F15 Why does gnome-shell automatically start Adobe acroread updater? (malware?)

[Darryl L. Pierce]

On Mon, Jul 11, 2011 at 05:13:27PM -0400, Deron Meranda wrote:
> > What I'm failing to see is how this is a failing of Fedora. You
> > installed a non-Fedora package on your system (AdobeReader is not a part
> > of Fedora) and it is that non-Fedora package that appears to be doing
> > things in the background on your system. You can blame the distro for
> > compromising your system when you were the one who circumvented the
> > trusted packages list and installed something else.
> 
> 
> Thanks for the info about xdg.  I was unable to find that on my
> previous searches, and it doesn't show up in the graphical Gnome
> preferences.
> 
> Sorry, I didn't mean to blame the distro; you're right, this was a
> third party package problem. ... Except that the Gnome 3 shell doesn't
> provide any feedback or information that it will run things in the
> background, nor is there any apparent method of listing those things
> (from the default install anyway).

Look at it from a usability point of view. See that list of apps in the
gnome-session-properties app? How distracting/obnoxious/cluttering would
it be for Gnome to tell us about every single one of them starting? I
can't think of a way for it to notify the user about each of them
without being a PITA.

> I do blame Adobe though.  Yes, I contemplated very long very before
> installing acroread because I do try to keep my system extremely pure
> .. but alas, the needs to fill out tax forms nudged me over.  But
> Adobe to their failing did not notify me that their software would
> periodically attempt to download and install software on my system
> without my knowledge.  Bad on them.

Yeah, but it's SOP. The Windows version does a (just about every day)
download of updates for Adobe. Really, you'd think by now they could get
it stabilized, right? :)

> Concerning Fedora.  This could perhaps be partially guarded against if
> there were an SELinux context into which I could label the "foreign"
> software -- that would prohibit it from accessing the network, or
> running scripts out of /tmp.  Is there such a type label that I could
> chcon /usr/local/bin/acroread ??

That I don't know.

-- 
Darryl L. Pierce, Sr. Software Engineer @ Red Hat, Inc.
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
Url : http://lists.fedoraproject.org/pipermail/users/attachments/20110711/5869a0e3/attachment.bin