Hacker News Reader

Comment by gruez | Hacker News Reader

You put the directory somewhere (eg. usb drive) and hope someone enters the directory and executes a git command.

To elaborate on your comment, on UNIX systems, you don't put "." in $PATH because someone might put a malicious executable named `ls` or `cd`, in a directory. It doesn't have root privileges, but it runs as your user account and can get some kind of persistence by hooking `~/.bashrc`. And perhaps by wrapping `sudo` it can eventually get root privileges.

That doesn't work if . is at the end of $PATH though? Since the real ones would take precedence due to how executable searching works...?

You never type sl on accident?

You should install https://github.com/mtoyoda/sl as a hardening measure.

Surprisingly, no... I thought I would, but somehow I've avoided this particular transpositional mistake (probably also due to my habit of setting up a ll or la macro for ls -l and ls -a).

That said, I also don't actually put "." in my path, though this is mainly so I can avoid heisenbugs rather than a security concern...

If that defence works reliably or not depends on whether you have sl installed or not.

    SL(6)                     Games Manual                    SL(6)

    NAME
           sl - display animations aimed to correct users who acci-
           dentally enter sl instead of ls.

Reply on news.ycombinator.com