Originally Posted by seaker79
- How can a denial-of-service attack be carried out if a directory name is known?
- Why is it important to use mktemp to generate a sufficiently random file/directory name for temporary files?
As I understand it, this is a matter of an attacker being able to guess the filename (or directory name) you wish to create and thereby block it by creating it first. I am sure you can come up with complicated scenarios about how this might happen and whether (under what circumstances) it is a problem. But mktemp
is trying to bypass all of that by making it extremely unlikely that an attacker could guess the name. There are probably circumstances where this is relatively unimportant while there are other circumstances where it wold be crucial. But with such a tool as mktemp
available, why would you want to not use it?