security review and patches for libpurple

Ethan Blanton elb at pidgin.im
Thu Aug 11 12:04:11 EDT 2011


Ethan Blanton spake unto us the following wisdom:
> I have rejected the following patches for rejection, further review,
> and/or correction:

Missed one:

* bonjour-geteuid.diff

  I think this is just wrong.  It looks to me like we *want* euid, not
  uid.  I can't think of any reason to setuid Pidgin in the first
  place, but if we do, it seems like the euid is probably who you want
  to be running Pidgin.  I don't know.  It's not clear to me how this
  should be changed either way.

Ethan


More information about the security mailing list