Novell goes for the desktop [LWN.net]

Novell goes for the desktop

Posted Mar 17, 2006 3:19 UTC (Fri) by paulmfoster (subscriber, #17313)
Parent article: Novell goes for the desktop

Oh what could be better than allowing the same kind of technology under Linux with which hundreds or thousands of script kiddies and crackers managed to infect millions of Windows PCs, namely Word macros? A few years ago, there was an effort to build a centralized configuration repository for *nix, a la the Windows registry.

Can we please stop chasing Windows and Microsoft?

(Log in to post comments)

security issues with macros

Posted Mar 17, 2006 10:17 UTC (Fri) by kingdon (subscriber, #4526) [Link]

My thoughts too. This is probably fixable, though.
There needs to be some distinction between "installing
software" and "opening a document", with the former
needed to run the macros (no, I haven't thought hard
about how this should be done, but the concept is
something we've seen before on the Linux desktop -
for example in terms of whether to autorun a program
on a CD when it is inserted). Even a dialog box
saying "this document contains macros? do you want
to run them?", which might not be the ideal user
interface, would still be better than nothing.

In addition, or instead, there might be an issue
of sandboxing the macros somehow (I don't know
enough about how they work to comment intelligently
on how feasible that is).

security issues with macros

Posted Mar 17, 2006 13:38 UTC (Fri) by eru (subscriber, #2753) [Link]

Even a dialog box saying "this document contains macros? do you want to run them?", which might not be the ideal user interface, would still be better than nothing.

I guess you have not looked at the real MS Office recently... It has precisely this kind of dialog. (I am not entirely sure if it is enable by default, or comes from local default settings used in the company I work at). Anyway, it does not seem to help security much. So many spreadsheets flying around in the company (I suspect in most other companies as well) have macros that people click OK at the "execute the macros" dialog automatically. So it is totally useless.

What is really required is having the macros execute only within a tight securiy sandbox, where they cannot modify anything except the document they are part of. This would be OK for most uses of the MS Office macros. I don't know if Novell plans to do so, but anything else will import the MS Office macro virus nighmare to Linux.

Novell goes for the desktop

Posted Mar 23, 2006 13:20 UTC (Thu) by Wol (guest, #4433) [Link]

I doubt you've got that much reason to be worried. Let's take the WordPerfect example (which I think may have been owned by Novell at the time...)

They added VBA support, and said they were planning to drop PerfectScript - well PerfectScript is, I think, still in the new version of WP I bought a week or two ago. And I believe it is still preferred by most users over VBA :-)

People who need VBA will use it, people who don't need it and people who know better will avoid it. Think of it as a legacy feature - we need it for compatibility with LegacyOffice, but as soon as LegacyOffice looks like it's joining the dodo where it belongs, VBA support will die with it.

Cheers,
Wol