Re: master 739593d 3/5: Make gnus-copy-file act like copy-file etc.

[Eli Zaretskii]

> Cc: address@hidden, address@hidden
> From: Paul Eggert <address@hidden>
> Date: Thu, 14 Sep 2017 21:04:16 -0700
> 
> Eli Zaretskii wrote:
> > no bot or person can reasonably
> > know in advance what file or directory the user will copy/rename.
> 
> Sure they can. Here's a scenario off the top of my head. A sysadmin uses 
> Emacs 
> to examine files, and has the bad (but all-too-common) habit of copying files 
> to 
> /tmp and examining the copies so that he doesn't mistakenly change the 
> originals. A malicious user asks the sysadmin to take a look at "problems" in 
> the user's ~/.ssh/known_hosts file. The sysadmin does this:
> 
> M-x copy-file RET ~malicious/.ssh/known_hosts RET /tmp/known_hosts RET
> 
> but it doesn't seem to work (there's no file in /tmp afterwards), so the 
> tired 
> sysadmin figures he mistyped the command, does the copy-file again and this 
> time 
> it works so he diagnoses the "problems". Because of the Emacs security bug 
> with 
> destination directories, the malicious user has now taken over the sysadmin's 
> personal and private known_hosts file.
> 
> The scenario works partly because the attacker knows the habits of the 
> victim. 
> Such habits are often easy to discover.
> 
> One possible solution to all this is to tell ones' sysadmins "Do not use 
> Emacs: 
> it has too many security holes". But I'm fond of Emacs, and would rather that 
> sysadmins could trust it to do their work.

The same sysadmin could do the same with Coreutils, with the same
results, right?

Sorry, Paul, this is not going to fly with me.  I still think that
changing the interactive behavior in these cases is wrong, and we
shouldn't do it.