A remote code execution vulnerability in GNOME [LWN.net]

A remote code execution vulnerability in GNOME

Posted Oct 12, 2023 6:10 UTC (Thu) by Wol (subscriber, #4433)
In reply to: A remote code execution vulnerability in GNOME by mjg59
Parent article: A remote code execution vulnerability in GNOME

The problem here - baloo and friends cough cough - is half the time the user has no clue what the indexer does, and the other half of the time the user has no use for the indexer's output!!!

You'd have thought they'd have learnt from the KDE4 debacle rendering large numbers of computers "unbootable". 36 hours and counting for getting to desktop from the login screen isn't a big enough hint?

Cheers,
Wol

to post comments

A remote code execution vulnerability in GNOME

Posted Oct 12, 2023 7:33 UTC (Thu) by mjg59 (subscriber, #23239) [Link] (2 responses)

I have both an idea of what it does and a need for it. But why should someone need to understand software to benefit from it? I have a poor understanding of what a DOM is, but I'm still happily using a browser. Should indexers be both poorly sandboxed and written in unsafe languages? No. Does that mean they shouldn't exist? Also no.

A remote code execution vulnerability in GNOME

Posted Oct 12, 2023 11:46 UTC (Thu) by Wol (subscriber, #4433) [Link] (1 responses)

No I'm not asking that a user should understand software that they are using.

I'm saying "please don't hand the user a chainsaw - UNASKED FOR - when they never cut wood".

I think KDE was unusable on my system for maybe six months, before someone said "put -semantic-desktop in your make.conf" and bingo! Things worked again!

My current system, I use xosview and it tells me I have four cores ... (I think that is four unthreaded cores). When I log in, cpu load typically hits 10, 14, for maybe 5 mins, and the system is horribly unresponsive. I really ought to put -semantic-desktop back in to make.conf. And when I asked what semantic-desktop did, I was told "oh, it makes kmail run faster". A program I don't use - I use TB.

I don't care whether indexers are sandboxed. I don't care whether they are written in safe or unsafe languages. I don't care whether they exist or not. But I DO care when they eat my CPU cycles, waste my time, endanger my computer, and they're so badly documented it takes me six months to find out that they're the problem I'm trying to track down!!! Plus the benefits I get in return aren't worth the electrons they're written with!

Cheers,
Wol

A remote code execution vulnerability in GNOME

Posted Oct 13, 2023 10:30 UTC (Fri) by sandeep_89 (guest, #127524) [Link]

Yes I had the same problem. Kept drainingy laptop battery, heating up the laptop and slowing it down. I masked and disabled the damn thing. Same for baloo, Windows Search Indexer.

Useless badly written plagues that act like our one computer is Google or the NSA wanting to index everything.