Subject: Re: X Server and -current
To: None <uunet!aggregate.com!rhealey@uunet.uu.net>
From: Roland McGrath <roland@frob.com>
List: current-users
Date: 06/23/1994 12:41:56
This idea that miscellaneous library functions should print arbitrary
garbage to stderr has really gotten out of hand.

It is just plain stupid that pppd prints "pppd: warning: this program
uses setreuid(), which is deprecated." twice every time you run it.  

There are two problems here.  Clearly pppd should be changed to use
setuid instead of setreuid.  That is trivial.  I really doubt it would
be any easier for someone to merge patches I sent than to simply do
the fix themselves.

But the more serious problem is in the mind of the person who wrote
this code in setreuid.  This is completely bogus!!  It is bogus in the
case of gets too, but I have given up on that; this case is different.
gets is always dangerous and should never be used; so fine, add code
that shoots the author of any program that uses it.  But setreuid
works fine!  It is just deprecated, not dangerous!  It is severely,
deeply, horrendously obnoxious for the library function to print to
stderr!

Millions of 4.3 BSD compatible programs will continue to work just
fine on netbsd, except their stderr will be cluttered with this
useless cruft.

As I have noted before, ld provides a convenient feature to generate
link-time warnings.  This is the appropriate thing to use for
setreuid.  Fine, a user should be warned if he runs a program that
uses gets; it could be used in obscure ways to compromise his
security.  But people using a program that is completely correct,
simply a few years out of date, should not be so abused!

I will gleefully send patches to fix this egregious bug, if I have any
hope that they will be used.  

------------------------------------------------------------------------------