Re: Email based attack on University
On Fri 04 Oct 2019 at 10:49:49 +0200, tomas@tuxteam.de wrote:
> On Thu, Oct 03, 2019 at 08:54:10PM +0100, Brian wrote:
>
> [...]
>
> > Opening an email causes no problem to the system on Debian. We would be
> > in deep trouble if it did. Does that address your concern?
>
> Woah. A sweeping assertion which would start making sense if you
> tried to explain what "opening an email" means to you. Next step
> would be to fix "no problem to the system" (does the disappearance
> of all user files count?) and the step after that would be "on
> Debian" (which MUA? Desktop environment, or just X cum WM or
> console? Which set of installed programs? Is user in sudoers? Are
> the last Spectre patches in? And so on).
>
> Yes, "our" security story is way better than theirs, and this is
> partly based on technical reasons, partly on social reasons and
> partly on practical reasons. But feeling smug about it is a
> vulnerability in itself :-)
A single reliable, well-documented and repeatable example of a problem
caused by pressing enter or clicking on a mail would go a long way to
wipe the smile of my face. User files are not necessary for the health
of the system.
--
Brian.
Reply to: