User avatar
🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca
3w
Second update: Yes, this is pointless security theatre. Any addon can download and execute remote code. So even if you do all of the work I mentioned, unless you audit the code, you still have no idea if the addon is safe or secure. This just gives users a dangerously false sense of security. The only way it would be meaningful is if NVDA code signs all addons, disables remotely downloading files, and only allows approved addons through the store. And doing this would be far, far worse than the alternative. It would mean, for one, that Eloquence would be completely dead as an NVDA addon. NVDA doesn't allow it in the addon store, and thus wouldn't sign it.

Update: it looks like the outreach to virustotal.com in my firewall logs was unrelated to NVDA. Based on a look at: github.com/nvaccess/nvda/blob/master/source/addonStore/models/scanResults.py

NVDA just accepts whatever the addon manifest says without verification. So instead of a privacy violation, this is just pointless. I can put whatever I want there in my addons, and it'll reassure the user that no viruses were found. To actually know the truth, a user has to:
* visit the URL
* hash there addon
* compare the hashes

And only then can they know if the results in the virustotal URL they visited are the same ones for the addon they installed, and that the information in the manifest is correct based on the actual virustotal.com findings.

By the time you do all that, either Windows Defender has flagged the virus, or you're already screwed.

I guess I'd rather pointless security theatre than privacy violation, if I have to choose. But can't I have neither?

It looks like in the latest alphas, it's now sending all of your addons to be scanned by VirusTotal. I did not give permission for this, and I do not want this. How long until NVDA stops addons it doesn't approve from running at all? For now I have virustotal.com blocked at the router. There seems to be no other way to block this.
'scanResults': {'scanUrl': 'www.virustotal.com/gui/file/2a83b713e38596cfbcb3f98b5eb91530ddfd0e9319907c6119cbbbe08f7acc88', 'malicious': 0, 'undetected': 67, 'harmless': 0, 'suspicious': 0, 'failure': 0, 'timeout': 0, 'confirmedTimeout': 0, 'typeUnsupported': 9}}
Traceback (most recent call last):
File "addonStore\models\scanResults.pyc", line 31, in fromDict
KeyError: 'virusTotal'
9
13
4
0
User avatar
James Scholes @jscholes@dragonscave.space
3w
@fastfinge
The only way it would be meaningful is if NVDA code signs all addons, disables remotely downloading files, and only allows approved addons through the store.
Such checks could arguably be meaningful for the Add-On Store even if they were limited in scope to only apply to the Add-On Store.

As in: if downloading from the Add-On Store, you could trust that NV Access had done X, Y, and Z in the interests of security. If you chose instead to bypass the store or install from a different one, that would be entirely on you and come with an appropriate set of warnings.

Frankly it could be an inappropriate set of warnings as long as it was still possible.

@alexhall
1
0
0
0
User avatar
🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca
3w
@jscholes @alexhall But that’s never, ever what happens. As soon as any infrastructure exists to stop you running code they can’t control they always use it to stop you doing things they don’t like. In the name of security, of course.
1
0
0
0
User avatar
James Scholes @jscholes@dragonscave.space
3w
@fastfinge I can't argue with you on the basis of history. You've been proven right time and time again.

However, I would like to hope that on this occasion, @NVAccess and the community will be willing to discuss and avert these concerns. Rather than assuming the worst and then being angrily smug when it comes to pass.

@alexhall
1
0
0
0
User avatar
🇨🇦Samuel Proulx🇨🇦 @fastfinge@interfree.ca
3w
@jscholes @NVAccess @alexhall The best way to avert the issue is to make infrastructure decisions that don’t allow it to happen. With a little thought that’d easily be possible. But slapping a virus total scan that can’t be helpful doesn’t demonstrate the kind of thoughtful approach needed.
0
0
0
0