4 ms·
You're giving those executables full control over your computer. Yeah, you won't get burned very often (depending on where you're getting these executables.) Bu
by ebbv 13y ago
You're giving those executables full control over your computer. Yeah, you won't get burned very often (depending on where you're getting these executables.) But when you do get burned it's going to be catastrophic. That's the problem.
It's a bad practice.
- skrebbel 13y agoHm, I see your point. How would you then recommend installing non open source software on a production system? E.g. a freeware (but proprietary) FTP server or a database engine.
- hrjet 13y agoIf you are taking recommendations, I wouldn't recommend installing them at all. You could ask the authors to support a platform which has a better security model. (Given that there are open-source and robuster-than-Windows platforms freely available.).
- jamespo 13y agoCool, I'll just email MS and ask them to port Sharepoint to BSD.
- steinnes 13y agoGood job making an honest and good recommendation sound naive.
- skrebbel 13y agoHow is 'just ditch Windows' an honest and good recommendation?
- mryan 13y agoThat was a terrible recommendation. Proposing a solution when you know nothing about the situation nearly always results in a pointless solution. Suggesting that the best way to securely install Windows packages is to use a different operating system smacks of immaturity, and is obviously not a practical solution in Windows environments. A better suggestion might be: If you do not trust it, run it in a VM/sandbox.
- hrjet 13y agoThat might be a good idea, assuming they do listen to user feedback.
- sp332 13y agoChrome for Windows installs to a user's own app directory. It doesn't require admin privileges.
- Arnor 13y ago1. Don't install software from untrusted sources. 2. The trusted sources should provide checksums so you can verify the package before installing it. This protects you from a compromised package so long as the page you accessed the package from has not been compromised (if that page is compromised, the checksum could be changed to the new one). I have no idea how you would verify closed source software if the checksum and package are both corrupted...
- donutz 13y ago"2. The trusted sources should provide checksums so you can verify the package before installing it." If the checksum is published to another trusted location, in addition to where you download the files, that would help in the case that an attacker compromises both the checksum and the package on the download site. The developer could post the checksum to Twitter at the same time as making the package available for download. An attacker would need to compromise both Twitter and the download site.