Hacker News Reader

I disagree. This bug is about trying to embed control commands into an arbitrary non-structured data stream. This is a bad idea, no matter if it's text or binary. The proper way to do this would be like the report says: open a separate channel from control commands. This is just like any other injection attack and not related to the unix philosophy.

View on HN

It's the "non-structured" part of what you said that I tried, and failed, to point out with my comment.

You don't need structure for secure control though, as long as the control channel is isolated. It's easier to make an insecure program when dealing with loosely described text streams, but it's by no means inevitable.

Doesn't have to be text.

Reply on news.ycombinator.com