Re: Is getpass(3) really obsolete?
- From
- Theo de Raadt <deraadt@openbsd.org>
- Date
- Oct 29, 2021, 14:21 UTC
- Message-ID
- <73029.1635517278@cvs.openbsd.org>
- In-Reply-To
- <00e401d7cccf$ccde0d40$669a27c0$@nexbridge.com>
<rsbecker@nexbridge.com> wrote:
Show 19 quoted lines
> > > getpass() is obsolete in POSIX.2. However, some platforms still are on > POSIX.1, > > so replacing it instead of providing a configure detection/switch for it > might > > cause issues. > > > > > > The community finally had the balls to get rid of gets(3). > > > > getpass(3) shares the same flaw, that the buffer size isn't passed. > > This has been an issue in the past, and incorrectly led to > readpassphrase(3) > > > > readpassphrase(3) has a few too many features/extensions for my taste, but > at > > least it is harder to abuse. > > readpassphrase is not generally supported. This will break builds on many > platforms.
Of course moving forward takes a long time. If a better API is supplied then there is a choice in 10 years. If a better API is not supplied, then 10 years from now this conversation can get a reply.