Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 5 Sep 2018 15:01:28 -0400
From: "Perry E. Metzger" <>
To: Tavis Ormandy <>
Subject: Re: Re: More Ghostscript Issues: Should we disable
 PS coders in policy.xml by default?

On Wed, 5 Sep 2018 11:02:48 -0700 Tavis Ormandy <>
> I would like to re-emphasize that while Ghostscript is very capable
> and mature software, I consider the -dSAFER sandbox to be a fragile
> security boundary and that we should consider deprecating (or
> minimizing the use of) untrusted postscript.

I haven't been following the bugs in depth (just noticing the
continuous stream of them arriving), but is the issue security flaws
in just -dSAFER or is it overall security bugs? If it's the former,
given how few things actually need any of the features past what
-dSAFER offers, perhaps compiling the code by default without any such
capabilities would work well? You can't run what isn't there.

Perry E. Metzger

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.