Hi, * Michael Gilbert <[email protected]> [2011-02-14 13:03]: > Just curious whether we should follow Microsoft's [0] and Ubuntu's [1] > lead and make it a policy to disable desktop autorun options by default. > Note that this was one of the flaws that allowed stuxnet to propagate to > network isolated machines. > > So far, I've only checked xfce, and it has autorun enabled by default. > If there is consensus that this would be a good thing, then I'll start > submitting bugs.
Would be a good thing, definitely. > Not sure if it would be worth pushing this in a point > update for the stable releases also? Doesn't require DSAs and should've happened before the release. This is something for the next point update imho. Cheers Nico P.S. Highly recommended kind of related talk: http://www.shmoocon.org/speakers#usbautorun -- Nico Golde - http://www.ngolde.de - [email protected] - GPG: 0xA0A0AAAA For security reasons, all text in this mail is double-rot13 encrypted.
pgpGLavzrz3DK.pgp
Description: PGP signature
_______________________________________________ Secure-testing-team mailing list [email protected] http://lists.alioth.debian.org/mailman/listinfo/secure-testing-team
