On Nov 24, 2016 2:03 AM, "Carlos Garnacho" <carlosg@gnome.org> wrote:
>
> Hi,
>
> > On Wed, Nov 23, 2016 at 5:03 PM, Carlos Garnacho <carlosg(a)gnome.org&gt; wrote:
> >
> > I'm objecting to whatever piece of software opens thoroughly untrusted
> > files out of ~/Downloads and parses them.  If that's not "Tracker",
> > then I apologize.
> >
> >
> > Firefox is a big piece of code that loads untrusted stuff.  It's
> > written in a memory-unsafe language, and there's a big team working on
> > fixing that.  It's not sandboxed, and there's a project to fix that.
> > And it's still a major attack vector, but at least it has a very
> > serious security team.
>
> Sounds great, do they also get the blame for gstreamer bugs? I've got lots of fun so share ;).
>
> According to you Firefox is just as insecure, and I can tell that Firefox uses GStreamer to open untrusted content over the internet. Why downloading the file at all, you could be tricked into a webpage that auto-plays the infected content, it could even be an ad unbeknownst by the site, you got every bit as infected and Tracker wasn't involved, using the exact piece of sofware as attack vector that we're talking nowadays.

Because Firefox doesn't allow all of the GStreamer content types.  And Firefox has its own mp4 container parser written in Rust these days, I think.

IOW they admit its a problem and they've made it better.

>
> And as for the projects themselves, Tracker is a fraction of Firefox in terms of code size, and tracker-extract inside Tracker is another fraction. That makes a whole lot difference between auditing or securing a *web engine* and a process that essentially iterates over files. Why is Firefox then any more credible? Must be the serious looks of their security team.

If a distro didn't provide a browser by default, no one would notice.  If a distro didn't index media metadata in Downloads by default, I suspect most users wouldn't even notice.

>
> >
> > The fact that flatpak integration is being planned is great.  I hope
> > that flatpak has an exceedingly strict mode for applications like
> > this.
> >
> > Tracker is just as exposed as Firefox because it (or some piece of it
> > or whatever) parses stuff in Downloads.
>
> Tracker-extract is not as exposed as Firefox, because the file needs being in the local filesystem for starters. The web world is well known for figuratively throwing 3rd party media content to your face, even in otherwise trusted websites.
>

Then at *least* stop indexing Downloads by default.

My point is that the default tracker configuration is wildly insecure and it could be improved quite easily.