The Malware Problem (and a solution)

" So, there have been some discussions about possible solutions for this issue. Some have proposed that we add a review process to all of this, so that anything that gets uploaded gets a security check from some KDE developers. That's a neat idea on paper. But only there. This couldn't possibly work out, for two reasons: 1) Manpower - We simply don't have enough of that. 2) Responsibility - Who wants to be responsible for letting Malware slip through your fingers? This can happen to anyone, and it would be pretty embarrassing. I certainly wouldn't want to be responsible for anything.

"Back when we designed the scripting system for Amarok 2 (QtScript, in-process), Ian Monroe and I realized that there isn't really any way to make it secure on a technical level. Sandboxing, automatic malware detection, flying cars - all this works somehow in theory, but in reality it requires some Bruce Schneier to do it, which we don't have (there is only only one Schneier, I guess). So basically we realized that the system would be unsafe, and that we would have to live with it. Amarok is very vulnerable to Malware scripts, because scripts can access most of Amarok, and Qt, and whatnot. Any Joe Schmoe could hack up a two-liner script that deletes your $HOME. So we accepted that reality, and tried to think of some other methods for making it all safer. What we came up with is this:"

Complete Story

Related Stories:

• GNOME 3: The Future of the Linux Desktop Revealed(Dec 10, 2009)
• Carelessness busts Linux security (Malware in GNOME screensaver)(Dec 09, 2009)
• Create a Custom Transitioning Background for Your Gnome 2.28 Desktop(Dec 04, 2009)
• Review: Gnome Shell(Dec 01, 2009)
• Amarok 2.2.1(Nov 20, 2009)
• Amarok 2.2.0: Back on Track(Oct 23, 2009)