From mboxrd@z Thu Jan  1 00:00:00 1970
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 6.2 \(1499\))
From: arisawa <arisawa@ar.aichi-u.ac.jp>
In-Reply-To: <CAOw7k5gPHKxF9vGtnmgoxZ5KoXBMtqQBc-HxwvcZUT0HGqn-7w@mail.gmail.com>
Date: Sun, 24 Mar 2013 22:16:53 +0900
Content-Transfer-Encoding: quoted-printable
Message-Id: <2428FA36-6C18-4190-8D03-51410FC51A61@ar.aichi-u.ac.jp>
References: <53BAB592-B277-407D-9522-EADF9D77808A@ar.aichi-u.ac.jp>
	<CAOw7k5gPHKxF9vGtnmgoxZ5KoXBMtqQBc-HxwvcZUT0HGqn-7w@mail.gmail.com>
To: Fans of the OS Plan 9 from Bell Labs <9fans@9fans.net>
Subject: Re: [9fans] a security problem in /sys/log/*
Topicbox-Message-UUID: 333a6c9a-ead8-11e9-9d60-3106f5b1d025

Thanks Forsyth,

/sys/log/cpu is an error log. Therefore It is sure that I did something =
stupid.=20
I tried reproducing same error log, and I found Russ is very careful =
person.
Factotum protects against revealing users password. For example:
- protects against input such as password=3Dxxxxxxxx (without !)
- carefully hides password in /sys/log/cpu
therefore I finally gave up reproducing the error.

Kenji Arisawa

On 2013/03/24, at 18:52, Charles Forsyth <charles.forsyth@gmail.com> =
wrote:

>=20
> On 24 March 2013 09:21, arisawa <arisawa@ar.aichi-u.ac.jp> wrote:
> I think better message is desired.
>=20
> Somehow you've got something using password instead of !password as an =
attribute name. The ! would prevent the attribute's value from being =
printed.