Re: [friam] SOSP History Day

On Mon, Oct 12, 2015 at 08:16:09AM -0500, David Nicol wrote:
> Square root having authority to delete files, were the library
> compromised, is an excellent example.

It is a good example when you wish to narrow it down as far
as possible, but it is a little far-fetched when you wish to
explain capabilities to neophytes. In the case of sqrt, either
you have installed a malicious system library, or someone
untrustworthy is launching your authority-carrying (setuid...)
binary and linking it with his malicious library.

A more reasonable example would be something that is not
always installed with the system and often updated, such as a
third-party statistics package, or even better a video player
or a PDF reader. Those don't even have to be malicious, just
too complex and vulnerable to malicious input, and there are
multiple real-world examples of such problems.

-- 
Lorens