVE-2016-3714


> Or, replace the strings with arrays and use execve() instead of system().
 
^^^

That.

system() should be taken out into the street and shot.  There's just
no good reason for a respectable programmer to use it.

Not saying that's the *only* thing they would need to do, but we need
to encourage development platforms, in general, to stop offering up
awful interfaces like this.  Heck, Node.js offers a child_process.exec()
call that isn't exec at all.  It is (approximately) system().  Surely
that won't lead to any problems...

tim

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.