(FYI: I have no internet connection at the moment, so I say 'hi' to all Wine developers!) Wine is nortorious for NOT supporting Autorun. Sure, it's stupid to load the autorun program right after the disk is inserted, but who wants to have to parse the autorun.inf by hand? So I wrote this little program. You can scan a CD for viruses first, then run this to emulate the Windows autorun feature. All you tell it is the drive letter of the CD, and it parses autorun.inf, and runs the listed program. It also check to make sure the file is a valid autorun.inf. It is not complete, and it is pure standard C. No Win32-specific functions are used. It uses several functions that aren't in the msvcrt, so I have included the portable snprintf library (version 2.1) and some portablized code from glibc. The tarball includes a prebuilt binary for your convience, but i strongly suggest you recompile the program from source (emerge xmingw on gentoo, and you can use my Makefile unmodified!)
Segin Noname wrote:
So I wrote this little program.
To be totally honest I don't see the point, in 99.999% of CDs I've ever seen autorun starts some file in the root folder of the CD (start.exe, setup.exe, install.exe, runme.exe, in any case something obvious) and the CD usually comes with instructions telling you which one to run, so I don't see why one would look in the autorun.inf file in the first place, or run the cd with your program, when they could run the right exe directly. So your program would only be useful if it worked like the real autorun, pulled the CD drive every second or so, and automatically read the CD's autorun.inf and started the appropriate exe. Many people (including me) would find that annoying, but I guess it's a windows feature some people may like. Ivan.
hi, I think HAL for linux should handle the automatic mounting and autorunning it take care. So it should be a part of HAL. my 2 cents. bye, VJ On 6/29/06, Ivan Leo Puoti <ivanleo(a)gmail.com> wrote:
Segin Noname wrote:
So I wrote this little program.
To be totally honest I don't see the point, in 99.999% of CDs I've ever seen autorun starts some file in the root folder of the CD (start.exe, setup.exe, install.exe, runme.exe, in any case something obvious) and the CD usually comes with instructions telling you which one to run, so I don't see why one would look in the autorun.inf file in the first place, or run the cd with your program, when they could run the right exe directly. So your program would only be useful if it worked like the real autorun, pulled the CD drive every second or so, and automatically read the CD's autorun.inf and started the appropriate exe. Many people (including me) would find that annoying, but I guess it's a windows feature some people may like.
Ivan.
Vijay Kiran Kamuju wrote:
hi,
I think HAL for linux should handle the automatic mounting and autorunning it take care. So it should be a part of HAL.
my 2 cents.
I strongly DISAGREE - as others have pointed out, the auto-running of CDs is a severe mis-feature of Windows, one which we should NOT duplicate. Now, I could agree with the idea of a program that, upon receiving a DBUS notification of a CD insertion, looked to see if there was an autorun.inf file, and then *asked the user what to do*. IF the user then said "Yes, please run this disk" then the program would parse the autorun.inf file. Ideally, such a program would also maintain a database of CDs already seen, and would allow the user to define an action for the CD that would happen automatically - an action that may have NOTHING to do with the CD itself. But the default action, for CDs never before seen should be "ask the user". Equally ideally, there should be a standard for *nix autorun files, that would allow for a bit more than "infect^Wrun this" - something like an XML file describing the disk, a set of possible actions (run a script, run an existing program, perform some "standard action" like "play as DVD", "run music program"), and the "autorun" program would be part of the operating environment, and would present a meaningful menu to the user.
On Thu, Jun 29, 2006 at 08:48:31AM -0500, David D. Hagood wrote:
Vijay Kiran Kamuju wrote:
hi,
I think HAL for linux should handle the automatic mounting and autorunning it take care. So it should be a part of HAL.
my 2 cents.
I strongly DISAGREE - as others have pointed out, the auto-running of CDs is a severe mis-feature of Windows, one which we should NOT duplicate.
Now, I could agree with the idea of a program that, upon receiving a DBUS notification of a CD insertion, looked to see if there was an autorun.inf file, and then *asked the user what to do*. IF the user then said "Yes, please run this disk" then the program would parse the autorun.inf file.
Ideally, such a program would also maintain a database of CDs already seen, and would allow the user to define an action for the CD that would happen automatically - an action that may have NOTHING to do with the CD itself. But the default action, for CDs never before seen should be "ask the user".
cd programs/explorer/ vi hal.c Ciao, Marcus
On Thursday 29 June 2006 06:48, David D. Hagood wrote:
I strongly DISAGREE - as others have pointed out, the auto-running of CDs is a severe mis-feature of Windows, one which we should NOT duplicate.
One could argue Windows itself is a mis-feature. :P Isn't the point of Wine to duplicate Windows, feature-for-feature and bug-for-bug? IMO, autorun capabilities should be included, though I personally don't care if it's on or off by default, as long as there's an option in winecfg. I'll just turn it off myself. Or perhaps even a popup notification upon the first detected autorun-capable disc, asking if you want to turn autorun on or off. autorun.inf needs to be parsed anyway, since it can set an icon for the drive.
On 6/29/06, Chris <chris.kcat(a)gmail.com> wrote:
One could argue Windows itself is a mis-feature. :P Isn't the point of Wine to duplicate Windows, feature-for-feature and bug-for-bug? IMO, autorun capabilities should be included, though I personally don't care if it's on or off by default, as long as there's an option in winecfg. I'll just turn it off myself. Or perhaps even a popup notification upon the first detected autorun-capable disc, asking if you want to turn autorun on or off. autorun.inf needs to be parsed anyway, since it can set an icon for the drive. No, I think the point of Wine is to run Windows programs on top of Unix. We don't need autorun to run Windows programs at all. Wine often leaves out features that are in Windows because they aren't needed to get Windows programs to run.
Running whatever code happens to be on a cd without asking the user is a very bad idea. I don't want to see it happen, and I think most real Wine devs probably feel the same way. Gnome already has a feature that can ask the user what to do when a cd is inserted. KDE probably has a similar feature. I think they'd be the people to ask if you want something like Windows' autorun. -- Vincent Povirk
Thats what I meant. On 6/29/06, Vincent Povirk <madewokherd+d41d(a)gmail.com> wrote:
On 6/29/06, Chris <chris.kcat(a)gmail.com> wrote:
One could argue Windows itself is a mis-feature. :P Isn't the point of Wine to duplicate Windows, feature-for-feature and bug-for-bug? IMO, autorun capabilities should be included, though I personally don't care if it's on or off by default, as long as there's an option in winecfg. I'll just turn it off myself. Or perhaps even a popup notification upon the first detected autorun-capable disc, asking if you want to turn autorun on or off. autorun.inf needs to be parsed anyway, since it can set an icon for the drive. No, I think the point of Wine is to run Windows programs on top of Unix. We don't need autorun to run Windows programs at all. Wine often leaves out features that are in Windows because they aren't needed to get Windows programs to run.
Running whatever code happens to be on a cd without asking the user is a very bad idea. I don't want to see it happen, and I think most real Wine devs probably feel the same way.
Gnome already has a feature that can ask the user what to do when a cd is inserted. KDE probably has a similar feature. I think they'd be the people to ask if you want something like Windows' autorun.
-- Vincent Povirk
On 6/29/06, Vincent Povirk <madewokherd+d41d(a)gmail.com> wrote:
On 6/29/06, Chris <chris.kcat(a)gmail.com> wrote:
One could argue Windows itself is a mis-feature. :P Isn't the point of Wine to duplicate Windows, feature-for-feature and bug-for-bug? IMO, autorun capabilities should be included, though I personally don't care if it's on or off by default, as long as there's an option in winecfg. I'll just turn it off myself. Or perhaps even a popup notification upon the first detected autorun-capable disc, asking if you want to turn autorun on or off. autorun.inf needs to be parsed anyway, since it can set an icon for the drive. No, I think the point of Wine is to run Windows programs on top of Unix. We don't need autorun to run Windows programs at all. Wine often leaves out features that are in Windows because they aren't needed to get Windows programs to run.
Running whatever code happens to be on a cd without asking the user is a very bad idea. I don't want to see it happen, and I think most real Wine devs probably feel the same way.
Gnome already has a feature that can ask the user what to do when a cd is inserted. KDE probably has a similar feature. I think they'd be the people to ask if you want something like Windows' autorun.
Having the ability to autorun cds is most definitely not a misfeature. Most people who use windows do not want to or are incapable of hunting around a cd for the correct executable to run the installer for their game or whatever. Sure wine is not catering to those people right now, however it will in the future if all goes well. I agree that autorunning all cds without ever asking the user is not good, however the feature itself is not bad. Asking the user is clearly the solution. Windows is simply not designed to have the average user perusing software directories. Will's $0.02
Thursday, June 29, 2006, 12:02:38 PM, William Knop wrote:
On 6/29/06, Vincent Povirk <madewokherd+d41d(a)gmail.com> wrote:
On 6/29/06, Chris <chris.kcat(a)gmail.com> wrote:
One could argue Windows itself is a mis-feature. :P Isn't the point of Wine to duplicate Windows, feature-for-feature and bug-for-bug? IMO, autorun capabilities should be included, though I personally don't care if it's on or off by default, as long as there's an option in winecfg. I'll just turn it off myself. Or perhaps even a popup notification upon the first detected autorun-capable disc, asking if you want to turn autorun on or off. autorun.inf needs to be parsed anyway, since it can set an icon for the drive. No, I think the point of Wine is to run Windows programs on top of Unix. We don't need autorun to run Windows programs at all. Wine often leaves out features that are in Windows because they aren't needed to get Windows programs to run.
Running whatever code happens to be on a cd without asking the user is a very bad idea. I don't want to see it happen, and I think most real Wine devs probably feel the same way.
Gnome already has a feature that can ask the user what to do when a cd is inserted. KDE probably has a similar feature. I think they'd be the people to ask if you want something like Windows' autorun.
Having the ability to autorun cds is most definitely not a misfeature. Of course it's not. It's the perfect means of distributing trojans, backdoors, rootkits and other very useful software an every CD, including DVDs and music CDs.
Vitaliy.
On Jun 29, 2006, at 8:59 PM, Vitaliy Margolen wrote:
Thursday, June 29, 2006, 12:02:38 PM, William Knop wrote:
Having the ability to autorun cds is most definitely not a misfeature. Of course it's not. It's the perfect means of distributing trojans, backdoors, rootkits and other very useful software an every CD, including DVDs and music CDs.
If your assuming said media is compromised in such a way, requiring the user to manually run the executable will not protect him. The fact is, most media is not compromised. Software publishers ensure they are not. Most windows users can trust their software publishers. For those who cannot, they can simply click "No" when the dialog pops up. Or they can set it to never autorun. Or they could set it to virus-scan before autorunning. Everybody's happy. One thing I'm sure of: If regular guy Joe Schmo has to run executables from CDs manually, he will either say CDs don't work in wine or say that wine is a PITA to use.
Thursday, June 29, 2006, 7:37:16 PM, William Knop wrote:
On Jun 29, 2006, at 8:59 PM, Vitaliy Margolen wrote:
Thursday, June 29, 2006, 12:02:38 PM, William Knop wrote:
Having the ability to autorun cds is most definitely not a misfeature. Of course it's not. It's the perfect means of distributing trojans, backdoors, rootkits and other very useful software an every CD, including DVDs and music CDs.
If your assuming said media is compromised in such a way, requiring the user to manually run the executable will not protect him. The fact is, most media is not compromised. Software publishers ensure they are not. Most windows users can trust their software publishers. That's what SONY been telling all along...
Vitaliy
The Sony rootkit fiasco alone should be enough to end this conversation. Period. Say what you want about the theoretical integrity of the media, and the user's security habits. The fact is that hundreds (possibly thousands or millions) of _real_ people were infected by rootkits because of autorun and an unscrupulous corporation. As you've so aptly demonstrated, average users are all too willing to trust people who don't deserve to be trusted. If Wine can protect some of those people sometimes, great. If Wine can protect people without any developers having to do any work, that's simply amazing. Well done Wine devs. --tim
On Thursday 29 June 2006 20:31, Tim Schmidt wrote:
The Sony rootkit fiasco alone should be enough to end this conversation.
If you notice, Sony got into a lot of trouble over that. And the problem wasn't autorun. The problem was that the disc installed the rootkit anyway /even if the user said no/. The same exact thing would've happened if the user had to browse the CD and double-click setup.exe, or whatever the file was called. Should Wine disable running .exe files because they may install rootkits on users' machines? Of course not, because that would be couter-productive to what Wine is trying to achieve. It's the same thing with autorun. It may or may not cause problems, but it's the user's responsibility to take proper care of their machine. It's just as true in Windows as it is in Linux, or any other OS.
On 6/29/06, Chris <chris.kcat(a)gmail.com> wrote:
If you notice, Sony got into a lot of trouble over that. And the problem wasn't autorun. The problem was that the disc installed the rootkit anyway /even if the user said no/. The same exact thing would've happened if the user had to browse the CD and double-click setup.exe, or whatever the file was called. Should Wine disable running .exe files because they may install rootkits on users' machines? Of course not, because that would be couter-productive to what Wine is trying to achieve. It's the same thing with autorun. It may or may not cause problems, but it's the user's responsibility to take proper care of their machine. It's just as true in Windows as it is in Linux, or any other OS.
Of course. You're right. Everyone's computers _should_ run arbitrary code from any un-authorized source automatically without the user's knowledge or permission. I was wrong. The fact that Windows ran _anything_ upon inserting a CD meant to contain audio only is crap. I understand that Sony exploited a 'feature' of Windows. It's all Sony's fault. Blame Sony. Problem is, that philosophy pushes the trust all the way out to the people who want to install rootkits on your computer. Bad idea. Better to trust Wine not to do anything to endanger your computer without your explicit attention. --tim
On 6/29/06, Chris <chris.kcat(a)gmail.com> wrote:
If you notice, Sony got into a lot of trouble over that. And the problem wasn't autorun. The problem was that the disc installed the rootkit anyway /even if the user said no/. The same exact thing would've happened if the user had to browse the CD and double-click setup.exe, or whatever the file was called. Should Wine disable running .exe files because they may install rootkits on users' machines? Of course not, because that would be couter-productive to what Wine is trying to achieve. It's the same thing with autorun. It may or may not cause problems, but it's the user's responsibility to take proper care of their machine. It's just as true in Windows as it is in Linux, or any other OS.
[skip to the last paragraph to get to the point; I thought this other stuff was necessary and now I don't, but I also don't feel like deleting it having already written it] I'm not sure we should install programs in that way on Linux. I think one of the most noticeable differences between Linux and Windows for most people is how you install software. In Windows, you get an exe file from somewhere (hopefully from someone you can trust), and you run it. You then follow the instructions, possibly reboot the computer, and then when you're done you expect the program to be installed and working. If it doesn't work, you complain to the authors of the software. In Linux, most of the software you need will be provided by your distribution. If you're on, say, gentoo, you type "emerge software", and when it's done you expect the program will be installed and working (in this case, you don't have to do anything; you just wait). If it doesn't work, you don't complain to the authors, you complain to gentoo. If it turns out to be an upstream bug, it gets passed along to the authors. If it turns out to be a bug in gentoo, then hopefully they fix it. Of course, Linux users can also do something similar to what the Windows users do and handle the whole process themselves. Then they'll report problems directly to the authors. Now, here's the part where I reward you for reading this far and tell you what this has to do with Wine. Wine users get software from the authors, try to install it themselves, and expect it to work. Then when it doesn't work they complain to Wine. That's backwards. Unless they checked the appdb first, probably no one from Wine claimed it would work to begin with. Yes, most people aren't like that, and yes, people should report bugs. But they shouldn't act like someone said it would probably work if no one has. I think this is a good reason to have something like Wine Doors. For applications that are known to work, possibly with some override or hack, someone could write an installer and vouch for the workingness of at least some apps. People who don't know how to do things like overrides can use the installer. If something doesn't work (and you should expect it to work if there's an installer that's supposed to work on that wine version) then those users have somewhere to complain to. Conversely, applications without installers would be hit-and-miss. You'll have to do a bit more work for those, and you may be paving the way for others by submitting testing data, writing howtos, bug reports, an installer, maybe even fixing something in wine. So it's clear that they might not work. Now, when you make someone's environment say "This CD has a program on it, shall I run it?", you're making the claim that this will probably work. That's just not true. It probably will not work as well as it's supposed to. I'd much rather have people go to a package manager, the applications database, the documentation, ANYWHERE where they will not be promised something that isn't true, even if it makes Wine seem harder to use. -- Vincent Povirk
William Knop wrote:
On Jun 29, 2006, at 8:59 PM, Vitaliy Margolen wrote:
Thursday, June 29, 2006, 12:02:38 PM, William Knop wrote:
Having the ability to autorun cds is most definitely not a misfeature. Of course it's not. It's the perfect means of distributing trojans, backdoors, rootkits and other very useful software an every CD, including DVDs and music CDs.
If your assuming said media is compromised in such a way, requiring the user to manually run the executable will not protect him. The fact is, most media is not compromised. Software publishers ensure they are not. Most windows users can trust their software publishers. For those who cannot, they can simply click "No" when the dialog pops up. Or they can set it to never autorun. Or they could set it to virus-scan before autorunning. Everybody's happy.
One thing I'm sure of: If regular guy Joe Schmo has to run executables from CDs manually, he will either say CDs don't work in wine or say that wine is a PITA to use.
I totally agree, autorun is a must (ok put in all the checks) but wine is being put together for the average user isn't it, that means if they put in a CD they expect it to do something, and don't care whether it's 100% secure, (that's the job of the virus/spyware detection software). Now wouldn't that be something wine with AVG/Spybot/Adaware buildin. Although I heard today Microsoft has just done that, a security suite for windows of course you have to pay a subscription otherwise they can't guarantee windows will be secure, mmm ... However, seeing as you can't even install a multi CD game in wine without the game complaining about the fact it can't find CD 2, perhaps priorities need to be sorted. What's the point of autorun when the app throws a wobbly when it gets to CD2
participants (11)
-
Chris -
David D. Hagood -
Ivan Leo Puoti -
Marcus Meissner -
nlaw＠nildram.co.uk -
Segin Noname -
Tim Schmidt -
Vijay Kiran Kamuju -
Vincent Povirk -
Vitaliy Margolen -
William Knop