Security Risks and Human Nature [LWN.net]

Security Risks and Human Nature

Posted Apr 7, 2006 19:19 UTC (Fri) by smoogen (subscriber, #97)
In reply to: .desktop files and security by th0ma7
Parent article: .desktop files and security

In the end, there are always trade-offs between security and usability... and trying to figure out where you havent just loaded your double barrel shotgun and aimed it at your crotch can be a lot harder for people because humans have myopic vision of wanting to get stuff done.

Humans also have horrible risk assessment skills. Many of us verge on climbing into the hole and welding it shut, and an equal many do not see the risks until after they have 'survived and gotten stronger, or didnt survive and doesnt matter'.

Trying to figure out the middle ground is the hard problem that we have to realize that people on both sides arent going to be happy with.

(Log in to post comments)

Security Risks and Human Nature

Posted Apr 10, 2006 19:04 UTC (Mon) by jmorris42 (subscriber, #2203) [Link]

> In the end, there are always trade-offs between security and usability...

Granted. But this one is simple to decide as soon as it is described. We have a file that can appear as anything it wishes to inside the graphical environment as both the icon and caption text being totally decided by the .desktop file itself, while the user has little or no way to discover what it will do when activated other than actually activating it or dropping to a command line and invoking less on it. But it can do absolutely anything it wants with the full execution rights of the user without requiring any privleges other than to be readable. So just what is the point of retaining the execute bit in file systems if this stands?