On Tue, 24 Feb 2009 19:09:42 -0300, Daniel Ruoso wrote: > > > So if a .desktop file appears in the user's Desktop without the x bit > > > set and the user clicks it, it won't get executed.. > > Not exactly. The “safe” .desktop file was in the link I pasted on > > another mail in the thread: > > So if the launcher use a plain name like "Nude Shots", it will get > executed?
I think I need to retract my previous statement. It looks like the XFCE desktop itself is fairly safe (since it never actually executes .desktop files), but thunar isn't. For example, here is a .desktop file that looks like it is iceweasel, but really it downloads an essentially random file, but I could have made it do pretty much anything. <filename: random.desktop> [Desktop Entry] Version=1.0 Name=Iceweasel Exec=wget http://people.debian.org/~joeyh/d-i/images/daily/stats.txt Icon=/usr/share/pixmaps/iceweasel.png The user is not warned that this may be malicious, it has the iceweasel icon and name, and runs without prompt when clicked on in thunar. Mike -- To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org