Re^4: Answer: How do I find the type of an image?

I don't know what you are trying to accomplish with this kind of answers

Your previous replay was:

that is not true..... .htm, .html, .jpg,. gif,.bmp,.png,...etc..extensions...etc....are all very important in the linux file system

And now you are saying that extensions are not important, and what's important is the file permission (The same idea I have explained in my replay just right before yours)

...sure it does..... but that is because the Ubuntu Desktop handles it all for you..... as a matter of fact, your only problem may be that you have a destop setting set to hide file extensions, like they do on Winblows

As I wrote those images uses no extensions I have deleted the extensions myself, so I am not confused with anything as you think.

And finally I have no problem with anything as you thought, I am just providing a code that might benefit someone else.

As *some* people uses file extension to determine the file type which I do not consider as a good practice.

About the permission thing: Just because you *think* your files are safe it does not mean it is, consider a web server (Apache for example) that is running scripts without suexec enabled , everybody on that server will have to grant group permission to the web server in order to let it execute those scripts.

That's just one of many examples, just keep in mind that we're humans and we're prone to mistakes & you should always expect the worst thing to happen.

Finally, by adding few more checking to your code ... You are not only protecting yourself from being cracked, You are protecting other users on the shared environment you are working on. And possibly the entire server from being rooted.

Finally I am not here to discuss Linux configurations & security issues. And I will skip answering any more replays to this node.

BTW, Thanks for the MIME types url you posted as again you proved my point, take a look yourself

Comment on Re^4: Answer: How do I find the type of an image?

Replies are listed 'Best First'.
Re^5: Answer: How do I find the type of an image? by zentara (Cardinal) on Dec 29, 2009 at 17:38 UTC
*And I will skip answering any more replays to this node.* ...thats ok,... i will just finish by saying on a properly configured linux system, it's not a problem..... all that will happen is that errors will be thrown if someone tries a file masquerade. Every linux distro i've seen, always puts files into your filesystem with a 0644 permission, and you need to chmod it to get it to even get it attempted to be executed by the kernel And if someone tries to slip a malicious binary into a file named as an image, only errors will be thrown when your Desktop(or whatever) tries to open it.....you will get "wrong header or not a correct filetype" errors Of course, that does not prevent people from shooting themselves in the foot..... anyone can get a malicious file , chmod it +e, and execute it..... thats why they train people to use computers, to avoid those obvious errors ..... the only protection from those idiots is to give them their own sandbox... called a home directory. And always compile your own from source code.... don't trust RPM's or canned pre-compiled code, unless you have no choice I'm not really a human, but I play one on earth. Old Perl Programmer Haiku	[reply]

Replies are listed 'Best First'.

Re^5: Answer: How do I find the type of an image?
by zentara (Cardinal) on Dec 29, 2009 at 17:38 UTC

And I will skip answering any more replays to this node.

...thats ok,... i will just finish by saying on a properly configured linux system, it's not a problem..... all that will happen is that errors will be thrown if someone tries a file masquerade.

Every linux distro i've seen, always puts files into your filesystem with a 0644 permission, and you need to chmod it to get it to even get it attempted to be executed by the kernel

And if someone tries to slip a malicious binary into a file named as an image, only errors will be thrown when your Desktop(or whatever) tries to open it.....you will get "wrong header or not a correct filetype" errors

Of course, that does not prevent people from shooting themselves in the foot..... anyone can get a malicious file , chmod it +e, and execute it..... thats why they train people to use computers, to avoid those obvious errors ..... the only protection from those idiots is to give them their own sandbox... called a home directory.

And always compile your own from source code.... don't trust RPM's or canned pre-compiled code, unless you have no choice

I'm not really a human, but I play one on earth.
Old Perl Programmer Haiku

[reply]