Hacker News Reader

Comment by username223 | Hacker News Reader

The first time I accidentally ran "less" on a directory and it piped some version of "ls" into itself, I was mildly annoyed. The thing's supposed to page a text file on a terminal. Since then, I've had to think twice before invoking it to avoid this "helpful" behavior, and I'm not surprised that it came back to bite people.

View on HN

> The first time I accidentally ran "less" on a directory and it piped some version of "ls" into itself, I was mildly annoyed.

    % less .
    . is a directory
    % less imadir
    imadir is a directory

My point is, that behavior is a configuration issue on your end, not inherent to the less codebase.

I believe that is the point of the linked email. Some distributions have less symlinked to something else (e.g. the lesspipe script) for convenience. Plain 'ol less isn't that much of a problem.

> My point is, that behavior is a configuration issue on your end, ...

On my end, and on every "end" where I ever log in. "less" works as a simple pager on my own system, but now I need to remember to possibly fix it everywhere else. "You can fix it in the config file" is not an excuse for broken-by-design software.

> ... not inherent to the less codebase.

Well yes, it kind of is. "less" used to be a better replacement for "more." Now it's something else, which should have a different name. Should "cat" be changed to automatically uncompress files and concatenate archives?

> Well yes, it kind of is. "less" used to be a better replacement for "more." Now it's something else, which should have a different name. Should "cat" be changed to automatically uncompress files and concatenate archives?

"less" already means "pager with all the bells and whistles". If you just want a simple pager, "more" is still there. How many fine gradations do you need?

Back in the old, old days, we all started using 'less' because 'more' did not have the ability to scroll backwards through a file. Nor was it buffering pipe input to enable similar functionality. It seems there has been a bit of feature creep in the ensuing 25 years...

Yup, cause apparenlty staying the same for 25 years is the new normal. Would you discard more too if it added the ability to page back in a document?

No, but if the maintainers added the ability to play MP3s and file my taxes, that is a cause for concern.

You could replace your less with the busybox version of less, which does not support LESSOPEN.

My understanding is that the less codebase has the hooks (LESSOPEN and LESSCLOSE), and it's configurable (by presence or absence of the variables) whether they're used.

You may also want to try the 'most' command, which is like less but more advanced.

More advanced is exactly the problem here.

If you use a simpler program like 'more' or 'pg', you won't have these kinds of vulnerabilities.

The vulnerability is not actually in the less command. Did you overlook that?

Using a simpler program is useless when that's not the problem in the first place. Using more instead gains you nothing except a less useful program.

The vulnerability is in less-the-complete-system. More doesn't even have the ability to pipe its input through random shell scripts that call exploitable programs, AFAIK.

The problem is parsing complex file formats in unsafe programming languages, and any system which does that will be vulnerable.

We need a less that does less than less today but more than more

This reminds me of an old program called list.com that could open anything as a text file. Any size whatsoever, any line size, etc.

I suppose this would be the more straightforward and expected behaviour:

    less: somedir: is a directory

Reply on news.ycombinator.com