[RFC] Security and Features in KPDF

[Enrico Ros]

On Monday 03 January 2005 19:36, Ingo Klöcker wrote:
> On Monday 03 January 2005 02:44, Tobias Koenig wrote:
> > On Sun, Jan 02, 2005 at 06:55:19PM -0500, George Staikos wrote:
> > > On Sunday 02 January 2005 18:19, Tobias Koenig wrote:
> >
> > Hi,
> >
> > > > This is really a save solution. When the user still clicks on
> > > > 'Ok' and the virus/wurm is executed... well, that's the users
> > > > problem. But that's the same case as when the user clicks on an
> > > > unknown email attachment. Do we forbid email attachments for this
> > > > reason?
> > >
> > >    This is not always so safe, because not all users understand the
> > > implications of a 1 character difference between two command lines,
> > > one being safe, the other being devastating.
> >
> > And what's the different to a script that the user downloads from
> > www.coolnewgames.com and executes it because its name is install.sh?

> This is not comparable with your proposal which just requires clicking
> on a link and acknowledging a dialog.

Well, that's oversemplified. We all agree that the action might be dangerous. 
And in fact the dialog can be like this:

http://www.dei.unipd.it/~rosenric/temp/before.png

Notice 'cancel' focused. So the user has to read the advistoy; we have the 
disclaimer; he/she has to click on the checkbox and then:

http://www.dei.unipd.it/~rosenric/temp/after.png

When clicking ok he/she says that he 'trusts' pdf's source, understands the 
command and still wants to continue executing it.
Obviously policies can be defined and even an option to always execute code 
can be in place for most experienced user (like "I use kpdf to show others my 
pdf files only)."
And if this dialog isn't enought frightening for the average user we can even 
add witches and scarfaces to scary he/she ^_^
Jokes apart, I don't see any other reason that blocks the execution code now.

Ciao,
Enrico
--
 
 
 --
 Email.it, the professional e-mail, gratis per te: http://www.email.it/f
 
 Sponsor:
 La palestra in casa da Oliviero.it Trovi un' ampia gamma di tapis roulant, a partire da € 429,00! 
* 
 Clicca qui: http://adv.email.it/cgi-bin/foclick.cgi?mid(45&d=3-1