6 ms·
> > In short, run `pdflatex` in a VM. > Yeah with a premature prankster you might have to. Anything that runs on untrusted input should be run in an isolated
by daenney 10y ago
> > In short, run `pdflatex` in a VM.
> Yeah with a premature prankster you might have to.
Anything that runs on untrusted input should be run in an isolated environment.
When it's your own stuff do as you please. When it's a thing you got from somewhere and just blindly run it on your machine, might want to think twice. That advise doesn't just go for LaTeX.
Just because you consider it immature doesn't mean it's not genuinely exploitable and someone couldn't use it against you. If anything, taking the approach of "only immature pranksters do this" probably makes it easier for someone to sneak it past you.
- bench_soup 10y agoWell, the article implies 'pwning coworkers' which is indeed quite immature. Do you do all your development in closed/isolated environment because of your coworkers posing threats? That sounds a bit paranoid.
- daenney 10y ago> Do you do all your development in closed/isolated environment because of your coworkers posing threats? That sounds a bit paranoid. Not because of my coworkers posing threats. And this wouldn't have to come from a coworker. Though that's what the author suggests the issue isn't limited to that which unfortunately seems to have taken the upper hand in the discussions around this. But I do most of my development in isolated environments. Not because I don't trust my coworkers but because people can fuck up, things sneak in and can break my system or leave it vulnerable.
- 50CNT 10y agoOn the other hand, isn't pwning coworkers the basis of sound security awareness training?
- lucb1e 10y ago> Anything that runs on untrusted input should be run in an isolated environment. If a colleague sends me something to review, I trust that he doesn't want to hack me. Someone can always use physical access to capture my keystrokes in some way. > doesn't mean it's not genuinely exploitable Agreed, so the message should be "don't run random LaTeX files from the internet or classmates or something", not "oh hey look at me annoying colleagues at work".
- foota 10y agoThis is being a bit paranoid, but do your colleagues pgp sign their messages? How do you know it is really coming from them?
- pbhjpbhj 10y agoand how do you know your colleague is not a spy, or a double agent, or an advanced AI seeking to take down the human race ... /paranoia
- saint_fiasco 10y agoOr just has an email client that got infected with a virus. Remember Office macro viruses? How we laughed at how stupid it was that a simple word processor apparently needed vulnerable turing-complete macros? Now we actually compile source files into documents and get surprised that someone might trick you into running malware.
- lucb1e 10y agoFair point. I mean, I do sign with PGP when I have someone's key but this often runs into trouble with spam filters or people going "I lost my key" or "I want to read it in the train and I don't have my privkey on my mobile device". So it's a valid point.
- ryukafalz 10y agoYou don't need to encrypt it, just sign it - no privkey required to read a signed message, and you don't need someone else's pubkey to do so. Of course it won't help if your coworkers don't also sign things they send to you.
- saint_fiasco 10y agoMalware writers might take advantage of your trust for your coworkers and spread their viruses as email attachments from trusted (infected) sources. It's like Office macro viruses but for nerds.