← Back to context

Comment by trasz

5 years ago

Finger is much better than HTTP from a security point of view, because it’s incomparably less complex (does one thing only), which eg removes all the risks coming from scripting, and makes sandboxing trivial - on both ends of the connection.

3 comments

trasz

Reply
epc  5 years ago

The Morris worm spread through a bug in finger(d). Turned out doing one thing only could still be a vector for a system compromise.

johannes1234321  5 years ago

Is it?

True, most finger implementations are trivial. But there is nothing stopping to create a finger daemon which does something dynamic based on the query the user sends. The same set of vulnerabilities is possible. It is also possible to write a simple web server for a single purpose without scripting, which is similarly secure to a finger daemon. Also finger clients are relatively secure as they don't do any interpretation of the data, (which might mean that they don't do any validation, which would allow console injections with escape sequences....) but there isn't anything stopping to send the response in HTML. Also you can write an as secure HTTP client for that tight use case.

In addition we have tons of tools to work with HTTP for debugging, proxying, caching, filtering, ... none of those for finger (which of course is a responds to nobody using finger and everybody using HTTP) which allow better handling.