5 ms·

pdf and dmg are already pretty scary.

by troymc 9y ago

josteink 9y ago
Considering most people in the world use Windows, dmg is pretty much irrelevant. They can only be opened/unpacked on Macs, so even if it contains a evil payload you won't ever got to it on Windows or Linux. Exe-files has much bigger impact and can be run through emulation on non-Windows systems. I'd say exe is a much better choice.
- falcor84 9y ago
  My mental pronunciation mechanism cannot stop reading "dmg" as "damage"
  - dEnigma 9y ago
    Same for me. I guess that's what decades of playing with and reading about video games do to your brain ^^
  - spiffworks 9y ago
    You must be a Richard Herring fan.
- mikkohypponen 9y ago
  *Considering most people in the world use Android.
  - josteink 9y ago
    Good point. Doesn't invalidate mine though :)
  - PetahNZ 9y ago
    Well, most people use both.
    - dabber 9y ago
      That can't be true can it?
- deleted 9y ago
  [deleted]
- deleted 9y ago
  [deleted]
- wingerlang 9y ago
  As an OSX user, it is fairly amusing when some sketchy ad auto-downloads some "setup.exe" file.
  - skocznymroczny 9y ago
    As a Windows user, it's amusing when shady websites try to emulate macOS system dialogs, or Android ones.
  - mamon 9y ago
    But what if you do the same on Linux, with Wine installed? are you vulnerable the same way Windows users are ? I mean: Wine lets you just double-click exe file to run it.
    - wingerlang 9y ago
      No idea, however I doubt any Linux user with Wine installed would double click some random setup.exe that was auto downloaded.
      - fredsanford 9y ago
        You are dangerously underestimating stupid...
cel1ne 9y ago
Dmg isn't scary. It's just a disk-image that mounts upon download. You have to manually start any executable on it. And yes, there are users who click on executables carelessly, but those aren't scared by url-parts.
- robin_reala 9y ago
  Safari’s DMG behaviour has been problematic in the past: https://www.cnet.com/news/mac-os-xsafari-dmg-vulnerability-reported-turn-off-automatic-opening-of-safe-files-to-prevent/ https://www.cnet.com/news/mac-os-xsafari-dmg-vulnerability-r...
- evilDagmar 9y ago
  Uhh... It mounts after downloading? Aside from that I doubt (or don't want to believe) that's what's happening... Doesn't that sound inherently dangerous to you? We've seen files that could infect Windows machines just from having the file browser look directly at them.

pdf and dmg are already pretty scary.

by troymc 9y ago

pdf and dmg are already pretty scary.

Considering most people in the world use Windows, dmg is pretty much irrelevant. They can only be opened/unpacked on Macs, so even if it contains a evil payload you won't ever got to it on Windows or Linux. Exe-files has much bigger impact and can be run through emulation on non-Windows systems. I'd say exe is a much better choice.

falcor84 9y ago
My mental pronunciation mechanism cannot stop reading "dmg" as "damage"
- dEnigma 9y ago
  Same for me. I guess that's what decades of playing with and reading about video games do to your brain ^^
- spiffworks 9y ago
  You must be a Richard Herring fan.
mikkohypponen 9y ago
*Considering most people in the world use Android.
- josteink 9y ago
  Good point. Doesn't invalidate mine though :)
- PetahNZ 9y ago
  Well, most people use both.
  - dabber 9y ago
    That can't be true can it?
deleted 9y ago
[deleted]
deleted 9y ago
[deleted]
wingerlang 9y ago
As an OSX user, it is fairly amusing when some sketchy ad auto-downloads some "setup.exe" file.
- skocznymroczny 9y ago
  As a Windows user, it's amusing when shady websites try to emulate macOS system dialogs, or Android ones.
- mamon 9y ago
  But what if you do the same on Linux, with Wine installed? are you vulnerable the same way Windows users are ? I mean: Wine lets you just double-click exe file to run it.
  - wingerlang 9y ago
    No idea, however I doubt any Linux user with Wine installed would double click some random setup.exe that was auto downloaded.
    - fredsanford 9y ago
      You are dangerously underestimating stupid...

cel1ne 9y ago

Dmg isn't scary. It's just a disk-image that mounts upon download. You have to manually start any executable on it. And yes, there are users who click on executables carelessly, but those aren't scared by url-parts.

robin_reala 9y ago
Safari’s DMG behaviour has been problematic in the past: https://www.cnet.com/news/mac-os-xsafari-dmg-vulnerability-reported-turn-off-automatic-opening-of-safe-files-to-prevent/ https://www.cnet.com/news/mac-os-xsafari-dmg-vulnerability-r...
evilDagmar 9y ago
Uhh... It mounts after downloading? Aside from that I doubt (or don't want to believe) that's what's happening... Doesn't that sound inherently dangerous to you? We've seen files that could infect Windows machines just from having the file browser look directly at them.