Path: utzoo!censor!geac!torsqnt!news-server.csri.toronto.edu!rutgers!att!emory!wa4mei!holos0!lbr
From: lbr@holos0.uucp (Len Reed)
Newsgroups: comp.unix.misc
Subject: Re: Who's in my Directory ?
Message-ID: <1990Nov23.162824.2090@holos0.uucp>
Date: 23 Nov 90 16:28:24 GMT
References: <1990Nov21.013355.16798@maverick.ksu.ksu.edu> <8314@star.cs.vu.nl> <1990Nov21.155805.27426@decuac.dec.com>
Organization: Holos Software, Inc., Atlanta, GA
Lines: 25

In article <1990Nov21.155805.27426@decuac.dec.com> mjr@hussar.dco.dec.com (Marcus J. Ranum) writes:
>In article <8314@star.cs.vu.nl> gpvos@cs.vu.nl (Gerben 'P' Vos) writes:
>>
>>I know a student around here with an "ls" shellscript in their home directory,
>>which *copied your mailbox* into a subdirectory, so he could read it.
=
=	That's *nothing* compared to what he could have done.
=
=	I used to have a hacked up version of sh that used to have a
="set showexec" that would print the name of the program being run when
=it ran it - useful for catching something like that. You only catch it
=after the fact, but you can still go beat them bloody until they tell
=you in detail what './ls' really did.

Hmm, so what you're saying is that you leave a big security hole and then,
after the fact, retaliate against whoever broke in.  Why don't you
publish your password and set things up so you can catch whoever broke
in?  Such things are reasonable only if you're conducting a sting
operation.  If not, '.' shouldn't be in your path ahead of the public
directories.
-- 
Len Reed
Holos Software, Inc.
Voice: (404) 496-1358
UUCP: ...!gatech!holos0!lbr