Re: Security leak: Public disclosure of user data without their consent by installing software via pkg

2021-04-09 Thread Johannes Meixner
This is getting tiresome. Please have a look the relevant handbook passage before shitpoasting on a security mailing list. At https://docs.freebsd.org/en_US.ISO8859-1/books/porters-handbook/pkg-install.html you can find strongly worded notes on this topic. Important: This script is here to hel

Re: Security leak: Public disclosure of user data without their consent by installing software via pkg

2021-04-09 Thread Kyle Evans
I won't try to address everything you've said, but here's some thoughts that came to mind as I read this: It's been acknowledged that this is doing something that an install script really shouldn't be doing; while there's no written policy (maybe, I haven't looked again) there's definitely at leas

Re: Security leak: Public disclosure of user data without their consent by installing software via pkg

2021-04-09 Thread Stefan Blachmann
The deeper-lying problem is the almost complete lack of policy what is allowed and not for installer scripts. And the complete lack of policy what to do in case of violations, no matter whether intentional or not. Other appstores (the pkg system is de facto an appstore) have policies that are bein