Path: utzoo!attcan!uunet!auspex!guy
From: guy@auspex.UUCP (Guy Harris)
Newsgroups: comp.unix.wizards
Subject: Re: Putting trojan horse fixes where they belong
Message-ID: <731@auspex.UUCP>
Date: 16 Dec 88 23:02:29 GMT
References: <6798@rosevax.Rosemount.COM> <591@auspex.UUCP> <6811@rosevax.Rosemount.COM> <13253@ncoast.UUCP> <6893@rosevax.Rosemount.COM>
Reply-To: guy@auspex.UUCP (Guy Harris)
Organization: Auspex Systems, Santa Clara
Lines: 18

>There are many sites that CANNOT put ANYTHING into $HOME/.exrc to turn
>  this trojan-horse mechanism off.

Those sites don't support "+set nomodelines" on the command line,
either, so the "fix" to Pnews doesn't help.

>There are probably some people who use 'set modeline[s]' in their .exrc because
>  they actually USE this feature, and requiring them to change this, instead
>  of fixing dangerously naive software, is shortsighted.

Err, umm, requiring them to change this prevents them from getting
screwed when running *other* utilities; care to track down *every single
utility* that runs "vi" - including the Bourne, C, and Korn shells - and
fix them?

Furthermore, if Arthur Olson's analysis is correct, the "+set modeline"
gets interpreted after the file's been read and checked for mode lines,
so it doesn't help anyway....