3 ms·
you're being dismissive because it sounds like a such an RCE could only be the result of gross negligence. let me paint a more plausible scenario. many gnome-b
by woodrowbarlow 7y ago
you're being dismissive because it sounds like a such an RCE could only be the result of gross negligence. let me paint a more plausible scenario.
many gnome-based distros (fedora, for example) ship with firefox and the "gnome extensions" plugin for firefox pre-installed. this extension allows you to install extensions directly into your shell from extensions.gnome.org just by clicking "install".
suppose an exploit was found that allows sources other than extensions.gnome.org to trigger the firefox plugin to install a shell extension.
seems much more likely now, doesn't it?
- Crinus 7y agoI'm not sure how much of a possibility this is because i do not know exactly how GNOME extensions work - the linked malware is not a real GNOME extension, it just pretends to be one by placing itself in the directory where GNOME extensions are placed, but it really is a shell script. But assuming that this is the case, as i said above the issue would be with Firefox and/or the Firefox extension, not with GNOME being extensible or the user being able to download and run shell scripts (the two things that enable this to work) in their computer (and really the "GNOME being extensible" part is minor, the only reason the malware uses that is to hide itself, it isn't even a real GNOME extension). The main reason i am dismissive is because if you think this is a real threat then you'd have to also think anything you can run on your computer to be a real threat - which, IMO, is absurd and at that point you might as well turn off and throw your computer out of the window.