[Date Prev] [Date Next] [Thread Prev] [Thread Next] Date Index Thread Index Search archive:
Date:Sat, 28 Feb 2004 10:21:13 GMT 
Subject:Re: 15.53 - Windows Installer Available 
From:Jonathan L Cunningham 
Volume-ID: 

On Fri, 27 Feb 2004 21:11:13 +0000 (UTC), bfulg@pacbell.net wrote:

>--- Jeff Best <jeffb@jtbest.demon.co.uk> wrote:
>> My biggest concern is the release of an 
>> executable to install a program. I don't know if
>> other people worry about the opacity (and hence, 
>> risk) of running programs to install things as
>> much as I do.
>
>I don't worry about it overly much, especially on
>"open source" projects where I can see the sources and
>the rules going into a build.

I don't like it, but it is so common on Windows platforms that
nowadays I just shrug, check I downloaded it from a URL that looks
genuine, and go ahead.

If I'm installing something important (on Linux) and I've downloaded
it from a mirror site, I'll check the checksum is what it says it
ought to be on the main site (using the appropriate, md5?, tool).

But if you are installing something very well known, it's different
from installing something with a (currently) much smaller user base
(like Poplog)-- but as Brent said, the Poplog sources are available.

Q: How many Trojans are in the Poplog sources? ;-)

 [ I've worked on at least one project, elsewhere, where one of the
  programmers kept trying to insert "Easter eggs" into the code - we
  wouldn't let him - so although I don't believe there is anything
  like that in Poplog, how would we know? ]

More importantly, as Steve Leach has pointed out in the past, there
are mechanisms in Ved which are (a) not used, (b) pose a high
security risk (see embedded text actions in REF VEDPROCS). I believe
these need to be sandboxed or replaced by a safer mechanism in
the next version of Poplog.

Jonathan

-- 
    Use jlc at address, not spam.