On 05/11/2011, at 18:24, Leon Kaiser wrote:
The flagrant disregard for his userbase is disgusting! I just uninstalled calibre.
sudo apt-get remove calibre
The comment and "patch" you posted shows you clearly did not read the comments in the bug report.
Ubuntu has already had the bug fixed, because they use a safe udev-based hook. The vulnerability only applies to
those who have installed Calibre from source. So "apt-get remove calibre" is a pretty naïve comment to make, but you
couldn't resist the bashing, could you?
The reason why he's reinvented the wheel writing the insecure calibre-mount-helper daemon is because there is no
platform-agnostic solution for auto-mounting.
Modern Linux distros need a udev hook, older ones need a HAL-based hook, BSD needs HAL, and who knows what everyone
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/