On Tue, Jan 07, 2003 at 09:18:00AM +0000, Jez Hancock wrote:
[snip]
> It's annoying in that I see a lot of users running mysql with the -u and -p options:
>
> mysql -u user -p mypassword
>
> on the commandline, thinking that this info will not show up in ps listings when ps
> is run by other users. Ho hum...
Any program that asks for a password on the command line should have
the common decency to overwrite/obfuscate it, along the lines of,
case 'p':
passwd = optarg;
optarg = "********";
break;
So that it doesn't show up in any "ps" output.
Of course, there is still a window of vulnerability before the code is
executed, but any long-lived daemon has no excuse for not doing this.
--
Crist J. Clark | cjclark@alum.mit.edu
| cjclark@jhu.edu
http://people.freebsd.org/~cjc/ | cjc@freebsd.org
