I don't want to start yet another discussion about profanity or
obscenity here.

When I learned this afternoon that hacks (i.e. FlipText) which are
enabled in a default installation and eventually get run because
random mode is selected as default, I was quite upset for two reasons:

* Users do not generally expect a screen saver to cause network
  traffic. Even in 2005 there are still Debian users whose network
  connectivity is non-broadband and/or metered by volume or time spent
  online for whom xscreensaver's default behavior may cause
  "interesting" surprises. Just think of laptops with GSM or UMTS
  modems for a non-third-world example...

* I haven't looked at the mechanisms used by xscreensaver-text to
  fetch content from URLs at all, but the security implications of a
  potential error in the code that retreives untrusted content from
  the net don't exactly cause a warm, fuzzy feeling.

Please consider changing the default behavior as follows:

1. Provide a short file /usr/share/doc/xscreensaver/README.textmode in
   which contains a concise description on the available options.

2. Change the app-defaults files so that either this file
   (*textMode: text?) or maybe just a pointer to instructions
   (*textMode: string?) is displayed per default.

Alternatively, modify xscreensaver-text to provide a more helpful
message if it can't find the binary (fortune per default) it is
supposed to call.

If you want me to provide a tested patch against the package in sid,
just drop me a line.

Thanks for listening.

Cheers,
-Hilko


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Reply via email to