Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-21 Thread David Mandelberg
Adam Lydick wrote: > Fantastic idea! (as others have said) Have you filed a bug against > nautilus (and other shells) to this effect? You might also file one at > the various upstream bug tracking systems as well. I'm glad you like it (I do too), but it wasn't my idea. Search the ubuntu-devel list

Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-21 Thread Bill Marcum
On Tue, Jan 18, 2005 at 07:14:29PM -0800, Moe wrote: > After all these months/years of warnings to NEVER open email > attachments, why are you sendinf attachments instead of in-line? > > Martin Schulze wrote: > > > >Part 1 Type: C > > Encoding: 8bit > What mail client are

Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-19 Thread Sam Watkins
On Wed, Jan 19, 2005 at 06:52:17AM -0500, David Mandelberg wrote: > I'm just suggesting that it should be harder for them to shoot > themselves in the foot i.e. by making .desktop's have the x bit before > they can be launched. I strongly agree. No, I STRONGLY agree! If they are to be marked exe

Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-19 Thread s. keeling
Incoming from Florian Weimer: > * s. keeling: > > > People who don't use stupid Windows email clients have no trouble with > > attachments at all. Attachments are a very useful tool; for instance, > > for code listings, they arrive unmangled by line wrap. > > > > Get a better email client, runnin

Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-19 Thread Florian Weimer
* s. keeling: > People who don't use stupid Windows email clients have no trouble with > attachments at all. Attachments are a very useful tool; for instance, > for code listings, they arrive unmangled by line wrap. > > Get a better email client, running on a better OS. You mean the OS whose use

Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-19 Thread David Mandelberg
s. keeling wrote: > No, I assume people have half a brain in their heads, look at the > attachment type, maybe save it to a file and inspect it, then maybe > look at it or delete it. Too much work? Whether it's too much work or not, most non-geeks I know don't bother. > Okay, slap a lot of autoloa

Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-19 Thread Rick Moen
Quoting s. keeling ([EMAIL PROTECTED]): > The problem here is the nitwit factor. Yes, well, a bunch of us have been keeping an eye on Linux MUAs and default mailcap behaviour for 10+ years, to make sure zeal for simplicity doesn't lead coders or distro assemblers to do something dumb. Thus my qu

Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-18 Thread s. keeling
Incoming from Rick Moen: > Quoting s. keeling ([EMAIL PROTECTED]): > > > Well, even mutt will, if you turn on autoload crap in .muttrc and load > > up your .mailcap with stupid helper apps. > > > > Out of the box, no, mutt doesn't do that. > > Ja. We might call the .mailcap scenario the "aim-gu

Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-18 Thread s. keeling
Incoming from Denis O'Toole: > Can you please OT: this Hint: the "d" key will probably do this for you. Please stop interfering with discussions of insecure applications on debian-security. TVM. :-) -- Any technology distinguishable from magic is insufficiently advanced. (*)http://www.s

Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-18 Thread Rick Moen
Quoting s. keeling ([EMAIL PROTECTED]): > Well, even mutt will, if you turn on autoload crap in .muttrc and load > up your .mailcap with stupid helper apps. > > Out of the box, no, mutt doesn't do that. Ja. We might call the .mailcap scenario the "aim-gun-at-my-foot-please" mutt extension. Ma

Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-18 Thread s. keeling
Incoming from Rick Moen: > Quoting David Mandelberg ([EMAIL PROTECTED]): > > > Do you mean to say that opening "message.txt\t\t\t.desktop" which > > happens to be a freedesktop.org compliant launcher for the program "rm > > -rf $HOME" is safe because it's designed for people running one of the > >

Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-18 Thread s. keeling
Incoming from David Mandelberg: > s. keeling wrote: > > Incoming from Moe: > > > >>Martin Schulze wrote: > >> > >>> Part 1 Type: C > >>>Encoding: 8bit > >> > >>After all these months/years of warnings to NEVER open email > >>attachments, why are you sending attachments instead

Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-18 Thread Denis O'Toole
Can you please OT: this Regards Denis O'Toole Moe wrote: After all these months/years of warnings to NEVER open email attachments, why are you sendinf attachments instead of in-line? Martin Schulze wrote: Part 1 Type: C Encoding: 8bit -- To UNSUBSCRIBE, email to [E

Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-18 Thread Rick Moen
Quoting David Mandelberg ([EMAIL PROTECTED]): > Do you mean to say that opening "message.txt\t\t\t.desktop" which > happens to be a freedesktop.org compliant launcher for the program "rm > -rf $HOME" is safe because it's designed for people running one of the > F/OSS products GNOME or KDE on a F/O

Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-18 Thread David Mandelberg
s. keeling wrote: > Incoming from Moe: > >>Martin Schulze wrote: >> >>> Part 1 Type: C >>>Encoding: 8bit >> >>After all these months/years of warnings to NEVER open email >>attachments, why are you sending attachments instead of in-line? > > > People who don't use stupid Win

Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-18 Thread s. keeling
Incoming from Moe: > Martin Schulze wrote: > > > >Part 1 Type: C > > Encoding: 8bit > > After all these months/years of warnings to NEVER open email > attachments, why are you sending attachments instead of in-line? People who don't use stupid Windows email clients have no

Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-18 Thread Moe
After all these months/years of warnings to NEVER open email attachments, why are you sendinf attachments instead of in-line? Martin Schulze wrote: > >Part 1 Type: C > Encoding: 8bit -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble?

Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-18 Thread Willy Sjonfjell
test tir, 18,.01.2005 kl. 10.41 +0100, skrev Martin Schulze: plain text document-vedlegg -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Debian Security Advisory DSA 644-1 [EMAIL PROTECT

Re: [SECURITY] [DSA 644-1] New chbg packages fix arbitrary code execution

2005-01-18 Thread Sebastian Lövdahl
Martin Schulze wrote: This message was modified by F-Secure Anti-Virus E-Mail Scanning. This is what F-Secure gave me. Martin do you send viruses? ;) Sebastian -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]