Hacker News Reader

Comment by robinhoodexe | Hacker News Reader

"The less(1) we're all familiar with has been completely rewritten. After importing a fork from illumos' Garrett D'Amore, OpenBSD continued to make improvements to the code. A safer and more modern tool was the end result, even if it's just for viewing text. Hopefully there will be less bugs now."

Impressive work.

View on HN

And less bugs. Beautiful pun there.

...until you realize that the proper word would be "fewer" because bugs are countable.

But there's an infinite number of bugs!

Countably infinite? :)

https://en.wikipedia.org/wiki/Countable_set

Hey, just so long as it's not an infinite amount.

Hopefully fewer less bugs.

...or until you realise that the personal preferences of Robert Baker do not constitute what is "proper". It was a daft preference when expressed and it's no less a daft "rule" now.

I think you meant ”fewer daft”.

You found a bug!

Wordplay humour is not built for pedants.

english grammar strikes again

Less was unsafe? How so?

Probably by emitting control sequences from the input files unfiltered to your terminal. Just guessing, but it's the one big thing that occurs to me when thinking of an unsafe pager.

Ah, okay that makes sense. Thanks!

It may be much, much worse. http://seclists.org/fulldisclosure/2014/Nov/74:

"Many Linux distributions ship with the 'less' command automagically interfaced to 'lesspipe'-type scripts, usually invoked via LESSOPEN.

This is certainly the case for CentOS and Ubuntu.

Unfortunately, many of these scripts appear to call a rather large number of third-party tools that likely have not been designed with malicious inputs in mind. On CentOS, lesspipe appears to include things such as groff + troff + grotty, man, and cpio. On Ubuntu, there's isoinfo (?!), ar from binutils, and so on. Ancient and obscure compression utilities and doc converters crop up, too."

I vaguely remember a ?different? issue where less would load a shared library to list its symbols.

Perhaps you're thinking of the `strings` issue:

https://lcamtuf.blogspot.com/2014/10/psa-dont-run-strings-on...

Yes, indeed.

Reply on news.ycombinator.com