Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I just found out about xinput and how it proves any gui's running on the same x-session can sniff each other.

Is there a support team for each app included in the Ubuntu repo's that checks for sniff code? I can imagine there must be specific libraries and commands in respective languages in the source that would identify sniffing attempts.

If we are protected from these sort of apps for the most part, the only other thing I can think of are networking apps. For example, scripts that may launch inside of Firefox that ships with Ubuntu. Does the end user have to install a Firefox add-on to actually get a sniffer inside of Ubuntu or could just some script from a webpage inject sniffing of the x-session? Or both?

Should we be concerned with torrent programs such as Transmission or Deluge?

Is there anyway to log processes that are getting keyboard, mouse, x-screen events to know what is paying attention?

share|improve this question
2  
Question is unclear: are you asking if there are malicious applications in the repo, or whether it is possible for an application to monitor your input? –  psusi Feb 22 '12 at 18:25
    
This is one reason your concept of running some apps as root (when they're not intended for it) will not get you any more security. –  poolie Feb 22 '12 at 21:13
    
@poolie, what? That made no sense. –  psusi Feb 22 '12 at 21:28
    
psusi, see askubuntu.com/questions/104923/… –  poolie Feb 23 '12 at 0:04
    
@psusi. Either interpretation is useful. –  bambuntu Feb 23 '12 at 4:00

1 Answer 1

up vote 1 down vote accepted

The Ubuntu wiki page on Repositories states:

Repositories make it very easy to install new software onto Ubuntu using an Internet connection, while also providing a high level of security, as each program available in the repositories is thoroughly tested and built specifically for each version of Ubuntu.

You won't have to worry about Transmission or default shipped apps.

By default the system ships secure. With any system running malicious code as root could compromise you.

Be wary of what untrusted apps you install, but in general open source is safe in the face of "many eyes", public code reviews lend a certain level of trust to the system. But you should also be aware and know better than to run flakey software. If unsure, ask on forums or friends, (Ubuntu Forums).

See the "Adding Other Repositories" section in that wiki page for outside sources. Sometimes it's not easy knowing what is safe, so ask your peers.

This brings up a well known problem with proprietary drivers, without the source how do we know what it does? A great example is that of the Sony rootkit scandal: if a large, 'trusted' corporation does it, any other mega-corp (TM) can too.

As far as scripts / add-ons in your web browser goes: A good rule of thumb is: less is better. Opt for script blockers like NoScript. A technique called Sandboxing runs your browser processes isolated from the host OS, to separate local resource from potential threats. Chrome does this by design, for Firefox you can use some tricks to make it sandboxed AFAIK, but you will have to do research on this to understand how and why.

share|improve this answer
    
Indeed, Ubuntu uses Launchpad for it's packages where code is reviewed, and see MOTU too. –  invert Feb 23 '12 at 15:56
    
As far as privacy issues go with Google, it's not much part of your question, but see this article: "If we really wanted privacy, we would turn off JavaScript, block ads, and browse in privacy mode through an anonymous proxy. But we would rather have free services." –  invert Feb 23 '12 at 15:57
    
I think most of the question has been answered, except whether or not a browser can produce code that sniffs x-session windows. –  bambuntu Feb 23 '12 at 16:41
    
Short answer: Yes. Long answer: Javascript and browser add-ons can all capture browser keystrokes. This goes for all platforms, Linux or Win or Mac. It's the price for feature-rich browsers. It comes down to what sites you visit, what add--ons you installs, and using your own judgement. –  invert Feb 24 '12 at 9:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.