<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7650.28">
<TITLE>RE: wineboot: Start items in StartUp folder on boot, includes security measures.</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<P><FONT SIZE=2>Well, that is what I thought too, I sent out another patch that does not have these anti-security measures,<BR>
but there were a lot of responses about them being necessary and someone marked the bug report as WILLNOTFIX.<BR>
Anyhow, both patches have been sent to wine-patches and also are available in the bug report #7384, so<BR>
I think Alexandre can choose one or the other. Anyone have any comments about the IShellFolder code or jus<BR>
want to check it over and give me a yay or nay? It works for me, but I just wanted to check with an expert.<BR>
<BR>
Misha<BR>
<BR>
-----Original Message-----<BR>
From: James Hawkins [<A HREF="mailto:truiken@gmail.com">mailto:truiken@gmail.com</A>]<BR>
Sent: Sun 2/11/2007 4:09 PM<BR>
To: wine-devel@winehq.org<BR>
Cc: Koshelev, Misha Vladislavo<BR>
Subject: Re: wineboot: Start items in StartUp folder on boot, includes security measures.<BR>
<BR>
On 2/11/07, Misha Koshelev <mk144210@bcm.tmc.edu> wrote:<BR>
> Ok, thanks to everybody's responses on the wine-devel list. Here is my<BR>
> new version of this patch. It starts the items in the StartUp folder<BR>
> like Windows does (again, if anybody who knows about IShellFolder will<BR>
> look over my code that would be great :) I tested it and it works for<BR>
> the Vector NTI installer, but I would really like to have an expert's<BR>
> opinion on whether it is missing osmething). There were a lot of<BR>
> comments on wine-devel about malware using this system to start itself<BR>
> so here is what I added:<BR>
><BR>
> - When wineboot finds a file that it wants to start in the StartUp<BR>
> folder, it asks the user whether he wants to run the program. His<BR>
> options are: Always, Yes, No (default), and Never.<BR>
> - If he selects Yes the program is run, if he select No it is not.<BR>
> - If he selects Always or Never, I create a registry key in:<BR>
> HKEY_CURRENT_USER\Software\Wine\StartupItems with the full pathname<BR>
> of the program and the value "always" or "never." When wineboot sees<BR>
> this program in the StartUp folder it checks this key, and if it is<BR>
> set it performs the appropriate action.<BR>
><BR>
> To me it seems like this would be enough to prevent malware from using<BR>
> this system because the user could just click no or never. Also, someone<BR>
> pointed out that wineboot already runs quite a lot of other RUN registry<BR>
> keys that can be used for malware, and currently there is no system for<BR>
> these keys like the one I made for startup. Any comments will be<BR>
> appreciated. Thanks.<BR>
><BR>
<BR>
These anti-malware changes are unnecessary. We implement Wine to be<BR>
bug-for-bug compatible with Windows. Windows doesn't ask this<BR>
question, and Wine shouldn't either. It's not our policy to not<BR>
implement portions of Windows that make it easier for malware to run.<BR>
<BR>
--<BR>
James Hawkins<BR>
<BR>
</FONT>
</P>
</BODY>
</HTML>