Language Selection

English French German Italian Portuguese Spanish

The Malware Problem (and a solution)

Filed under
Linux
Software
Security

So, there have been some discussions about possible solutions for this issue. Some have proposed that we add a review process to all of this, so that anything that gets uploaded gets a security check from some KDE developers. That's a neat idea on paper. But only there. This couldn't possibly work out, for two reasons: 1) Manpower - We simply don't have enough of that. 2) Responsibility - Who wants to be responsible for letting Malware slip through your fingers? This can happen to anyone, and it would be pretty embarrassing. I certainly wouldn't want to be responsible for anything.

Back when we designed the scripting system for Amarok 2 (QtScript, in-process), Ian Monroe and I realized that there isn't really any way to make it secure on a technical level. Sandboxing, automatic malware detection, flying cars - all this works somehow in theory, but in reality it requires some Bruce Schneier to do it, which we don't have (there is only only one Schneier, I guess). So basically we realized that the system would be unsafe, and that we would have to live with it. Amarok is very vulnerable to Malware scripts, because scripts can access most of Amarok, and Qt, and whatnot. Any Joe Schmoe could hack up a two-liner script that deletes your $HOME. So we accepted that reality, and tried to think of some other methods for making it all safer. What we came up with is this:

Rest here




More in Tux Machines

KTextEditorPreviewPlugin Reaches 0.1.0 and a Quick Look (Screenshots) at KDE Plasma 5.11

  • KTextEditorPreviewPlugin 0.1.0
    The KTextEditorPreviewPlugin software provides the KTextEditor Document Preview Plugin, a plugin for the editor Kate, the IDE KDevelop, or other software using the KTextEditor framework. The plugin enables a live preview of the currently edited text document in the final format. For the display it uses the KParts plugin which is currently selected as the preferred one for the MIME type of the document. If there is no matching KParts plugin, no preview is possible.
  • Quick Look at KDE Plasma 5.11
    KDE released Plasma 5.11 beta version at 14 September 2017. The new star feature here is Plasma Vault, an ability to protect your folder with password. You can try it on the latest KDE neon before the Plasma finally released next October. Here is a quick look to the new things on KDE Plasma on neon dev-unstable.

Antergos 17.9 Gnome - Ghost riders in the Tux

Antergos 17.9 is a weird distro, full of polarities. It comes with a weak live session, and it does not really demo what it can do. The installer is good, robust, and if offers some neat tricks, including extra software and proprietary graphics driver. I'm really impressed by that. The installed system behaved reasonably, but with some oddities. Hardware support isn't the best, most notably touchpad and what happened after waking from suspend. On the other hand, you get good smartphone and media support, a colorful and practical software selection, a moderately reasonable package manager with some tiny dependency hiccups, pretty looks, okay performance, and nowhere does it advertise its Archness. Much better than I expected, not as good as it should be. Well, taking everything into consideration, I guess it deserves something like 7.5/10. Antergos needs a livelier live session, more hardware love out of the box, and a handful of small tweaks around desktop usability. Shouldn't be too hard to nail. Worth watching. Read more

LibreELEC (Krypton) v8.1.2 BETA

This is the third beta for our 8.2 release. It addresses minor findings related to the Samba bump: we now detect and avoid invalid Samba v3 configurations, old samba.conf.sample templates are overwritten with the new v4 template, and remote SMB shares are mounted using SMB2 or where possible SMB3. The release also adds support for the Raspberry Pi IQAudIO Digi+ board and a Xiaomi BT remote, and includes security fixes for the Blueborne Linux/BlueZ vulnerability. This is hopefully the final 8.1.x beta release; next will be 8.2.0. Read more

Android Leftovers