Comment by shermantanktop
4 days ago
You’re saying it’s not a 2 tier client/server app, it’s a one tier app with no intermediate API to define or enforce permissions. Fine.
But the filesystem access to read/write the db files creates a path to bypass half of that application.
Does the application checksum the db file and have any resistance to filesystem tampering? That'd be trivial to beat, I’m sure, but it’d be something.
Well, on a different note, if you have a scripted language application, you typically can edit files and bypass whatever you want on the application. In fact, I'd bet most modern software isn't signed; and even if it is, sometimes the libraries that get compiled in into that signed binary... aren't.
I can change the behaviour of many/most applications by just having read/write access to files; Can you give me examples of mainstream applications that are resistant to filesystem tampering when eg.you have install access? Maybe I'm missing something.
> But the filesystem access to read/write the db files creates a path to bypass half of that application.
Is there any local/native application for which this is not true?
With a permissions system that’s meant to enforce security? I hope not.
I’m not a FoxPro user and so maybe these are single-user/single-host installs, where the user can only destroy their own data, and permissions are a pretend feature. In which case, carry on.
> With a permissions system that’s meant to enforce security? I hope not.
There's different needs for a permissions system.
You're thinking of it as "lock to the main entrance of a maximum security prison". Think of it more as a lock on a bedroom door: it's not there to withstand a SWAT assault, it's there to keep people from accidentally walking in.
All local applications (which were all applications in the era we are talking about) with permissions were sold to companies on the understanding that there was no real security.
Hell, even the networked products at the time had no real security :-/
Can't you just use filesystem permissions? Like, FoxPro under its own user and it's database owned and accessible by FoxPro user only?
1 reply →