Hacker News Reader

Comment by chopin | Hacker News Reader

I am pretty baffled by the fact that anyone relies on output parsing for verifying a signature. Is this common? I suspect that we will see more vulnerabilities like this in that case.

If one relies on a command line tool for doing this, wouldn't it be safer to have a command line switch which lets the program exit with 0 if the verification succeeds and another value if it fails?

Has anyone an elif what the fix would be? Just altering a switch (which I suspect) would be a band-aid, imho.

View on HN

Return code doesn't help this time because there is more than one kind of correct input. There can be valid encrypted message, valid signed message or combination of both. In the attack valid encrypted message was made to look like valid signed message. For both verification would succeed unless you know what the message is supposed to contain before processing it with gpg.

As already suggested output parsing here is necessary due to multiple possible outcomes.

I just want to add that if you have to parse command output, enforce the output format as well as you can. The --verbose bug really shouldn’t have happened.

As I am mainly a Java guy it has burnt into me to never rely on .toString() output for code flow. It seems to me that this is somewhat similar (or has the Unix world a gentlemans agreement that output has an API contract). I'd never touch anything where I couldn't enforce (preferably typed) output to rely on especially in a security context. I think I have already seen command line tools which can return structured content (json, xml) with a switch (I don't remember which, though).

awscli tools can generally do so.

> I have already seen command line tools which can return structured content (json, xml) with a switch

That happens. It doesn't need to a standard format like that however. Some command like tools add a porcelain option that produces output for scripting (ie no ansi color codes, easy to parse, etc). That works well too.

This is literally how all Linux and Unix CLI tools interoperate. Would be great to see wider adoption of something like PowerShell's ouput model.

This is uncommon and almost certainly specific to PGP. The PGP spec is large and complex. It's infinitely easier to use gpg(1) and parse its output than actually implementing PGP you need.

The GPL license might be part of why this is done; running GPG in a separate process avoids infecting your code with its license.

This may or may not be true. Please ask your lawyer.

IANAL and I'm not saying this works from a legal standpoint (my understanding is it depends), I'm just arguing this is one reason why people might do this (run an executable and parse the output instead of just linking a library and passing proper data structures). I've seen it happen in another context.

Elif?

I'm guessing they meant "Explain like I'm five". Though I usually see it abbreviated as ELI5.

Reply on news.ycombinator.com