Hacker News Reader

Comment by rurban | Hacker News Reader

With Perl we fixed that security risk earlier (3 years ago) and better. The path of the script is never added to the global script path anymore. This fixed all these attacks automatically. If the script was in /tmp, ~/Downloads or just ~/. We don't need to warn our users to take care, they won't. Most of them don't even read such best practice warnings.

View on HN

Similar to how Bash usually doesn't have current directory on the default PATH for executables, you must explicitly reference it ./local-executable for similar concerns.

csh (tcsh?) used to be my default shell, and the current directory was first in the path. That was really convenient. At the time, I didn't realise the risks.

I have always wondered why this was, compared to DOS!

I got burnt by an unfortunate combination of ActivePerl registering script execution as the default handler for .pl files, and some random file transfer application's "view file" dispatching to the Windows default file handler once. Wanted to view the source of a remote perl script; it ended up downloading and immediately executing the script locally with no warning. Boom!

The problem then is that more complex programs are harder break down, and people will tend to write their entire program in a single file. What does happen a lot with Perl.

Ah, that's also how you made a lot of CPAN simply not installable, prompting people who had actual jobs and deadlines just to drop in the variable USE_UNSAFE_INC=1 to get the old behavior back, and call it a day.

Or keep their Perl at 5.24.3.

You never had to do that yourself. cpanminus, cpan, and cpanplus all got patched to do that during installation for you before the release of 5.26.

Reply on news.ycombinator.com