Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror

Comment Mistakes and security flaw (Score 2, Informative) 171

Hello there,

I've just posted a review and a comment at my site (translation) where I point that Adobe makes an amateur mistake, by installing all AIR files as the user who launched the installer, despite the fact that it asks for root access via gksu (a graphic sudo replacement). This makes the user owner of the files "AIR root", letting him able to compromise AIR Apps to all users of the system (either voluntarily or by a virus for example). This goes against all security policies I've ever seen. System wide programs must be read only to every one, except for root, which is a user that "is just meant not to be used".

I also pointed at my site to at least two packaging mistakes: broken dependencies and garbage after uninstall.

I wonder: why in hell they have to make that annoying Windows-like installer, more vulnerable to this sort of error, than simply give a package and a software repository? Or at least give direct access to a "traditional" RPM or Debian package... Doesn't they know the KISS rule?

Hope this sort of stuff does not happen when it comes to be final.

Slashdot Top Deals

"Plan to throw one away. You will anyway." - Fred Brooks, "The Mythical Man Month"

Working...