A detailed discussion of why putting .
(current directory) in the PATH
is a bad idea.
Lets say you're being attacked by an adversary on your machine.
He authors a malicious program, and puts it in a directory, hoping that you'll stumble on it eventually. To increase his chances, he names it something common like mv
.
If you have added .
to the beginning of your path, and happen to be in the right directory when you type mv onefile twofile
... then the local mv
(./mv
) gets run instead of the mv
command we're all used too! This happens because .
is in your path, and the local mv
will be found before the /usr/bin/mv
. Suddenly, your user account or the entire machine may be horribly compromised.
(note: mv might be one of the built-in commands, and immune to this. Not sure... but the principle is solid)
So, you learn the lesson, and now put .
at the end of your path, so that all "official" directories will be searched before the local directory.
But the attacker is now on to you! Instead of the program mv
, he creates in a program mc
, which is a common typo for mv
. Again, you intend to type mv onefile twofile
, but make a simple typo to mc
. Now all the "official" directories are searched, the program mc
is not found, and finally it is found in the local directory. Malicious code is run, and again you lose.
The lesson is that your PATH
should only cover known-good software, and since your current directory changes frequently, you never know exactly what software is there, and should never run it unless you're very explicit about it with the ./
prefix (eg. > ./IMeanToRunThis)