Comment 5 for bug 1393612

Revision history for this message
Martin Pitt (pitti) wrote :

Removing package for now, as it's not at all clear how to design this (at least udev is way too low in the stack to even potentially ask the user anything).

I'm very sceptical of these approaches. Experience shows that popping up dialog boxes with security related questions à la "are you sure that ..." are at least annoying and rarely productive. And on a server you usually don't even have a way to interactively ask the user anything on hardware changes.

If there is a way to detect "malicious" USB devices in some way, we absolutely should do that, but as versatile as they are, USB devices can do pretty much anything. They could act as an audio device to record what you are doing, as a network device to re-route traffic, or as a malicious keyboard (but that's not even the worst IMHO, as you then usually see that something funky is going on and yank it out again).

It's nothing new at all that malicious hardware can exist and that hardware always trumps software in terms of trying to keep each other in check :-)