One new object in Pd, one giant leap for Pd programmers!
What a great addition. Many thanks! Roman
- Roman Haefeli reduzent@gmail.com [2021-08-23 10:41]:
One new object in Pd, one giant leap for Pd programmers!
Thanks Roman! I can't seem to find this in 0.51.4 is it that new? Much looking forward!
On Mon, 2021-08-23 at 11:10 +0200, Peter P. wrote:
- Roman Haefeli reduzent@gmail.com [2021-08-23 10:41]:
One new object in Pd, one giant leap for Pd programmers!
Thanks Roman! I can't seem to find this in 0.51.4 is it that new? Much looking forward!
It will be part of next 0.52 release and is already implemented in current git master branch.
Sorry, I got too excited, but realize now that it might not be wise to post such things on Pd users list.
Roman
On 8/23/21 12:26 PM, Matt Davey wrote:
oh come on....spill the beans...what does it do?
https://github.com/pure-data/pure-data/pull/1351
gfmdasr IOhannes
wow, because everything is a file (in unix), the sky's the limit!
cheers to that.
ub
On 23.08.21 14:59, IOhannes m zmoelnig wrote:
On 8/23/21 12:26 PM, Matt Davey wrote:
oh come on....spill the beans...what does it do?
https://github.com/pure-data/pure-data/pull/1351
gfmdasr IOhannes
Pd-list@lists.iem.at mailing list UNSUBSCRIBE and account-management -> https://lists.puredata.info/listinfo/pd-list
Looks great!
Has this any security implications? Could this be used to attack other computers?
best wishes
Am 23.08.21 um 14:59 schrieb IOhannes m zmoelnig:
On 8/23/21 12:26 PM, Matt Davey wrote:
oh come on....spill the beans...what does it do?
https://github.com/pure-data/pure-data/pull/1351
gfmdasr IOhannes
Pd-list@lists.iem.at mailing list UNSUBSCRIBE and account-management -> https://lists.puredata.info/listinfo/pd-list
On 8/31/21 12:38 PM, Ingo Stock wrote:
Looks great!
Has this any security implications?
sure. if the user is allowed to overwrite "C:\Windows\system32\rundll32.exe" they could inject malicious code. or delete that file.
however, if they are allowed to overwrite that file, they can already replace it with the contents of a WAV-file to bork the system.
so I don't think there are additional security implications¹.
Could this be used to attack other computers?
*other* computers? no, not really. it provides an interface to your filesystem. unless your filesystem lives on other computers, i don't see how you could impact them.
gfmasdr IOhannes
¹ i wonder whether it would be possible (with Pd>=0.42) to create a patch that creates a gui-plugin on the fly. if this is true, then you can already do everything that [file] allows you to do - and much more.
gfmadsr IOhannes
On 8/31/21 1:05 PM, IOhannes m zmoelnig wrote:
¹ i wonder whether it would be possible (with Pd>=0.42) to create a patch that creates a gui-plugin on the fly. if this is true, then you can already do everything that [file] allows you to do - and much more.
like with the attached patch.
i've tested this on Linux, macOS and Windows (where i have an msys installation and some folders that might make the exploit work - but which might not be present on your machine).
running the patch will add a few search-paths to your preferences and probably modify your MIDI-settings. apart from that, it shouldn't do any harm (though i wouldn't recommend to run it if you have a show tonight). use at your own risk.
gmasdr IOhannes
Has this any security implications?
It's certainly not worse than [pdcontrol] whose "browse" method basically allows to run arbitrary executables. A Pd project could contain a malicious binary (disguised as a WAV file) which is automatically run when you open the main patch - without you ever noticing.
Generally, every single external is a potential security risk since it contains arbitrary code. Maybe [zexy] contains a backdoor for the NSA, who knows?
Christof
On 31.08.2021 13:05, IOhannes m zmoelnig wrote:
On 8/31/21 12:38 PM, Ingo Stock wrote:
Looks great!
Has this any security implications?
sure. if the user is allowed to overwrite "C:\Windows\system32\rundll32.exe" they could inject malicious code. or delete that file.
however, if they are allowed to overwrite that file, they can already replace it with the contents of a WAV-file to bork the system.
so I don't think there are additional security implications¹.
Could this be used to attack other computers?
*other* computers? no, not really. it provides an interface to your filesystem. unless your filesystem lives on other computers, i don't see how you could impact them.
gfmasdr IOhannes
¹ i wonder whether it would be possible (with Pd>=0.42) to create a patch that creates a gui-plugin on the fly. if this is true, then you can already do everything that [file] allows you to do - and much more.
gfmadsr IOhannes
Pd-list@lists.iem.at mailing list UNSUBSCRIBE and account-management -> https://lists.puredata.info/listinfo/pd-list
On 8/31/21 3:50 PM, Christof Ressi wrote:
Has this any security implications?
Generally, every single external is a potential security risk since it contains arbitrary code.
what i forgot to say: even with my proof-of-concept exploit (regardless of whether it actually works), i don't think there is anything inherently wrong with that. if we consider Pd as a programming language, then it should be possible to write all kinds of code. e.g. you could write a Pd-patch that cleverly uses beta- and zeta-waves to hypnotize people and make them give you all their money - no filesystem access involved. or just play some very loud sounds, right after you completed your ENT degree.
having said that, the idea of a "sandboxed" Pd might be interesting.
Maybe [zexy] contains a backdoor for the NSA, who knows?
i do.
gfamsdr IOhannes
Maybe [zexy] contains a backdoor for the NSA, who knows?
i do.
well...?
-
Christof Ressi -
Ingo Stock -
IOhannes m zmoelnig -
Jaime Oliver -
Matt Davey -
Peter P. -
Roman Haefeli -
ub