Hacker News Reader

Comment by bawolff | Hacker News Reader

> ...but the fact that file:// schemes can access remote files by appending /net/ followed by a domain name is pretty shocking.

Not that shocking. Windows has had that with SMB networking for ages file://SMBSERVERNAME/path/file . Linux somewhat supports /dev/tcp/HOSTNAME/PORT (technically that's application level in bash so not everywhere), and im sure there's daemons you could run to automount things on the fly.

View on HN

> Linux somewhat supports /dev/tcp/HOSTNAME/PORT (technically that's application level in bash so not everywhere), and im sure there's daemons you could run to automount things on the fly.

Do note that this has been disabled in the major distributions at compile time for pretty much ever. The debian bug to build bash with that feature by default is ~20 years old (and was closed as wontdo).

On two different Debian 10 boxes bash seems to have it enabled:

  Terminal 1
  $ echo hi > /dev/tcp/127.0.0.1/9999

  Terminal 2
  $ nc -vvvlp 9999
  Listening on [0.0.0.0] (family 2, port 9999)
  Connection from 127.0.0.1 57540 received!
  hi
  $

For anyone wondering, it is enabled by default on Ubuntu too. I wonder what made someone think that this was a good idea?

If you follow the everything is a file philosophy it seems quite natural does it not?

Except permissions aren't granular enough / are too confusing, it's a giant footgun with the current Linux architecture, which doesn't have all the nice things Plan9 does

I mean, unless you're host is extremely locked down you'll probably also have telnet,netcat, etc installed, so no great difference.

I'm no specialist but I'm inclined to disagree, for me it's the difference between the ability to run an arbitrary binary and the ability to read/write an arbitrary filepath

They are imaginary paths in the bash executable. They aren't usable outside it. Thus the netcat analogy.

Anything you can do in telnet or netcat can also be done in python, perl, ruby. One of those is likely installed, most probably python.

And if you think about if all applications where using files for communication blocking one program from the internet would be as simple as a chmod.

I didn't say that the everything is a file philosophy is necessarily correct and well implemented on Linux. Merely that if you where to continue along this direction it would seem like a logical next step. I don't think I would use this for anything but for shell scripts at best. However especially if you are a plan 9 fanatic then it would seem like quite a good idea which is what the original question was.

Although it was disabled in Debian bash 2.04-5 on 2000-06-05, it was re-enabled in bash 4.0-5 on 2009-09-13 and is currently enabled. See https://metadata.ftp-master.debian.org/changelogs/main/b/bas...

SMB is more understandable though, since you have more trust for things on your local network, and an attacker usually won't have control over those resources. And it's a fairly common and reasonable expectation in a business environment that network drives appear as part of the filesystem.

Whereas a domain name over the open internet is an entirely different story.

Its been a while since i've done windows stuff, but i thought you could use IP addresses in addition to netbios names for smb - \\1.2.3.4\share\file

You can use \\domain.name\share\ as well.

Actually if I am not mistaken it is after they want to fight the browser war they break the barrier between the file system and internet system. It is not in the early version of windows or IE. the integration is one of the major mistakes Microsoft made. And surprise apple fall for it as well.

Can’t trust these two or ,,, who can we trust for network security.

Reply on news.ycombinator.com