Yet another "GPG bug" that isn't *really* a GPG bug... The app let's you specify a status fd and people pass in "2" and mix it up with stderr? Does *anyone* downstream in the PGP ecosystem understand basic security hygiene? https://neopg.io/blog/gpg-signature-spoof/#proof-of-concept-ii-signature-and-encryption-spoof-enigmail …
Yes, and the spoofing for human consumption *is* a bug in gpg (they should not be allowing arbitrary terminal control characters printed as filenames).
-
-
I was talking about the machine-parsable output confusion issue with --status-fd 2. Other binaries don't care about control characters; the bug there is calling apps mixing two data streams together. There's no reason why any garbage spat out on stderr should ever be parsed.
-
yeah, I know... the status fd's data is completely invalid the moment anything else can write to it. Not sure if it was done this way because of laziness or naivety...
End of conversation
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.
urgh... This is also horrific... my terminal is not (ever?) white... perhaps GPG should encode newlines in the output, or ban "filenames" with `\ngpg:` in them.