On a multiuser system there are various cases where being able to predict the PID of a process allows attack against naive code.
On a multiuser system there are various cases where being able to predict the PID of a process allows attack against naive code. eg. If a process uses the pid to generate a tmp file name, someone sneaks in first and makes it a link and uses that to put content into an arbitrary file they shouldn't have write access to. Now, there is a valid contention that any code doing that is broken anyway and should just be fixed, and most code is much better about this now than 15 years ago. There is another contention that randomizing pids can help so why not. See http://marc.info/?t=94754302700001&r=1&w=1 and http://marc.info/?t=94759485200001&r=1&w=1 for old discussion.
Posted by znep on Mar 23, 2015, 7:32 PM
Tags
Related issues
- This is my biggest problem with agents, they constantly defensively code for cases that have no chance of happening and in most cases a p...
- I wish there was something like LEAN for biology.
- The issue is really the extreme difficulty of programming them, especially for anything sequential (rather than combinatorial).
- I probably could have beared with it if it was only limited to programming, but it showing up in creative fields has made me feel all sor...
- I hate that I'm in deep enough to know what you mean.
- The biggest problem with “AI” is that big corps are shoving it down our throats.
Raise real-world problems, find people facing the same issue, and discuss solutions.7,500 issues0 comments
reliability (Other)
This is my biggest problem with agents, they constantly defensively code for cases that have no chance of happening and in most cases a p...
I wish there was something like LEAN for biology.
The issue is really the extreme difficulty of programming them, especially for anything sequential (rather than combinatorial).
I probably could have beared with it if it was only limited to programming, but it showing up in creative fields has made me feel all sor...
I hate that I'm in deep enough to know what you mean.
The biggest problem with “AI” is that big corps are shoving it down our throats.
in the middel of a coding session with 5.6 sol.
[Hero Run] 535B-A23B on 18T tokens
On a multiuser system there are various cases where being able to predict the PID of a process allows attack against naive code.
On a multiuser system there are various cases where being able to predict the PID of a process allows attack against naive code. eg. If a process uses the pid to generate a tmp file name, someone sneaks in first and makes it a link and uses that to put content into an arbitrary file they shouldn't have write access to. Now, there is a valid contention that any code doing that is broken anyway and should just be fixed, and most code is much better about this now than 15 years ago. There is another contention that randomizing pids can help so why not. See http://marc.info/?t=94754302700001&r=1&w=1 and http://marc.info/?t=94759485200001&r=1&w=1 for old discussion.
Comments (0)
No comments yet. Start the discussion.