slacker (s@lack.er) on 1/28/09 wrote:
>
>I understand your complaint.

You clearly don't.

I'll try one more time, but then I'm off this thread, it's
just not worth my time.

>I commented on the security issue, and the only conclusion
>I can draw from your continued focus on this topic is that
>you consider metadata to be dangerous, and it should never
>leave someone's computer without some warning popping-up
>which says, "please review metadata before sending."

No. You don't understand AT ALL.

It has nothing to do with "metadata". It is all about
any data.

If you move data around, you'd better be conscious about
it. If you're not, you're going to inevitably give people
information that you didn't mean to give.

Example of this: pdf files with areas "blacked out", done
by people who weren't conscious about what they were
really doing, because when you look at the file, it
looks like you can't read the data. Never mind that it is
there and you can just remove the black-out.

The same is true of extended attributes. Not because they
are metadata, but because they are hidden data that
people aren't aware of.

It's why you want to use it - you want your programs to hide
data in otherwise innocent and unrelated files, and I'm
telling you that you're an idiot. You clearly don't even
understand nor apparently even care about what the
implications are.

>This can only improve the security offered to the
>user, because it's possible to write a singular tool to
>wipe xattrs, but it's impossible to do the same for
>metadata embedded within all the different types of file
>headers.

Don't be silly. If the metadata is in the file itself,
the user will see it. It's about whether it is
something that is agreed upon by the file format or not.
It's not just hidden and unaware by the users of the file.

You also ignored all my other issues, as if my only
reason for telling you EA's were bad were security. I do
happen to be security-conscious - you don't want system
software writers not being very anal about leaking
information - but it's not like it was even remotely the
only argument, or even meant to be the strongest one (for
some people, security arguments are very strong, while
others simply don't care).

Linus