J8 RUSITH?
So it seems that Apple installs /bin/ps setuid root. (Scare #1).
It seems also that the last bits emitted by a ‘strings /bin/ps’ is
J8 RUSITH?
. I have no idea what that is or what it means, but I think it belongs on a tshirt.
(Thanks to Dave and Ted for validating those for me. I thought I was 0wned.)
http://www.opensource.apple.com/darwinsource/10.3.5/adv_cmds-63/ps.tproj/tasks.c
Further research indicates it’s been in the source code since at least 12/2000. I can’t find older code than that. If someone has access to the openstep source code, it would be interesting to see how far back it goes…
-M