| | <<<Back 1 day (to 2018/01/25) | 20180126 |
| enometh | -dREALLYDELAYEDBIND still makes pstotext barf with Error: /undefined in NOBIND | 05:34.05 |
| | DELAY*BIND | 05:35.03 |
| | this worked with 9.18 | 05:40.31 |
| | why is kensharp on this mission from hell to remove delaybind and nobind | 05:53.00 |
| | at least doc/History9.htm gives a commit 0a41e707 that I can try torevert | 05:54.42 |
| | fwiw i reverted both patches | 06:00.41 |
| | where do you get the Halftone or the openwin/* truetype resources that gs looks for | 06:01.15 |
| kens | enometh (for the logs) because those options are a *massive* security hole. They were removed as part of a much, much wider removal of non-standard PostScript oeprators. Why ? Because of all the security reports we kept getting which were centered on those operators and features. | 07:57.41 |
| | And in any event, DELAYBIND has been re-instated. Also as far as I know, REALLYDELAYBIND works perfectly well, its the identical code from DELAYBIND with the name changed. | 07:58.16 |
| | Resources \re all stored in ghostpdl/Resource/Init | 07:58.45 |
| | There's no such thing as an openwin resoruce, or a TrueType resource | 07:59.04 |
| enometh | sigh ghostscript was a stable project earlier | 10:21.55 |
| kens | It still is | 10:22.05 |
| | As the message said. if you have a reason for using teh deprecated features, then talk to us | 10:22.28 |
| | And before you say it, we've tried asking for feedback before removing stuff. Nobody responds | 10:22.49 |
| enometh | no now its something else | 10:23.03 |
| kens | Well like I said, we removed *lots* of non-standard stuff, because we were getting security reports, and it was (perhaps surpsisingly) being exploited in the wild | 10:23.36 |
| | So again, if you have a problem, talk to us | 10:23.48 |
| | Sitting carping doesn't actually help anyone | 10:24.01 |
| enometh | i'm trying to find this one, before reverting.. | 10:24.26 |
| kens | You could always just use an old release if its that big a problem to you. I believe a lto of distros are still shipping versions of Ghostscript which are anything up to 10 years old. | 10:25.37 |
| enometh | kens, i don't buy the security narrative | 10:25.48 |
| | thats just what i meant when i said "used to be stable". stable deve. | 10:26.04 |
| | now its just like any other manipulated project | 10:26.15 |
| kens | You may not buyt it, but if you look through our bug reports you'll find plenty of security problems. | 10:26.29 |
| | And also one that blew up on us badly last year | 10:26.40 |
| enometh | there is no fix for those | 10:26.44 |
| kens | Umm, there is | 10:26.54 |
| | We fixed all of them | 10:26.59 |
| enometh | removing functionality is not a fix | 10:27.04 |
| kens | Sure it is | 10:27.14 |
| enometh | back to my point | 10:27.21 |
| kens | That doesn't make it not stabl;e. | 10:27.31 |
| enometh | this used to be a stable project before it got taken over | 10:27.41 |
| kens | If you want stable you can use an old version | 10:27.41 |
| | LOL taken over ? ROFLMAO | 10:27.52 |
| enometh | by the security ratrace bottomfeeders | 10:27.57 |
| kens | Thye have nothing to do with what we choose to implement | 10:28.16 |
| | Non-standard PostScript5 extensions are not part of the language, so removing them should nto be a problem. | 10:28.35 |
| enometh | one sec let me try to find this other issue | 10:28.39 |
| kens | And as I (keep) saying, if people have a genuine need for them then we will reconsider | 10:28.52 |
| | But since (as I also said) tehre's no way to find out if people are using vulnerable non-standard stuff without removing it.... | 10:29.20 |
| enometh | sorry kens, that argument is defective | 10:29.54 |
| kens | Well we will have to agree to disagree then | 10:30.04 |
| enometh | it covers a defect in the developer | 10:30.14 |
| kens | Oh personal epithers now ? | 10:30.22 |
| enometh | hmm this seems to be a `a4' beginpapersize | 10:40.37 |
| kens | beginpapersize isn't standard PostScript. Its also not (afaik) ever been a Ghostscript extension | 10:41.21 |
| | So presumably its a procedure defined in your PostScript program | 10:41.47 |
| | a4 is still defined in statusdict, that has not changed | 10:42.15 |
| enometh | i still dont know what the problem is, but for this file, my use-case problem goes away if i remove a4 from the TexDict of the ps file. these some ps are decades old | 10:43.23 |
| kens | Can't really comment without seeing teh program | 10:43.48 |
| | But that's (obviously) going to override the Ghostscript definition. | 10:44.11 |
| | Presumably something in the TexDict procedure is doign something which causes a problem | 10:44.32 |
| enometh | I can't figure this out from the release. let me see if i can get a git clone | 11:11.34 |
| kens | You could simply put the PostScript program somewhere public and let us look at it | 11:11.54 |
| enometh | oh i'm just trying to use pstotext, it breaks on many ps programs | 11:12.26 |
| | you mean the program generated by pstotext | 11:12.49 |
| kens | Also, of course, if you clone the current code, it won't match the release, becasue that's about 5 months old | 11:12.51 |
| | I mean the PostScript program you are feeding to Ghostscript | 11:13.01 |
| enometh | it breaks on most of them.. | 11:13.26 |
| kens | Note that Ghostscript can extract text from PostScript and PDF input using the txtwrite device. | 11:13.27 |
| | that doesn't really help | 11:13.35 |
| | I need something I can look at, ideally something small | 11:13.48 |
| enometh | yeah. i tried cloning ghostpdl from github but that didnt do anything | 11:13.53 |
| | from where i got the release.. | 11:14.14 |
| kens | Should work, but I'm no expert with Github | 11:14.17 |
| | You'd be better using our repository | 11:14.25 |
| enometh | this is a wrong url isnt it git clone git://github.com/ArtifexSoftware/ghostpdl | 11:14.57 |
| kens | I can''t really tell, I don't use Github | 11:15.15 |
| | Git hub is supposed to be a mirror of our git repository, which is why I say you;d be better using ours | 11:15.38 |
| enometh | i can give you a quick test case if i can do git log -G.. | 11:15.40 |
| | but i'm running out of time. it may have to wait till sunday | 11:15.58 |
| kens | Well, I won't be working Sunday.... | 11:16.09 |
| | But I can read the logs on Monday | 11:16.15 |
| enometh | i'm quite slow. let me try getting this compiled on a guest box.. | 11:17.57 |
| kens | Good grief Github has 279 hits for Ghostscript | 11:18.28 |
| enometh | i got it from git.ghostscript.com.. | 11:18.51 |
| kens | Oh well that's not Github, that's us | 11:19.02 |
| enometh | note the first githun url i mentioned gives a sparse repo or something | 11:19.27 |
| | or maybe it uses submodules | 11:19.35 |
| kens | No we don't use submodules | 11:19.42 |
| enometh | now i already have the distro gs on this machine. if i want to be able to bisect from the source tree, should i configure --prefix=/tmp/gs-root/usr, install there and call the binary from there? | 11:22.01 |
| | or is there a better method | 11:22.15 |
| kens | I'm not sure what configure has to do with bisecting | 11:22.28 |
| enometh | i'm assuming before bisecting you have to install it | 11:22.49 |
| kens | Personally when bisecting I just build and use the local binary, I don't install it | 11:22.51 |
| enometh | it wont pick up the systemwide files? | 11:23.03 |
| | if i use a local binary? | 11:23.17 |
| kens | Which system wide files did you mean ? | 11:23.19 |
| enometh | the .ps files it installs | 11:23.27 |
| kens | The default build puts everything into the binary | 11:23.32 |
| enometh | oh yeah | 11:23.39 |
| kens | In a ROM file system | 11:23.41 |
| enometh | when i was tracing this i thought i saw it was picking up stuff from /usr/share/ghostscript/9.22/lib/ | 11:24.34 |
| kens | The release may well do so | 11:24.48 |
| enometh | will the local try to do it too? | 11:25.05 |
| | hopefully not. ok | 11:25.08 |
| kens | Distros often change the build so that it doesn't use a ROM file system. THey also use shared libraries for things like FreeType, OpenJPEG etc | 11:25.15 |
| enometh | ok thx | 11:25.32 |
| kens | Our default build puts everything in the ROM file system | 11:25.36 |
| enometh | let me get to the point of reproducing the failure.. | 11:25.52 |
| kens | So as long as you don't use -I to include other search paths, nothing should be external | 11:25.54 |
| enometh | sigh pstotext hardcodes /usr/bin/gs | 11:38.43 |
| | and i cant revert those patches with head without conflicts | 11:43.20 |
| kens | As I said, you could just let us look at the PostScript program | 11:48.13 |
| enometh | well for examplehttp://www.linux-usb.org/USB-guide/USB-guide.ps | 12:10.29 |
| | after reverting 0a41e707c and 8f796773 | 12:11.10 |
| | i'm trying to see where pdftotext -debug chokes on it | 12:11.41 |
| kens | File runs perfectly well as far as I can see. | 12:11.52 |
| | When sent to Ghostscript | 12:12.05 |
| enometh | the failing program is pstotext | 12:12.16 |
| kens | Then I need to see what pstotext is sending. | 12:12.31 |
| | And teh command line its using | 12:12.50 |
| | Oh I see pstotext is 'no longer maintained' | 12:13.20 |
| | I'd suggest using txtwrite instead then, at least that's maintained | 12:13.32 |
| | Anyway, lunchtime | 12:13.58 |
| enometh | now calling ./pstotext -debughttp://www.linux-usb.org/USB-guide/USB-guide.ps doesnt even startup gs | 12:18.32 |
| | gs bails with Unrecoverable error: undefined in git. apparently the reverts didnt work like they did with my release build | 12:19.01 |
| | pstotext is available from http://us.archive.ubuntu.com/ubuntu/pool/universe/p/pstotext/pstotext_1.9.orig.tar.gz for example | 12:19.42 |
| | i'm also out of time. maybe on monday | 12:19.50 |
| | until then i'm going back to ghostscript-x11-9.00 | 12:20.14 |
| | which was working great! | 12:20.18 |
| | so it gets called like: | 16:54.09 |
| | gs -r72 -dNODISPLAY -dFIXEDMEDIA -dDELAYBIND -dWRITESYSTEMDICT -dNOPAUSE -dSAFER ocr.ps -- <psfile> | 16:55.30 |
| | ocr.ps is in that tarball i pointed above | 16:55.47 |
| kens | yeah, not re-instting WRITESYSTEMDICT | 16:56.15 |
| | and that's your problem | 16:56.25 |
| enometh | i read the warning message i didnt follow it | 16:56.37 |
| | let me try again | 16:56.54 |
| | kens i dont understand what you meant | 16:59.50 |
| kens | the code won't work without WRITESYSTEMDICT | 17:00.23 |
| enometh | apparently it wont.. | 17:01.53 |
| | Error: /undefined in --setpagedevice-- | 17:04.22 |
| | when it encouters some systemdict. I still dont understand whats expected and whats not happening | 17:04.46 |
| | what do uou mean "not re-instting" ? | 17:05.21 |
| kens | The code wants to write to systemdict, which is not legal | 17:05.34 |
| | I mean we will not re-instate the flag | 17:05.52 |
| enometh | what> | 17:06.00 |
| kens | Its a massive security nightmare | 17:06.03 |
| | WRITESYSTEMDICT | 17:06.22 |
| enometh | how do i revert it in my local copy | 17:06.23 |
| kens | no idea | 17:06.33 |
| enometh | the warning says it works | 17:06.34 |
| | how did you remove it? | 17:06.39 |
| | which commit | 17:06.44 |
| kens | don't remember, not really interested | 17:07.00 |
| enometh | ghostscript prints out: *** WARNING - you have selected SAFER, indicating you want Ghostscript to execute in a safer environment, but at the same time have selected DELAYBIND. Unless you use this option with care (and specifically, remember to call .bindnow) it is possible that malicious code may be able to evade the limited security offered by the SAFER option. | 17:07.11 |
| | and youre saying there is no flag?> | 17:07.19 |
| kens | No | 17:07.37 |
| | I'm talking about WRITESYTEMDICT | 17:07.54 |
| | I never mentioned SAFER | 17:08.04 |
| enometh | sigh. it also prints out: | 17:08.49 |
| | *** WARNING - you have selected SAFER, indicating you want Ghostscript to execute in a safer environment, but at the same time have selected WRITESYSTEMDICT. Unless you use this option with care and specifically, remember to execute code like: "systemdict readonly pop" it is possible that malicious code may be able to evade the limited security offered by the SAFER option. | 17:08.58 |
| kens | oddly I thought it wasn't removed | 17:09.14 |
| enometh | what are you saying | 17:09.24 |
| | and if you see ocr.ps it does have a systemdict readonly pop | 17:09.30 |
| kens | and in fact its still present, must be something else | 17:09.35 |
| | Frankly, I don't really care. Its an unsupported tool relying on dangerous non-stabdard extensions. | 17:10.26 |
| enometh | sigh | 17:10.28 |
| | yeah you shouldnt have removed ps2ascii either. your comments indicate you dont know the use cases, and you dont know how to provide it back | 17:10.36 |
| kens | and there exists a doumented, safe way to achieve text output | 17:10.46 |
| enometh | it is inadequate and buggy | 17:10.58 |
| | you are aware of the inadequacies | 17:11.06 |
| kens | then report bugs | 17:11.07 |
| enometh | so you can answer your customers like this? | 17:11.24 |
| kens | you are not a customer | 17:11.40 |
| enometh | there wont be a reason if you handt removed the functionality in the first place | 17:11.45 |
| | hey now you have customers. thats what i call a racket | 17:11.58 |
| kens | or if you are you have not identified yourself as such | 17:12.06 |
| | we've always had customers that's what pays for your free loading | 17:12.28 |
| chrisl | enometh: if you continue to be rude or abusive, you'll not be welcome on this channel going forwards | 17:13.20 |
| enometh | its a shame for open source really that someone pays developers to put in bugs tto create issues with a security narrative , which they have no clue about | 17:13.21 |
| kens | kick #ghostscript enometh | 17:13.25 |
| | Forward 1 day (to 2018/01/27)>>> | |
Log of #ghostscript at irc.freenode.net.