SoylentNews is people
SoylentNews
from the random-plugin-included-for-free dept.
Submitted via IRC for SoyCow9228
Mozilla sneaked a browser plugin that promotes Mr. Robot into Firefox—and managed to piss off a bunch of its privacy-conscious users in the process.
The extension, called Looking Glass, is intended to promote an augmented reality game to "further your immersion into the Mr. Robot universe," according to Mozilla. It was automatically added to Firefox users' browsers this week with no explanation except the cryptic message, "MY REALITY IS JUST DIFFERENT THAN YOURS," prompting users to worry on Reddit that they'd been hit with spyware.
"I have no idea what it is or where it came from. I freaked out a bit and uninstalled it immediately," one user wrote on Reddit.
Without an explanation included with the extension, users were left digging around in the code for Looking Glass to find answers. Looking Glass was updated for some users today with a description that explains the connection to Mr. Robot and lets users know that the extension won't activate without explicit opt-in.
Mr. Robot is a TV series about hackers airing on USA Network.
Source: https://gizmodo.com/mozilla-slipped-a-mr-robot-promo-plugin-into-firefox-1821332254
(Score: 3, Insightful) by SanityCheck on Sunday December 17 2017, @04:37PM (17 children)
This is true. I'd love some sort of a software that would lock any program in current state, bypassing all the unambiguous auto-updaters. It get's beyond maddening trying to keep some programs from updating to add "new-features."
(Score: 4, Insightful) by Justin Case on Sunday December 17 2017, @04:59PM (15 children)
Again, this
iswas a solved problem. We used to install as root and run without privileges, so nothing could modify your trusted computing base without deliberate steps to enable the change.But that became "too hard".
So enjoy the rapes, kiddies.
(Score: 4, Interesting) by TheRaven on Sunday December 17 2017, @05:49PM (14 children)
sudo mod me up
(Score: 4, Informative) by unauthorized on Sunday December 17 2017, @07:15PM (2 children)
Actually, multilevel security is not a new concept, through it's widespread adoption is a fairly recent development. selinux is nearly 20 years old by now.
(Score: 3, Touché) by PiMuNu on Monday December 18 2017, @10:59AM
and it is still unusable...
(Score: 3, Interesting) by TheRaven on Monday December 18 2017, @11:45AM
sudo mod me up
(Score: 1, Informative) by Anonymous Coward on Sunday December 17 2017, @09:30PM
Correct. But AppArmor is available for OpenSUSE and now Debian. Use it. It may save your day.
(Score: 2) by sjames on Sunday December 17 2017, @10:41PM (9 children)
It's new to Windows, but it's been part of unix since forever. Root installs software and then users can run it but they have read-only permission on the executables. Each user's home directory has the read-write per-user configuration files. Any software that insists on individual users being able to do updates should be beaten with a bucket of wet squirrels.
(Score: 3, Informative) by FatPhil on Sunday December 17 2017, @11:20PM (3 children)
Great minds discuss ideas; average minds discuss events; small minds discuss people; the smallest discuss themselves
(Score: 0) by Anonymous Coward on Monday December 18 2017, @12:10AM
At least in that scenario the software you're deliberately installing should be trustworthy enough not to do that. That's still better than allowing any program installed at any time from tinkering with your deliberately installed component.
(Score: 2) by sjames on Monday December 18 2017, @01:35AM
The installer will be the standard system package manager. That doesn't mean untrusted packages should be installed. As for suid executables, some may actually be necessary for the system to function at all. Otherwise, it's wet squirrel time. All of that is quite distinct from the program updating itself whenever it feels like it without review.
Sure, in some cases the single user and admin may be the same person and may not be that experienced, but in others the admin might be someone more experienced. That applies in home situations as well.
(Score: 2) by urza9814 on Tuesday December 19 2017, @03:24PM
The average user has passwords saved in their browser and all their online IDs associated to a webmail account that is configured to stay logged in. Who needs root access when you can hijack someone's entire digital life with a single browser plugin?
https://xkcd.com/1200/ [xkcd.com]
(Score: 2, Informative) by Anonymous Coward on Monday December 18 2017, @12:53AM (2 children)
It's new to Windows
Security permissions has been baked in since Win NT 3.5. The coding standards on the other hand could be argued that they should be better. One of the NTs selling points was that it was DoD approved. That was before people starting punching holes through the network protocols they hung off the TCP ports (which was a clone of Novel).
NO one set it up the permissions correctly. I mean no one. Not even MS default setup did it much until 2000. The security permission stack in NT is actually pretty powerful. The posix style permission stack is simplistic by comparison. With many flags doing quadruple duty for different things. The NT permission stack is fairly fine grained. Which in many ways makes it harder and oddly enough more confusing to use. When I first learned about it I was like what the fuck is MS doing. This should be setup this way out of the box with some nice reading for every admin to do so they know about it.
Easiest way to 'secure' most windows computers? Install it. Have 1 admin user that install things. Then run everything else under standard user accounts. With each system process running in its own set of accounts. Pretty much the same way most unix boxes work.
The process sandboxing is new. But at this point is more of a process compile option than a configuration option (which it should be).
(Score: 0) by Anonymous Coward on Monday December 18 2017, @08:45AM (1 child)
And that's exactly what made Windows so insecure.
Yes, it can be secured very tightly, but you need to be Dave Cutler to understand it. Meanwhile, Unix permissions are so simple that they can be understood by anyone capable of handling a root password without nuking the entire system.
(Score: 0) by Anonymous Coward on Tuesday December 19 2017, @01:51AM
You can effectively mimic the posix style of permissions if you want in NT (they had to, to put in the OS/2 and posix subsystems). The permission system is much more powerful. The posix system is very powerful but has some creaky edge cases. I can effectively ban a particular user from seeing something even if they are in the right groups and permissions. Something a bit tougher to do in posix. NT has decent list of permissions both positive and negative. The ACL style is much more powerful. For 99% of everything both work very effectively in their default configurations. But get outside of those and NT's system is a better one.
(Score: 2) by TheRaven on Monday December 18 2017, @11:49AM (1 child)
sudo mod me up
(Score: 2) by sjames on Monday December 18 2017, @08:40PM
The data files remain a problem, though selinux and other MAC systems can help a lot there. There is an advantage to software not being able to modify itself, it's far from useless. End of the day, if software can modify itself (possibly as a result of a security flaw, it's game over. Part of your data will necessarily be accessible to some of the software you run. No security system can prevent that and leave you with a usable system
A file system that supports snapshotting can at least help you to recover if something goes wrong.
(Score: 0) by Anonymous Coward on Monday December 18 2017, @03:57PM
Use a VM with a rollback point and always start from the rollback point.