Subject: Re: First Install
To: None <masami@fa2.so-net.or.jp>
From: Bill Studenmund <wrstuden@loki.stanford.edu>
List: port-mac68k
Date: 03/30/1997 14:01:35
> 
> On Sun, 30 Mar 1997 09:22:32 -0500 (EST),
> Albert Carter <SilverMoonTiger@wizzard.tiac.net> wrote:
> > I will give that a try but regardles to them being in the path if you go to
> > that directory actually go to /usr/X11R6/bin and type in startx it should
> > work.
> 
> Nope, if your path doesn't have '.' in it.

Exactly. And there's a security reason for not putting '.' in your path.
It provides a mechanism for certain security violations. If '.' is in
your path, especially in the from of your path, then you can unknowingly
run trojan horses when you want system utilities. Like if you download
a package which includes an "ls" command, and then type ls to see what
is in the directory, you've just run the trojan horse.

Also, set-uid root shell scripts which don't set the path right can fall
prey to that attack. That's why 1) we don't allow set-uid scripts, 2)
good scripts either set the path or use full path names, and 3) by
default, '.' isn't in your path.

That said, one of the first things I do is add '.' to my path when I do a
new install. :-)

Take care,

Bill