Hacker News Reader

If I had to guess, I'd say they were doing it because it is often installed with suid root.

Edit: also, there's a challenge about this in the program's README :-)

"Decide for yourself, of course, but it looks safe to me - there's only one buffer and fgets doesn't let it overflow, there's only one file opening, and while there is a potential race condition there, it's with /dev/console. If someone can exploit this race by replacing /dev/console, you've got bigger problems. :)"

It should be pointed out that the README is wrong about the race condition – it is not limited to /dev/console, you can use the -e option to point it to a different output device.

It doesn't open /dev/console by default either (the default device is /dev/tty0).

I don't see where the race condition is, though.

I was looking into this the other day. It was the original developer of the tool who found the vulnerability in it.

I wouldn't assume that someone was actively looking for vulnerabilities there.

Perhaps a user got curious how is this implemented, looked at the source, and was horrified with what they saw.