Interests: News, Finance, Computer, Science, Tech, and Living

  • 13 Posts
  • 697 Comments
Joined 2 years ago
cake
Cake day: June 13th, 2023

help-circle









  • Android is Linux using SELinux for user confinement plus users do not have root access and it uses verified boot to enforce all that.

    Keep in mind the system meaning root can do anything it wants. User apps cannot though they can ask the system to do certain things for example by SUID executables for example or other methods. Not sure how android actually does it.

    What is different about Android is owner, user, work profiles, and the new private space structure. Not sure low level how that is done but presumably combination of different users, SELinix, and different encryption keys.




  • flatbield@beehaw.orgtoPython@programming.devWhats in a Python tarball
    link
    fedilink
    English
    arrow-up
    3
    ·
    edit-2
    4 months ago

    By the way. The only files you mentioned I am less sure about are configs. Specifically if these configs are system specific, probaby only examples or templates should be included but the configs should be built by the build process on the target system.

    Edit: It should contain tests. Running some equivalent to ‘make check’ on the target system is pretty standard.

    Edit: Not sure what .github folder tree file contains so cannot say.


  • flatbield@beehaw.orgtoPython@programming.devWhats in a Python tarball
    link
    fedilink
    English
    arrow-up
    3
    ·
    edit-2
    4 months ago

    If your talking about a source distribution archive, generally it is the project in the ‘distclean’ state. This is decribed in GNU documentation. I think for GNU Make. Not sure if the git specific files should technically be included but maybe these days they should. The ‘distclean’ state is generally the same code as from the VCS tree but with hard to build files pre-built but probably not platform specific files. The ‘maintainerclean’ state is basically the clean VCS snapshot nothing pre-built.

    Edit: The reason to prebuild some not platform specific files is to minimize the tools needed for installing from source.







  • I was more thinking of the CGI script vunerability that showed up a few years ago. In that case data came from the web into the shell environment uncontrolled. So uncontrolled data processing where the input data crosses security boundaries is an issue kind of like a lot of the SQL injection attacks.

    Another issue with the shell is that all proccesses on the system typically see all command line arguments. This includes any commands the shell script runs. So never specify things like keys or PII etc as command line arguments.

    Then there is the general robustness issue. Shell scripts easy to write to run in a known environment and known inputs. Difficult to make general. So for fixed environment and known and controlled inputs that do not cross security boundaries probaby fine. Not that, probablay a big issue.

    By the way, I love bash and shell scripts.