Please create an account to participate in the Slashdot moderation system

 



Forgot your password?
typodupeerror
×
Bug KDE

Remember Autorun.inf Malware In Windows? Turns Out KDE Offers Something Similar (zdnet.com) 85

Long-time Slashdot reader Artem S. Tashkinov writes: A security researcher has published proof-of-concept (PoC) code for a vulnerability in the KDE software framework. A fix is not available at the time of writing. The bug was discovered by Dominik "zer0pwn" Penner and impacts the KDE Frameworks package 5.60.0 and below. The KDE Frameworks software library is at the base of the KDE desktop environment v4 and v5 (Plasma), currently included with a large number of Linux distributions.

The vulnerability occurs because of the way the KDesktopFile class (part of KDE Frameworks) handles .desktop or .directory files. It was discovered that malicious .desktop and .directory files could be created that could be used to run malicious code on a user's computer. When a user opens the KDE file viewer to access the directory where these files are stored, the malicious code contained within the .desktop or .directory files executes without user interaction — such as running the file.

Zero user interaction is required to trigger code execution — all you have to do is to browse a directory with a malicious file using any of KDE file system browsing applications like Dolphin.

When ZDNet contacted KDE for a comment Tuesday, their spokesperson provided this response.

"We would appreciate if people would contact security@kde.org before releasing an exploit into the public, rather than the other way around, so that we can decide on a timeline together."
This discussion has been archived. No new comments can be posted.

Remember Autorun.inf Malware In Windows? Turns Out KDE Offers Something Similar

Comments Filter:
  • Fixed yesterday (Score:4, Interesting)

    by Anonymous Force ( 6156298 ) on Sunday August 11, 2019 @09:36AM (#59076380)

    From Release AnnouncementsKDE Frameworks 5.61.0 [kde.org] :

    KConfig

            Security: remove support for $(...) in config keys with [] marker // b.

    • This is still a critical vulnerability as no user interaction is basically required and there's no way to disable this "feature" before your distro pushes an update (and some Linux distros are not exactly agile in this regard).

      • Re: (Score:3, Insightful)

        by v1 ( 525388 )

        although "disclosing" an exploit by handing it to the press is about as unresponsible as disclosure can get.

        Authors go from having 30-60 days to get a patch distributed, to having NO time. Forcing them to absolutely scramble to mitigate the damage is a real dick move.

        • by hey! ( 33014 )

          Of course *this* way you draw a lot more attention to yourself than if you allow the problem to be quietly fixed.

          • by raymorris ( 2726007 ) on Sunday August 11, 2019 @10:23AM (#59076486) Journal

            You're absolutely positively right. A few years ago I discovered a way to take down Wikipedia and other major web sites by sending a single packet. You wouldn't think you could take down a site hosted on multiple clusters, but there it was.

            The name of this vulnerability? Didn't need name. Didn't need a website. Just needed to be fixed. You won't find press articles about it, because it was handled properly.

            I contacted the project responsible for the vulnerable software. Their security team looked into it and within a day or two a fix was ready. The fix was deployed on major international targets such as Wikipedia. Later that day the team coordinated with distro maintainers such as Florian at Redhat to get the fix prepped in the distro update channels. After the update had been widely available for about a day it was time to explain what was being fixed.

            It garnered no attention for me, and as far as we know there were no victims, because we handled it right.

            I did get one benefit. Coincidentally, I had a job interview scheduled. The interviewer asked me if I had any experience with Ubuntu systems. I asked them if they get the Ubuntu security emails and asked them to look at the Ubuntu email that had been sent out a few hours before. The email from Ubuntu security began "Ray Morris discovered ...". The interviewer didn't feel the need to ask anymore about my Ubuntu experience. :)

            • I missed typing a few words. This:

              You wouldn't think you could take down a site hosted on multiple clusters

              Should say:

              You wouldn't think you could take down a site hosted on multiple clusters +with one packet+

              The packet caused the servers to start DOSing each other at maximum speed.

            • by epyT-R ( 613989 )

              attackers don't wait weeks or months for the vendor to respond, and if you happen to be the first to figure it out, you can pretty much guarantee that someone else with less savory intentions is right behind you. If your goal is to help, the best way is to release publicly ASAP because it gives users the most time possible to mitigate incoming attacks as well as force the vendor to prioritize a fix.

              The temporary "security through obscurity" of 'responsible disclosure' is a fool's game, and only works at all

              • > If your goal is to help, the best way is to release publicly ASAP because it gives users the most time possible to mitigate incoming attacks as well as force the vendor to prioritize a fix.

                That's not bad for a guess from a random reader of Slashdot.
                Not a stupid idea.

                Also doesn't happen to be right - I've been doing this full time for twenty years, so I've had the opportunity to see what actually happens in real life, many times.

                I will point out that your suggestion of releasing the information before

                • by epyT-R ( 613989 )

                  You're right, it does give kiddies access, but it also gives admins access too. The worst possible outcome is admins not knowing the hole is there when they're attacked by those who've decided to exploit the vulnerability themselves.

                  Depending on security through obscurity and vendor charity is foolish. If you've been working in this field as long as you say, you ought to know that. I remember the squabbles over full disclosure vs 'responsible' disclosure years ago. I'm not convinced the current consensus on

                  • by raymorris ( 2726007 ) on Sunday August 11, 2019 @12:23PM (#59076736) Journal

                    > I'm not convinced the current consensus on the latter benefits anyone but lazy vendors and those who want to capitalize on vulnerabilities

                    99% of those of us with any experience in the field are convinced.

                    One thing to keep in mind is that roughly 99.98% of attackers are script kiddies - they click to run a set of 10,000 prewritten exploits, they don't figure out any themselves. Those vast majority of bad guys exploit things AFTER public release often don't even know there is a new exploit added to the toolkit.

                    The immediate disclosure position depends on the argument that if there are a dozen people in the world who could theoretically find it, we should distribute an exploit to tens of thousands of bad guys.

                    • Ray has been way more patient with you than you deserve, but you just won't stop digging. Your first paragraph there doesn't even have anything to do with that he said.

                    • > Well then those admins aren't doing their jobs. They ought to be monitoring those public lists...oh right, they're all largely neutered now thanks to 'responsible' disclosure.

                      I think you mean that some admins don't do their job as quickly and recklessly as the very fastest script kiddie, who doesn't work 9-5.

                      > > we should distribute an exploit to tens of thousands of bad guys.

                      > Vs the knowledge remaining the exclusive domain of people who discover it

                      Yes, either only those who need to know actu

                    • by epyT-R ( 613989 )

                      that's because he didn't address what I said in the previous post.

                    • by epyT-R ( 613989 )

                      or it sits in an NSA database and is used for god knows what.

                      If you're an admin, don't you want to know where you're vulnerable, or are you going to trust that the vendor will look after your interests ahead of their own public image?

                    • by epyT-R ( 613989 )

                      ..and I'd still rather get an email from a vuln list on a monday morning than not hear about it for a few months when the vendor decides it's time.

                    • > If you're an admin, don't you want to know where you're vulnerable

                      I'd much rather wait 2-3 or three days for everyone to know that I used to be vulnerable, than to have everyone know that I *am* vulnerable.

                      You're not a sysadmin either, are you?

                    • > rather get an email from a vuln list on a monday morning

                      If you'd rather find out on Monday that you've been vulnerable, while all the bad guys found out on Saturday, and you won't have a fix until Friday, I'm going to guess you've never even *heard* the term TTC.

                      It takes *minutes* to *hours* for new exploits to be posted on the cracker forums. Once it's in Metasploit, unprotected AWS servers are, on average, exploited within MINUTES.

                      What you find out on Monday morning is that your company got utterly

                  • I'm not convinced the current consensus on the latter benefits anyone but lazy vendors and those who want to capitalize on vulnerabilities.

                    Immediate disclosure doesn't penalize lazy vendors and help responsible vendors, it hurts all vendors and all of their customers. This doesn't mean that disclosure timelines should be arbitrarily long, but they should be long enough that responsible vendors can get fixes out before the exploits get packaged up in the the kiddies' toolkits.

                  • Depending on security through obscurity

                    Relying SOLELY on security by obscurity is foolish. Relying on it forever is foolish. But in the short term, it's quite valuable. If there was nothing to security through obscurity, then every product with a flaw would have an attack in the wild the same day the product became available.

                    Of course, just handing it off to vendors and saying that's the end of it doesn't always work either. It's why, as v1 said above, responsible disclosure gives vendors an arbitrary time period (he used 30-60 days) to release

                • I will point out that your suggestion of releasing the information before any fix can be available *guarantees* that *everyone* using the software is vulnerable to every script kiddie on the planet. Obviously that's the worst possible outcome.

                  Users should feel the pain of using insecure software, so they are motivated to move to something more secure.

                  • I will point out that your suggestion of releasing the information before any fix can be available *guarantees* that *everyone* using the software is vulnerable to every script kiddie on the planet. Obviously that's the worst possible outcome.

                    Users should feel the pain of using insecure software, so they are motivated to move to something more secure.

                    How do they find that?

              • Bullshit, if the vendor is not responsive all you are doing is giving the keys to the kingdom to EVERYONE with bad intentions, instead of the one or two who may or may not be following in your footsteps. There was a huge leak of NSA exploits a while back, most of them never seen before but discovered years ago, which just shows that just because you found a problem doesn't mean someone is right behind you.

                I will bet you money that this WAS reported to the vendor (or shortly going to be) and someone else
                • by epyT-R ( 613989 )

                  During that time the NSA knew about it and likely got away using it because it was not disclosed. It's not guaranteed that someone else will figure it out, but it grows more likely with time, especially for holy-grail vulnerabilities that crooks and state-actors crave. Eventually, someone will use it, or, worse, has been using it all this time. Full disclosure forces earliest-possible resolution, either from the vendor, by admin mitigation/workaround, or by user migration from the broken software. The latte

              • attackers don't wait weeks or months for the vendor to respond, and if you happen to be the first to figure it out, you can pretty much guarantee that someone else with less savory intentions is right behind you.

                Right, Open Source makes it easier for everybody to find bugs, not just white hat hackers.

            • I did get one benefit. Coincidentally, I had a job interview scheduled. The interviewer asked me if I had any experience with Ubuntu systems. I asked them if they get the Ubuntu security emails and asked them to look at the Ubuntu email that had been sent out a few hours before. The email from Ubuntu security began "Ray Morris discovered ...". The interviewer didn't feel the need to ask anymore about my Ubuntu experience. :)

              Not the first time I read this from you here on Slashdot, and yet it still makes me chuckle :-)

              • Thanks for mentioning that. It's probably my favorite interview story. (I've done a few interviews).

                A few days ago an interviewer said they have several thousand machines, and asked what is the largest network I've had responsibilities for. "Well, there's Rackspace ...". I kinda wish that question had come AFTER I took the job with AT&T, which provides networking services to AWS and Google cloud. As far as I can tell, AT&Ts systems run not only the largest network in the world (AT&T itself),

        • by epyT-R ( 613989 )

          Do you think would-be attackers will wait simply because disclosure is a 'dick move'? Write better software and you won't have as much of an issue.

      • Sure ... and compare that to Windows where people pointed out this same kind of flaw and the response was "Not a bug - Will not fix." If the asshole who found this was a responsible discloser then eveyone who updates regularly would already have the fix on their system. None of us create bug free software. The issue is how bug discovery is handled. This asshole did it wrong, the KDE responded as appropriately as possible, and if you use a decent distro they will too.
        • None of us create bug free software.

          This is not a bug. It is a major design flaw. It is something that is so obviously wrong and stupid that it never should have existed int he first place.

          "When a user opens the KDE file viewer to access the directory where these files are stored, the malicious code contained within the .desktop or .directory files executes without user interaction"

          In what bizarro parallel universe does designing something like that even make sense?

          • Windows Explorer had similar bugs in the past. Opening a directory with specially crafted .BMP or .CHM (and I think, others, can't recall) caused embedded code to run. All you have to have is physical access to the machine, and in Linux' case, write permissoin to the directory and file. Kind of a tempest in a teapot sort of a bug.
          • Failing to check that a relative path spec doesn't go outside the current subtree is a bug. If you can show me the design specification where it says that the pathspec should allow such traversal then I will stand corrected, but you can't. Of course, you are the very type of idiot that thinks the code is the design and the first step to developing software is to fire up your IDE and write your first lick of code, so I can see how you wouldn't know the difference.
          • It is a major design flaw

            Because you have never built something that seemed a good idea at the time, but turned out to have a major flaw, because you don't code.

            In what bizarro parallel universe does designing something like that even make sense

            Well what do the files usually do? I doubt that they started out with "let's execute code".
            Looks like they were meant primarily as configuration files for the desktop and specific folders, hence the prefix . to make them hidden by default.
            I doubt the original des

        • by epyT-R ( 613989 )

          Not if the response was 'will not fix' after a 'responsible disclosure'. The userbase still doesn't know it is vulnerable and the vendor is not under as much pressure to fix it.

          • I see that you are unaware of how responsible disclosure works. Responsible disclosure does not mean you stay silent if the developers refuse to fix the issue. It means you give them time to respond appropriately first. The behavior you describe would be irresponsible. Once the team has responded with "will not fix" the terms of responsible disclosure have been met. At that point it is considered not only acceptable, but an obligation, to report the bug in order to pressure the team to fix it.
            • by epyT-R ( 613989 )

              Yes, I'm aware that's what's supposed to happen.

              • It's not "what's supposed to happen." We are talking about a definition of a security model. If the person discovering the flaw tells only the developer and never anyone else even if the vendor keeps it a secret then that by definition is not responsible disclosure. BTW I didn't pick up on it, but KDE already has a fix committed, so your statement "Not if the response was 'will not fix' after a 'responsible disclosure'." was stupid to make on its face. My post was about this particular issue. My statement w
                • by epyT-R ( 613989 )

                  No. We were talking about what impacts that particular security model has. Then people started getting personal. I said it's better to know sooner, even if would-be attackers find out as well. You disagree and would rather everyone fly on ignorance while the vendors (and possibly governments) dally about. You're welcome to your opinion.

                  • Bullshit. You tried to say that responsible disclosure doesn't work if there is never any disclosure. You made this assertion because you had no idea what it was and didn't realize it is an industry defined term. Then you tried to claim you weren't ignorant and knew exactly what the term meant, despite making it clear you had no clue what it meant by suggesting it was possible to practice responsible disclosure and never disclose. Just admit you didn't know and move on. Stop trying to pretend like you didn'
                    • by epyT-R ( 613989 )

                      I reread the thread. You're right. I misread part of what you said. I apologize.

                    • You sir are a gentleman and a scholar. I don't know anyone including myself who hasn't been wrong. I know few, however, who will ever admit to it. It is especially popular on Slashdot these days for people to go on and on with the most ridiculous arguments long after they have been proved wrong. I, for my part, apologize for my demeanour. As an explanation, but not an excuse, I have been dealing with an incredible amount of adversity that is the direct result of having to deal with many, many people who can
    • "We would appreciate if people would contact security@kde.org before releasing an exploit into the public"

      We would appreciate it if you wouldn't do things this stupid.

    • Hey buddy, I remember you from a previous article. Glad you continue to log in and contribute to the discourse :)

  • by drinkypoo ( 153816 ) <drink@hyperlogos.org> on Sunday August 11, 2019 @10:06AM (#59076454) Homepage Journal

    "We would appreciate if people would contact security@kde.org before releasing an exploit into the public, rather than the other way around, so that we can decide on a timeline together."

    Yeah, and users would prefer software that didn't have sophomoric mistakes like failing to do input verification, but we don't all get what we want, do we? What other amateur hour glaring mistakes are in KDE?

    • Look on the bright side; this is proof that Linux on the Desktop is finally catching up to windows. Just wait until KDE XP hits the shelves!

    • Give the scope of just how much of KDE is affected by it and for how long it has been, the benefit of doubt for this mistake goes to KDE for remaining undiscovered so long. Maybe the amateurs are security researchers?

      We can't all be perfect like you.

      • We can't all be perfect like you.

        This isn't about perfection. This is about easily avoided errors which don't happen at all if you use best practices.

  • by iggymanz ( 596061 )

    KDE is dying, distros are tossing it out, only one developer making daily commits last time I looked

    not pining for the fpords, it's shuffled off the mortal coil

    • KDE is dying, distros are tossing it out, only one developer making daily commits last time I looked

      Another crippling bombshell hits the KDE community. Netcraft confirms it, right?

    • If you think I'm switching to Gnome, you're out of your mind.
      • Eeewwwwwww, GNOME3 is infexlible garbage, it's why MATE forked off of GNOME2 and Cinnamon built on GNOME3 libraries.

        I wasn't saying anything about how good KDE is, by the way. I can see why some people like it. It's just not enough people are liking it.

        Anyway, plenty of other great desktops out there.

      • Try LXDE. It mostly resembles Gnome 2 and doesn't take up too much space.

  • How about the .profile in user's home directory - that gets executed upon login (or, better yet, .bashrc - on every shell launch), quietly and without any user interaction, on pretty much any Unix-like system. I mean, that's a giant security hole, amirite?

    • depends, what do the permissions on your .profile look like? Is it a chaste virgin with its legs crossed sitting behind its father wielding a shotgun, or is it a drunk whore lying on the floor of the Queens New York bus stop's men's room without knickers and it's legs spread?

    • A bounds checking failure in a shell would be news. Do you have one to report?

  • No news here (Score:4, Interesting)

    by Nabeel_co ( 1045054 ) on Sunday August 11, 2019 @12:09PM (#59076716) Homepage

    NO?! THE OPEN SOURCE COMMUNITY RELEASED SOMETHING THAT'S CRAP? YOU DON'T SAY...

    Listen, I don't think that OpenSource is bad, in fact I think it's really good.

    But the community is not healthy. Many open source projects lack polish and direction making them unusable for anyone other than the people most familiar with the software.

    Look at Audacity, VLC or almost any Linux distro. There is so much tribal knowledge, and so many layers of crap you have to go through. Because everyone wants to do it their way, there is no consensus, and no focus on polish or simplicity.

    Audacity breaks every normal paradyme for an audio NLE, VLC is half stuck between being a terminal utility and a GUI media player, and don't even get me started on Linux, or the beloved Ubuntu, riddled with stupid bugs, like not being able to change your hostname during the installer without causing problems once it's installed, or having to dig through 3-4 layers of configuration files to change one network interface.

    WHY? There is no need for any of that, but people just keep piling crap on top of crap, or breaking convention because they are too lazy or think it's too inconvenient for them to follow convention.

    It's problematic and is the key reason why the masses don't use open source software regularly, or donate to open source projects.

    Now, I know, I'm on Slashdot, and we love our open source software on here. But we're not the norm.

    Normal people can't be bothered to dig through three layers of config files to change a hostname or set an IP address, normal. people will tap space and expect their NLE to toggle between play and pause, normal people would expect VLCs conversion functions that are in the GUI it actually work, and not have to resort to using the terminal to use VLC when really all it does is use ffmpeg anyways.

    It's crazy and is holding our community back.

    What does this have to do with KDE? Well, if everyone stuck to a well established convention, then we wouldn't have weird flaws like this, because we'd all be using the same well tested conventions that has everyone's eyes on them, not just a niche group that prefer one thing over the other.

    It's like, open source is supposed to be about how people can work together to release and maintain something for free, because it's maintained by the same people who use it, and anyone can contribute.

    But what it really shows is how fragmented everything is, and how no one works together, fragments and forks everything until the point where you have 20 ways to do the same thing, all of which suck, and none of which have overlapping features being a situation where you're always splitting the difference and never truly happy.

    It's a shame, and we can and should be doing better.

    • Look at Audacity, VLC or almost any Linux distro. There is so much tribal knowledge, and so many layers of crap you have to go through.

      That's retarded. I was able to use both of them without any issues the first time I tried them. Hell, for YEAR my default response to friends, family, and random users on the net who were having issued playing media files was "install VLC". And the response 5 minutes later was invariably " wow, thanks!".

      If you think that using VLC requires "tribal knowledge" I suspect that there's still a VCR in your house flashing 12:00

      • Hahaha, so you're resorting to insults because you don't like what I said and can't challenge it with facts? Well done.

        If you don't know of the CLI only functions in VLC (which make up the majority of the features of VLC) you don't know VLC well. VLC effectively is a GUI tool, that 90% of it's functions are accessed via the CLI only.

        That's dumb.

        • Er. I responded with facts, and no insults. I said your argument was retarded, and then explained why. I didn't say that you are retarded ... though, thanks to your followup, I'm starting to lean in that direction.

          • That's retarded.

            I suspect that there's still a VCR in your house flashing 12:00

            Er. I responded with facts, and no insults.

            Oh, so I should think that these are compliments, and that they are your way of you suggesting that I'm highly intelligent?

            Well, let me try it your way: Go fuck yourself you assholish sack of shit. You probably don't have two neurons between your ears to be able to rub them together to start a fire. Stop wasting my air by breathing it, I need it more than you do.

            Am I doing it right?

            Oh, no, I wasn't insulting you, I was just saying I think your points are assholish and make you look like a peice of shit. Not

        • If you don't know of the CLI only functions in VLC (which make up the majority of the features of VLC) you don't know VLC well. VLC effectively is a GUI tool, that 90% of it's functions are accessed via the CLI only.

          So? It's plenty useful even if you do nothing with the keyboard, ever. Most people will only ever use it to play video files they have downloaded, which is fine. It's possibly the best single tool that there is for that. There is a related problem, though. The problem is, there's no help. The help option refers you to the Wiki. If VLC's only purpose were to stream from the internet, it would make sense not to have any help file. It isn't. It doesn't. It seems like they could easily distill the Wiki into a h

          • It's possibly the best single tool that there is for that.

            Sure, but that's not a particularly high bar.

            There where other closed source pay apps that did it better, but they aren't being maintained anymore.

            At the end of the day, VLC is just a GUI wrapper for ffmpeg, and not much of one at that, since so many things need to be done via the CLI.

            Like, what's the point? It's not 2005 anymore, and in Windows, the built in media player is good enough for 90% of the media that's out there.

            • There where other closed source pay apps that did it better,

              Name one.

              but they aren't being maintained anymore.

              Oh, how useful.

              At the end of the day, VLC is just a GUI wrapper for ffmpeg, and not much of one at that, since so many things need to be done via the CLI.

              By all means, make a better skin, and contribute it.

              Like, what's the point? It's not 2005 anymore, and in Windows, the built in media player is good enough for 90% of the media that's out there.

              Some of us don't want to run Windows, or even if we do, don't want to chase codecs.

              • Movist for mac os was pretty good back in the day.

                Listen, I'm not denying that VLC is useful, but it's by no measure a good application.

                It's likely the best one, but again' that isn't saying much.

        • If you don't know of the CLI only functions in VLC (which make up the majority of the features of VLC) you don't know VLC well

          Do you NEED them? Does the average user need them? I used to use VLC all the time, and I've never used any of the CLI features. VLC has its problems, but CLI options doesn't come close to the top.

          • That wasn't the point of my statement.

            It's need or uses isn't really the point, the point is that the majority of VLCs functions are uselessly complex for the average user.

            The only part that's simple in VLC is that it autoplays a file that gets opened with it.

            But try using any of the other functions, like conversion, or streaming, or transcoding, and you're going to have a bad time.

            In some cases, yes, you do need the other features. If you every try to do a batch convert of some media files, it will fail if

    • by Tom ( 822 )

      Normal people can't be bothered to dig through three layers of config files to change a hostname or set an IP address,

      Normal people don't set IP addresses :-)

      Also, have you seen the maze you need to navigate to get to some configurations in Windows? Not to mention the abomination that's called the Registry?

      I do agree with some of your points, but the configuration especially on Linux is far, far ahead of anything that windows offers.

      • I mean... You're right, Window's network settings are way too convoluted. But at least it auto-configures when you plug in a new NIC.

        Last I set up Ubuntu Server, I went straight for /etc/network/interfaces, just to find out that it's configured by another service...

        When I finally found that services config file, I found out that it's configured by another service too. Three layers of config files later, I was able to configure my NIC, and whenever I googled it, the answer was "just use /etc/network/interfac

  • by OneHundredAndTen ( 1523865 ) on Sunday August 11, 2019 @12:52PM (#59076788)
    The problem with KDE and Gnome is that they are trying - and failing miserably - to elevate Linux in the desktop by imitating Windows as closely as they can. In this case, creating security weaknesses. With such desktop flagships, no wonder has Linux been spinning its wheels in the desktop, and chances are it will carry on doing so. Their saving grace: by attempting to out-Windows Windows, thus guaranteeing that Linux will not become the choice of the masses in the desktop, KDE and Gnome are allowing those of us who use other options in the Linux desktop to have a convenient and secure desktop system, while being, for the most part, disregarded by malware creators. Keep it up, KDE and Gnome! Linux in the desktop needs you, although not in the way you would like.
    • by Tom ( 822 )

      Many people have been saying that for years. Especially about KDE, which is basically a windows copy. Gnome at least had the guts to here and there have its own ideas.

      It is rare that someone conquers a market by copying the market leader, and when it happens it is usually because of superior marketing budget. Whoever thought that making Linux like windows would make it appeal to more people didn't understand why people are using Windows - or Linux - in the first place.

      But, as I said, lots of us have been sa

    • Comment removed based on user account deletion
    • by dargaud ( 518470 )
      I have no idea what you are talking about. KDE may have originally copied Windows (2000?) but the point is that Win10 has gone way past usability for me. Opening the file explorer has heaps of virtual folders that point to worthless things (One Drive ? Saved Games ? 3D objects ? WTF are those ?), often looping on themselves. Grey on white interface buttons with no borders (is that text or clickable ? your guess). Tons of uninstallable crap (Cortana, *vomits*). Important menus that are next to impossible to
  • Zero user interaction is required to trigger code execution — all you have to do is to browse a directory

    Strange definition of zero user interaction.

    It still assumes a system with a GUI desktop running KDE and that user browsing a directory containing files not under his or her control. Such file must be placed on the system in the first place too, requiring the user for example to download it or mounting a device like dvd or usb key. I'd say for all those things to come into play a user is needed.

  • Now I can enjoy one extra feature Windows has!

  • This is poor behavior by the researcher, for an open source project they should have let them know first - instead of keeping it around so they can yuk it up with their friends at Defcon.
  • Comment removed based on user account deletion
  • "Just" requires a user to download an odd file, or possibly a ZIP file and unpack it - Most modern KDE distributions have trained users to not do this as software is so much simpler to install from a repository ...

Wherever you go...There you are. - Buckaroo Banzai

Working...