{"comment":{"url":"https://api.github.com/repos/hpc/give/comments/9665889","html_url":"https://github.com/hpc/give/commit/1cebd3b71725981c5568ec03adecaaf7273e28ca#commitcomment-9665889","id":9665889,"user":{"login":"dayr","id":1854301,"avatar_url":"https://avatars.githubusercontent.com/u/1854301?v=3","gravatar_id":"","url":"https://api.github.com/users/dayr","html_url":"https://github.com/dayr","followers_url":"https://api.github.com/users/dayr/followers","following_url":"https://api.github.com/users/dayr/following{/other_user}","gists_url":"https://api.github.com/users/dayr/gists{/gist_id}","starred_url":"https://api.github.com/users/dayr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dayr/subscriptions","organizations_url":"https://api.github.com/users/dayr/orgs","repos_url":"https://api.github.com/users/dayr/repos","events_url":"https://api.github.com/users/dayr/events{/privacy}","received_events_url":"https://api.github.com/users/dayr/received_events","type":"User","site_admin":false},"position":55,"line":180,"path":"give.py.in","commit_id":"1cebd3b71725981c5568ec03adecaaf7273e28ca","created_at":"2015-02-09T23:49:06Z","updated_at":"2015-02-09T23:49:06Z","body":"Should probably reply this way too...\n\nAt the time that I was doing that I hadn't tracked down the give/take\nsecurity tests, and I wasn't sure what I was going to have to do to get\nyour version approved for production use, so I tried to minimize the\nfunctional differences . As it turns out, there weren't any problems\ngetting it through the security tests and approved, and I probably could\nhave left that in, but I never got back to looking at the permissions\nmasking.\n\nMy only concern with having those bits masked off in give.py would be that\nthe model for give/take is that all of the security related features are\nprovided by the give-assist program and give.py is not security sensitive\nsoftware (too easy to create a custom version of give.py or other program\nthat calls give-assist). I can imagine a scenario where a bug in\ngive-assist that allowed world access to the give spool directory was\nhidden from testing by masking off the world bits in give.py. Basically,\nthe argument is that give/take should be secure regardless of what\npermissions are set in give.py, so it's better to keep them open in give.py.\n\nRyan\n\nOn Wed, Feb 4, 2015 at 6:01 PM, Dominic Manno <notifications@github.com>\nwrote:\n\n> @dayr <https://github.com/dayr> Any particular reason you don't want to\n> mask off world write and execution bits? Just curious.\n>\n> —\n> Reply to this email directly or view it on GitHub\n> <https://github.com/hpc/give/commit/1cebd3b71725981c5568ec03adecaaf7273e28ca#commitcomment-9596039>\n> .\n>\n"}}