[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 31 Oct 2017 19:57:14 +0100
From: Steffen Nurpmeso <steffen@...oden.eu>
To: oss-security@...ts.openwall.com
Subject: Re: Fw: Security risk of vim swap files
Tim <tim-security@...tinelchicken.org> wrote:
|On Tue, Oct 31, 2017 at 01:23:52PM +0100, Hanno Böck wrote:
|> I just sent this to the vim dev list, but I guess it's interesting for
|> oss-security, too.
|> ...
...
|Sure, you can argue that maybe some systems should ignore these files,
|block access, etc, but it is pretty absurd to expect every other piece
|of software in the universe to work around very unsafe defaults of text
|editors.
|
|Also, it almost never makes sense to put things in /tmp, for several
|reasons pointed out by others. Making ~/.vim/... the default location
|clearly is the best solution.
I for one really dislike that for many years (i think .gconf and
all around that was the first time i recognized the problem) that
more and more programs think they can simply create a dot
directory in my $HOME. Indeed i have started using umask 0077 due
to this. I use "set dir=~/traffic" and "set backupdir=~/traffic"
and that has a mode of 0700. My vim(s) has/ve never needed ~/.vim.
--steffen
|
|Der Kragenbaer, The moon bear,
|der holt sich munter he cheerfully and one by one
|einen nach dem anderen runter wa.ks himself off
|(By Robert Gernhardt)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
