31 Jul
2023
31 Jul
'23
5:34 a.m.
It must be the fate of all UUCP-like protocols to recapitulate the
life of UUCP. My memory is that ACSNet (quite UUCP like) had both an
execute, and a *(a)dom.ain and even root@* handling, and that it caused
some DOS consequences.
There's nothing implicitly wrong with remote execution, remote job
entry was a thing back in the coloured book protocols. I guess the
problem inherent in "just do this thing" in UUCP was the permissions
and runtime context. But a chroot() and permissions drop should have
made it less risky. There is the "but anyone can inject it" problem.
Execute on read is just awful. But, now we have HTML to track "they
read it" through URL fetch.
G