Re: Wine Security Disclosure

2008-03-16 Thread James McKenzie
Lei Zhang wrote: > On Sun, Mar 16, 2008 at 7:01 AM, Dan Kegel <[EMAIL PROTECTED]> wrote: > >> 2) we can at least document how to use clamav with wine, >> or link to clamav and its doc, e.g. >> http://www.clamav.net/ >> https://help.ubuntu.com/community/ClamAV >> >> 3) we can warn on star

Re: Wine Security Disclosure

2008-03-16 Thread James McKenzie
Dmitry Timoshkov wrote: > "Dan Kegel" <[EMAIL PROTECTED]> wrote: > > >>> What's so special about Wine that doesn't apply to say VMWare, >>> Parallels, Win4Lin, DOSBox, and others? >>> >> With vmware, parallels, and win4lin, you can actually >> run commercial virus scanners inside those

Re: Wine Security Disclosure

2008-03-16 Thread TheBlunderbuss
"Dan Kegel" <[EMAIL PROTECTED]> wrote: It's not enough to provide Wine and throw up our hands saying "It's up to users to protect their systems" because our users are at worst quite literally clueless, and at best too busy to want to bother with virus issues. If we can guide them or ease the

Re: Wine Security Disclosure

2008-03-16 Thread Lei Zhang
On Sun, Mar 16, 2008 at 7:01 AM, Dan Kegel <[EMAIL PROTECTED]> wrote: > 2) we can at least document how to use clamav with wine, > or link to clamav and its doc, e.g. > http://www.clamav.net/ > https://help.ubuntu.com/community/ClamAV > > 3) we can warn on startup if we detect that clamav >

Re: Wine Security Disclosure

2008-03-16 Thread Dan Kegel
[EMAIL PROTECTED] wrote: > Is it really necessary to require running a virus scanner from > inside of Wine? No. Hey, cool, we agree on something! > > and everybody knows that one should do that if one > > cares about viruses. > > Same sentence applies to Wine I'd assume. No, because everyb

Re: Wine Security Disclosure

2008-03-16 Thread Dmitry Timoshkov
"Dan Kegel" <[EMAIL PROTECTED]> wrote: >> What's so special about Wine that doesn't apply to say VMWare, >> Parallels, Win4Lin, DOSBox, and others? > > With vmware, parallels, and win4lin, you can actually > run commercial virus scanners inside those environments, Is it really necessary to req

Re: Wine Security Disclosure

2008-03-16 Thread Dan Kegel
[EMAIL PROTECTED] wrote: > What's so special about Wine that doesn't apply to say VMWare, > Parallels, Win4Lin, DOSBox, and others? With vmware, parallels, and win4lin, you can actually run commercial virus scanners inside those environments, and everybody knows that one should do that if one ca

Re: Wine Security Disclosure

2008-03-16 Thread Dmitry Timoshkov
"Dan Kegel" <[EMAIL PROTECTED]> wrote: > It's not enough to provide Wine and throw up our hands > saying "It's up to users to protect their systems" > because our users are at worst quite literally clueless, > and at best too busy to want to bother with virus issues. > If we can guide them or ease

Re: Wine Security Disclosure

2008-03-16 Thread Dan Kegel
dmitry wrote: >> if we are so compatible that we can run virii and spyware, >> then we need to document it ... otherwise there will be many people >> disappointed by unrealistic expectations. > > Again, I don't see how Wine developers could help with that, > we are developers, not a health care dep

RE: Wine Security Disclosure

2008-03-16 Thread Rolf Kalbermatter
Dmitry Timoshkov [mailto:[EMAIL PROTECTED] wrote: > > This level of security info is something everyone should have easy > > access to and know before starting Wine. Of course, wherever I'm not > > accurate, feel free to fill in! > > There is nothing special about Wine that doesn't apply to >

Re: Wine Security Disclosure

2008-03-16 Thread Dmitry Timoshkov
"Steven Edwards" <[EMAIL PROTECTED]> wrote: > On Sun, Mar 16, 2008 at 3:52 AM, Dmitry Timoshkov > <[EMAIL PROTECTED]> wrote: >> Again, I don't see how Wine developers could help with that, we are >> developers, >> not a health care department. > > And this is why there is a disconnect from dev

Re: Wine Security Disclosure

2008-03-16 Thread Steven Edwards
On Sun, Mar 16, 2008 at 3:52 AM, Dmitry Timoshkov <[EMAIL PROTECTED]> wrote: > Again, I don't see how Wine developers could help with that, we are > developers, > not a health care department. And this is why there is a disconnect from developers to users. If you don't document what are and are

Re: Wine Security Disclosure

2008-03-16 Thread Dmitry Timoshkov
"Steven Edwards" <[EMAIL PROTECTED]> wrote: >> There is nothing special about Wine that doesn't apply to common >> unix/linux/windows security practices. > > No but people come to Linux hearing that its more secure than Windows > for various reasons. I hardly see that it's a Wine problem. > W

Re: Wine Security Disclosure

2008-03-16 Thread Steven Edwards
On Sun, Mar 16, 2008 at 1:29 AM, Dmitry Timoshkov <[EMAIL PROTECTED]> wrote: > There is nothing special about Wine that doesn't apply to common > unix/linux/windows security practices. No but people come to Linux hearing that its more secure than Windows for various reasons. While this may or ma

Re: Wine Security Disclosure

2008-03-15 Thread Jeff Latimer
Dmitry Timoshkov wrote: > "TheBlunderbuss" <[EMAIL PROTECTED]> wrote: > > [skipped] > > >> This level of security info is something everyone should have easy >> access to and know before starting Wine. Of course, wherever I'm not >> accurate, feel free to fill in! >> > There is nothing spec

Re: Wine Security Disclosure

2008-03-15 Thread Dmitry Timoshkov
"TheBlunderbuss" <[EMAIL PROTECTED]> wrote: [skipped] > This level of security info is something everyone should have easy > access to and know before starting Wine. Of course, wherever I'm not > accurate, feel free to fill in! There is nothing special about Wine that doesn't apply to common uni

Re: Wine Security Disclosure

2008-03-15 Thread TheBlunderbuss
    There should be documentation in place beyond a simple entry in the appdb, since you all know as well as I do that the database does not and cannot cover every piece of software out there. For the most part, people don't even know it exists or they don't use it. There will be documentation

Re: Wine Security Disclosure

2008-03-15 Thread Edward Savage
> However, it is true that we should tell users that Wine is > able to run many Windows malware, and that they > should be just as careful running Windows software > with Wine as they would running it with Windows. > We should also show how to install the standard > Linux virus checkers. > -

Re: Wine Security Disclosure

2008-03-14 Thread Ivan Gyurdiev
> No matter what if your running a program, be it linux or windows (on > wine) it always has the potential to mess up things that the user > running it has access too. Not true - you should be running in a SELinux sandbox to solve this problem. I'm not sure if the technology is mature enough for

re: Wine Security Disclosure

2008-03-14 Thread Dan Kegel
wrote: > The recent discussion about Windows viruses working through Wine leads > me to questions about its security. > I've heard that using a separate user is alright, and then it isn't > alright. You're probably referring to http://www.winehq.org/pipermail/wine-devel/2008-March/063452.ht

Re: Wine Security Disclosure

2008-03-14 Thread Zachary Goldberg
On Fri, Mar 14, 2008 at 3:53 PM, TheBlunderbuss <[EMAIL PROTECTED]> wrote: > > The recent discussion about Windows viruses working through Wine leads > me to questions about its security. > I've heard that using a separate user is alright, and then it isn't > alright. Where did you hear that

Wine Security Disclosure

2008-03-14 Thread TheBlunderbuss
    The recent discussion about Windows viruses working through Wine leads me to questions about its security. I've heard that using a separate user is alright, and then it isn't alright. That you shouldn't use sudo to login to such a special wine user. That you really should use a virtual mach