Re: EPNG Chunk Registration

On 07/08/16 01:41 AM, John Bowler wrote:
>> Example
>>
>> The exEc chunk containing #/usr/bin/env xdg-open should open the image
>> in the default image viewer, given a system with xdg-open and GNU
>> coreutils installed.

Sorry, that was a typo. It should've been #!.

> This looks like a reference to the UNIX '#!' hack; in UNIX the kernel
> looks at the first few bytes of an executable and, if they start with
> '#!' it executes the file in the following (space delimited) bytes.
> It is a big, horrible, security nightmare.  I can't imagine anyone in
> their right mind would actually implement such a facility for a PNG.
>
> Perhaps more important, I wouldn't want to encourage anyone,
> regardless of mindset, to do so.  Glenn's sarcastic comment on the
> original link might help if you don't understand the history of the
> '#!' mess, or the consequences of executing arbitrary data.
>
> To understand the example you may need to know that '/usr/bin/env' is
> a shorthand for 'sh -c', which, in its turn, is  longhand for the
> empty string; in other words it means 'execute whatever follows'.
>
> The example as stated is just a restatement of the original (or more
> likely Xerox PARC) Apple meme of associating a document (a PNG is a
> document) with an 'editor'; a preferred application to use for a
> default action ('open') on the document.  Since PNG is such a generic
> format there may be some merit in what I hope underlies the proposal.
>
> John Bowler <[email protected]>
>
> ------------------------------------------------------------------------------
> _______________________________________________
> png-mng-misc mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/png-mng-misc


------------------------------------------------------------------------------