Bug#3189: nvi over-cautious about .exrc?

[Ian Jackson <ian@chiark.chu.cam.ac.uk>]

Bruce Perens writes ("Bug#3189: nvi over-cautious about .exrc?"):
> I think that's prudent. It would be simple enough to stick a trojan
> horse in the .exrc .

I disagree, strongly.

It is not the business of programs to check the permissions of the
dotfiles in users' home directories.

Firstly, this means that they are deciding my security policy for me,
which is not appropriate.  (And, as we see, it is causing problems
because Debian's default security policy and architecture is not
compatible with its ideas.)

Secondly, it is futile.  For every program which does this check there
will be dozens which don't; if someone has the opportunity to attack
these files they'll just do it to one of the other ones.

Ian.