(OLD) (ARCHIVED) Puppy Linux Discussion Forum

[8-bit]

I just had a thought and was wondering.
How many of us download a program and then just run it without checking the code.
Let us just say that a program is downloaded, not checked for content, and run.
Now, lets imagine that the new on-line-once contributor has evil intentions.
He includes in the code code to gain access to the computer or intercept commands to be used by his program.

What I am getting at here is the Windows type attitude of a new user of Puppy.
They read of a great program they want to try.
They download it and run it without ever checking it out.
It crashes Puppy or their present OS.
The blame then falls on Puppy.
Is this right?
NO!
But it is not the first post that said "Puppy broke my computer"
So....
Do you check the code of a program before you run it.
Do you even know how?

I am guilty of running programs without checking them out first.
I will admit it.
But it sure makes you think.
With Puppy, you have a chance to check that code.
Windows, fat chance!

[Flash]

I don't bother checking. I wouldn't know what to look for if I tried. I don't worry though, because I run Puppy from a multisession DVD in a computer without a hard disk drive. If I try something that borks Puppy, or that I suspect might have compromised it, I simply shut down without saving to the DVD. If I find that I nevertheless managed to save some malware, I can tell multisession Puppy to ignore the contaminated session when it boots.

[Pizzasgood]

[Lobster]

Where do we get these wonderful devils advocate programmers?

A low CPU, data collecting (perhaps key logger) trojan, morphing
etc would be great fun. Is the source code available?

Strangely you would not know if such a system
did not exist on your computer

FUD is the real trojan.

[Pizzasgood]

People who are afraid of FUD should probably stay away from topics like network security, espionage, and healthy eating.

Or perhaps they should become very close to those topics to get over their fear of FUD. That leaves UD, and if they spend time learning, they can eliminate most of the doubt too, leaving them with just Uncertainty, which is omnipresent and eternal. I think.

[Lobster]

Tronkel is one of the people who seems to compile most of the programs he uses.

At the moment I believe the biggest security problem is Flash
and its action script language.

Previously it was javascript.
I ain't going to turn either off.

I am going to download and use pets and sfs
Maybe that is the geek version of living dangerously?

[Pizzasgood]

The important thing is to know of the risks. You can still take them, just realize you are taking them. It makes a difference.

For example, take two people who always cross the street without looking. They both attempt to cross a particular street that has occasional traffic. The first person believes there is no traffic, and the second knows there is. Despite that neither looks, the first will be more likely to be struck down. The second guy will be more aware - even though he doesn't use his eyes, his ears can pick up the noise of an oncoming vehicle, and it can happen even if he isn't consciously listening for one. And his subconscious will be prepared for the possibility of needing to dodge a bus, so his reaction time will be better than the first person's.

[kirk]

[PaulBx1]

Also, any time you install programs, back up the pupsave first. That won't help with detection, but if you do detect a problem, your recovery is simple.

I have a mod to my /etc/rc.d/rc.shutdown file which makes pupsave backups automatic, so this is even easier than it normally would be.

I always thought it would be a good idea to generate and record a checksum of /initrd/pup_rw, and then to compare the current checksum with the one from the previous boot, giving a warning if they are different. But there might be enough written to the pupsave just in the ordinary course of events to make this unworkable. You'd have to exclude mail files and other similar things. I never got concerned enough to look into this.