On Sunday 17 June 2007 22:58, Anant Narayanan wrote: > Siddhesh Poyarekar wrote: > > For self-loading USB: You plug in the device and you get a > > message "Please enter your root password so that I can install > > the drivers for this device". That device could be your new MP3 > > player or your camera. Then again it could also be your friends > > USB memory stick that may have dirtied itself somewhere and is > > actually asking you for root password to get its dirt on you > > rather than just the driver. You will not know the difference. > > The problem can be eliminated by storing the drivers on ROM. Now, > if you trust the manufacturer of the device, you can trust the > drivers - the same scenario as divers on a CD.
It is not the storage medium but the ability to autoload which is the problem. The other risks noted in this thread are common to all os's and / or the medium used for delivering content with a device driver being a specially dangerous case. Trusting anyone without an open review process is a strict no no. Further the act of verification has to be manual because an automated process has exactly the same set of vulnerabilities that the verification is trying to mitigate. Which defeats the purpose of automated driver loading. Complex methods have evolved for such verification certs being one such. -- Rgds JTD -- http://mm.glug-bom.org/mailman/listinfo/linuxers
