Hacker News new | past | comments | ask | show | jobs | submit login

I see a common anti-pattern in security researchers in that they can lose sight of the human beings who operate the software.

argv[0] should be used by any logging message that purports to report the program name, because argv[0] should be a string the human recognizes as something they invoked. Taking it away would break usability.

This does, of course, imply that the program name is non-constant untrusted data. Which means we shouldn't be making security software that depends on knowing that name.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: