Re: Video editing in Linux?

From: Adam D. Barratt (usenet+ucol_at_adam-barratt.org.uk)
Date: 11/05/04 

Date: 5 Nov 2004 11:56:44 +0100

In uk.comp.os.linux, in <418b4d4c.235514687@130.133.1.4>, SjT <NOT@yahoo.com>
wrote:
> Ian Molton <spyro@f2s.com> Kissed me, Licked me, then left me a note:
[...]
>>> That's a good idea actually, but surely it would be more secure if the
>>> maintainer was to run the diff file?
>>
>>Why does it amke a difference who runs diff? as long as the maintainer
>>actually reads the output of the diff program there is no problem.
>
> Well you could change the code to fix the problems, run a diff on it,
> save the resulting file.
>
> Then, modify the code to add your malicious code and send that file
> with the original diff file you made previous?

You're missing a key point. You *don't* send the code, you *only* send
the patch/diff. The maintainer checks the patch and, if they're happy
with it, applies it.

You could send them a complete patched file, but anyone even vaguely
competent is going to ignore it entirely and simply use the patch.
That's what it's there for.

Adam 

-- 
A "goto" in Perl falls into the category of hard things that should be
possible, not easy things that should be easy.
             -- Larry Wall in <199709041935.MAA27136@wall.org>

Relevant Pages

  • Re: libssl - Debian
    ... Ob ich dazu diff aufrufe ... Also wo hat bitte schön ein Patch gefehlt, ... Der Debian Maintainer ist nicht im rosafarbenen Tuetue durch den Reif ... Vernuenftigen Menschen im Upstream eingekippt wird? ...
    (de.comp.security.misc)
  • [PATCH] cpufreq: correct broken links and email address
    ... documentation and in source code. ... diff -upr ... -#define MAINTAINER "cpufreq@xxxxxxxxxxxxxxxxxx" ...
    (Linux-Kernel)
  • Re: libssl - Debian
    ... Ob ich dazu diff aufrufe ... noch der Funktionsname als weitere Information auftaucht. ... Der Debian Maintainer ist nicht im rosafarbenen Tuetue durch den Reif ... Fehlermeldung eines von den Distributionsmaintainern einer ...
    (de.comp.security.misc)
  • Success! was Re: tvtime audio vs pcHDTV-3000 card and pvHDTV-1.6 software
    ... On Wednesday 16 March 2005 20:15, Gene Heskett wrote: ... > that a diff actually outputs only the src code differences, ... nor in that simple little 10 line patch that ... >Unforch, the 2.6.11 plain tree has not, in this case been built yet ...
    (Linux-Kernel)
  • Re: how to compile and install a new driver
    ... Warren Block wrote: ... but you'd better include enough info so that they could make FreeBSD-stype diffs: diff has the unfortunate default of making an output that is compatible with ed. ... This supplies extremely little information to use, in case the file you're trying to patch with that diff has changed, and is also damned hard for mere humans to understand. ... then you can compile. ...
    (freebsd-questions)