February 2009 - Wine-Devel - list.winehq.org

Re: Malware on Wine review

by Damjan Jovanovic

On Tue, Feb 24, 2009 at 12:49 AM, Dan Kegel <dank(a)kegel.com> wrote: > http://www.avertlabs.com/research/blog/index.php/2009/02/23/running-windows… > is an interesting report; all the malware he tried ran > to at least some extent on wine. > > One interesting bit of advice he gives at the end is > > "Do not set the file association for Windows executables with Wine. > This would enable running Windows executables in Wine by simply double > clicking them." > > I saw a patch floating by to turn this on by default recently. Maybe > we should make it off by default, but easy to turn on...? > > > That patch, which I wrote, works a differently than you describe. It generates an association from a file extension, to open with the handler for its ProgID currently in the registry. So it allows .txt to open with Notepad and .dev to open with Dev-C++. It does not make Wine open a new .exe by default - at least, that was not the intention. Windows executables already run in Wine when you double click on them - that's tools/wine.desktop doing it's job. Damjan

Feb. 24, 2009

Re: Simple but awesome demos of Wine?

by Tom Wickline

Hello Dan, Maybe run the game in a Virtual Desktop? Tom On Tue, Feb 24, 2009 at 1:57 PM, Dan Kegel <dank(a)kegel.com> wrote: > > Wow. I just tried LOTRBFME2 :-) and it's impressive. > Only problem so far is that it doesn't restore video resolution on exit. > Otherwise it's the coolest game of the sort I've ever seen. > (I don't get out much :-) > - Dan > > > -- http://www.wine-reviews.net/ http://bordeauxgroup.com/

Feb. 24, 2009

Re: Simple but awesome demos of Wine?

by Dan Kegel

On Sun, Feb 1, 2009 at 12:33 PM, Vít Hrachový <vit.hrachovy(a)sandbox.cz> wrote: > Hi Dan > from top of my head - > > Heroes of Might and Magic III > Wizardry 8 > Lord of the Rings: Battle for Middle-Earth 2 > > all have free demo downloads and don't require net. Wow. I just tried LOTRBFME2 :-) and it's impressive. Only problem so far is that it doesn't restore video resolution on exit. Otherwise it's the coolest game of the sort I've ever seen. (I don't get out much :-) - Dan

Feb. 24, 2009

Re: Malware on Wine review

by Dan Kegel

On Mon, Feb 23, 2009 at 4:06 PM, Dan Kegel <dank(a)kegel.com> wrote: >>>>> "Do not set the file association for Windows executables with Wine. >>>>> This would enable running Windows executables in Wine by simply double >>>>> clicking them." > > Yes, this will require a modicum of consensus. We might decide > to stay unsafe, or we might decide to make the bindings be in > a separate package, so it's easier for admins to flip the switch. As someone else mentioned, it's probably safe for the file manager's doubleclick handler to execute programs that are marked executable. The option would be whether to let it execute ones not marked executable. - Dan

Feb. 24, 2009

Re: Malware on Wine review

by Jerome Leclanche

I think at best it should be up to the distribution to decide to enable additional security features, which is where most common users will get Wine from. Maybe display a warning on the download page? (Gah, Reply to all, sorry Marcel.) JL On Tue, Feb 24, 2009 at 3:14 AM, Marcel Partap <mpartap(a)gmx.net> wrote: >> What about having to mark the exe as +x before Wine will load it? That's >> easilly doable frame any sane filemanager and provides a good level of >> safety.. and Wine already does a good job of making sure installed programs >> get +x. > Wow it actually does, never noticed that up to now :O > The problem would be with one of the more common use case: trying to > start/install a program from an optical disc. The files will not be > marked +x and the directories not be writable. > This problem scenario is also rather specific to WiNE; not an issue > for KDE f.e. whcih yesterday had a related change committed: .desktop > files have to be marked as executable to be run on click now. Lively > discussion about that is still ongoing on kde-core-devel. > > Despite from the install-from-cdrom issue, few users that have (been) > switched from windows to linux will know how to chmod +x a file, so > wine would at least have to give them a hint (or even a button) to do > it. But once it becomes easy, they will just get used to clicking it > and not be consciously pondering if the action is safe or not. So > while i think it'd make sense, i doubt it is a practical solution to > require files to have the executable bit. > > Maybe a better solution would be to introduce an optional dependency > on ClamAV and tight integration with it - known malware could be > filtered and distributors would have greater interest in contributing > to continuous ClamAV signature updates.. > > regards marcel. > > > > -- > "Obstacles are those frightful things you see when you take > your eyes off your goal." -- Henry Ford (1863-1947) > > Change the world! Vote: http://hfopi.org/vote-future > > > -- Adys

Feb. 24, 2009

Re: Malware on Wine review

by Marcel Partap

> What about having to mark the exe as +x before Wine will load it? That's > easilly doable frame any sane filemanager and provides a good level of > safety.. and Wine already does a good job of making sure installed programs > get +x. Wow it actually does, never noticed that up to now :O The problem would be with one of the more common use case: trying to start/install a program from an optical disc. The files will not be marked +x and the directories not be writable. This problem scenario is also rather specific to WiNE; not an issue for KDE f.e. whcih yesterday had a related change committed: .desktop files have to be marked as executable to be run on click now. Lively discussion about that is still ongoing on kde-core-devel. Despite from the install-from-cdrom issue, few users that have (been) switched from windows to linux will know how to chmod +x a file, so wine would at least have to give them a hint (or even a button) to do it. But once it becomes easy, they will just get used to clicking it and not be consciously pondering if the action is safe or not. So while i think it'd make sense, i doubt it is a practical solution to require files to have the executable bit. Maybe a better solution would be to introduce an optional dependency on ClamAV and tight integration with it - known malware could be filtered and distributors would have greater interest in contributing to continuous ClamAV signature updates.. regards marcel. -- "Obstacles are those frightful things you see when you take your eyes off your goal." -- Henry Ford (1863-1947) Change the world! Vote: http://hfopi.org/vote-future

Feb. 24, 2009

Re: Malware on Wine review

by Chris Robinson

On Monday 23 February 2009 4:28:27 pm Zachary Goldberg wrote: > I interpret bug-for-bug compatibility to be more than just emulating > the API bugs so apps run. Its about emulating the experience for > users to be as close to expectations (set by Windows) as possible. Can't say I agree with that. If a user wants the Windows experience, they should get Windows. Wine enables Windows apps to run on Linux and other Unix systems, not making Linux/Unix systems behave like Windows (IMO, it should make the Windows apps behave like Linux ones whenever possible). > Preventing them from double-clicking EXEs in the file manager without > finding some arbitrary configuration option doesn't seem to be inline > with this. What about having to mark the exe as +x before Wine will load it? That's easilly doable frame any sane filemanager and provides a good level of safety.. and Wine already does a good job of making sure installed programs get +x.

Feb. 24, 2009

Re: Malware on Wine review

by Chris Robinson

On Monday 23 February 2009 3:58:10 pm Zachary Goldberg wrote: > I disagree on this point. Is malware via Wine on Linux really a > problem commonly affecting users? What happened to replicated > Window's behavior bug for bug? User X might ask: double clicking an > exe works in Windows why shouldn't it in Linux? Why should user X > have to go through an extra step to do something on Linux than they > would on Windows? Linux isn't Windows. If anything, I think it would be a good idea to pay more attention to those non-Windows features, such as making Wine refuse to load EXEs and DLLs that aren't +x. A simple security measure, and it cleanly follows the behavior of the host system. IMO, "Windows doesn't do it that way" is not a valid excuse to not do it. There was a blog post recently that made its way through slashdot exposing a deceptively simple attack vector for trajans on Linux. It revolved around the DE's capability of executing a program/shell script specified in a .desktop file, where neither the .desktop file nor the program being run needed +x. You could simply click on a .desktop file from an email, disguised as a "safe" iamge or text file, and the DE's associations would take care of the rest. The file didn't have to be saved somewhere and manually marked +x.. it opened and ran a program directly from the email. Is that a good thing to be bringing to Linux/Unix? The capability for users to click on an exe in an email and have it run with no questions, beyond an "Are You Sure?" dialog that they're conditioned to click through? IMO, this is something Wine should try to avoid, even though it's perfectly acceptable in Windows.

Feb. 24, 2009

Re: Malware on Wine review

by Zachary Goldberg

2009/2/23 Ben Klein <shacklein(a)gmail.com>: > 2009/2/24 Zachary Goldberg <zgold(a)bluesata.com>: >> 2009/2/23 Dan Kegel <dank(a)kegel.com>: >>> Ben Klein <shacklein(a)gmail.com> wrote: >>>>> http://www.avertlabs.com/research/blog/index.php/2009/02/23/running-windows… >>>>> >>>>> "Do not set the file association for Windows executables with Wine. >>>>> This would enable running Windows executables in Wine by simply double >>>>> clicking them." >>>>> >>>>> I saw a patch floating by to turn this on by default recently. Maybe >>>>> we should make it off by default, but easy to turn on...? >>>> >>>> This would annoy all the people that the association targets. We can >>>> either make it easy to run all Windows apps (malware and legit) via >>>> file manager, or none at all. >>> >>> Yes, exactly. The default should be off, and it should be easy to >>> turn on. >>> - Dan >> >> I disagree on this point. Is malware via Wine on Linux really a >> problem commonly affecting users? What happened to replicated >> Window's behavior bug for bug? User X might ask: double clicking an >> exe works in Windows why shouldn't it in Linux? Why should user X >> have to go through an extra step to do something on Linux than they >> would on Windows? > > Thing is, this is not something that's explicitly within Wine. It's > desktop integration at best, and file manager-specific at worst. I'd > say it doesn't fall under the heading of "bug-for-bug compatibility". > > That's just me though. Comments from real Wine devs would be much more > meaningful :) > I interpret bug-for-bug compatibility to be more than just emulating the API bugs so apps run. Its about emulating the experience for users to be as close to expectations (set by Windows) as possible. Preventing them from double-clicking EXEs in the file manager without finding some arbitrary configuration option doesn't seem to be inline with this.

Feb. 24, 2009

Re: Malware on Wine review

by Austin English

On Mon, Feb 23, 2009 at 5:58 PM, Zachary Goldberg <zgold(a)bluesata.com> wrote: > 2009/2/23 Dan Kegel <dank(a)kegel.com>: >> Ben Klein <shacklein(a)gmail.com> wrote: >>>> http://www.avertlabs.com/research/blog/index.php/2009/02/23/running-windows… >>>> >>>> "Do not set the file association for Windows executables with Wine. >>>> This would enable running Windows executables in Wine by simply double >>>> clicking them." >>>> >>>> I saw a patch floating by to turn this on by default recently. Maybe >>>> we should make it off by default, but easy to turn on...? >>> >>> This would annoy all the people that the association targets. We can >>> either make it easy to run all Windows apps (malware and legit) via >>> file manager, or none at all. >> >> Yes, exactly. The default should be off, and it should be easy to >> turn on. >> - Dan >> >> >> > > I disagree on this point. Is malware via Wine on Linux really a > problem commonly affecting users? What happened to replicated > Window's behavior bug for bug? User X might ask: double clicking an > exe works in Windows why shouldn't it in Linux? Why should user X > have to go through an extra step to do something on Linux than they > would on Windows? > > -Zach > > > +1 -- -Austin

Feb. 24, 2009