On 8/2/07, David Gerard <dgerard(a)gmail.com> wrote: Only mostly rubbish: People can, and have, externally linked to malicious software from our sites. Of course, that can happen anywhere on the net and users (and their browser software) should be smart enough not to execute such code, but Wikipedia looks rather respectable so people may be more inclined to bypass security measures based on something on our site. At the moment there are 209 external links to .exe files from the main namespace of English Wikipedia. I don't think we should worry about malicious software specifically. Instead view any external link to malicious code as part of the larger problem of weak oversight of external links. A while back I ran clamav against all 'executable' looking external links and found one nasty file. It would be really nice if the mechanism that updates externalinks table spat out a running log of external link additions and removals that we could hook an ongoing scanner into. It's also possible to rename malicious content as one of our accepted formats for upload and upload it. If you client will execute an 'exe' renamed to 'ogg' and sent with the Ogg mime type your client is broken, but broken clients do exist. I do not recall ever seeing an example of something malicious distributed that way on our sites.

On 8/2/07, David Gerard <dgerard(a)gmail.com> wrote: We do. And if it doesn't match what we think it will be... we put a notice that no one notices on the image page. Example: http://commons.wikimedia.org/wiki/Image:Edvard_Grieg_-_03_-_In_The_Hall_Of_… (that file is an mp3 renamed to ogg, normally I just transcode all these but I've left that one sitting around because the copyright status on it looked suspect) There is a constant slow stream of misnamed files that come in.... every few months I hit one and get a wild hair to go convert or delete all the ones on commons and enwiki. I've found some weird stuff, even suspicious, but not yet something which I am confident was malicious. [[User:Gmaxwell]] gets bored and takes a pushbroom it it once a year is not a scalable method of handling this stuff. Even if we had the more aggressive filtering that you thought we had the risk of such files would remain. For the most part the handlers for the formats we do support tend to be pretty robust, internet grade stuff though..

Gregory Maxwell wrote: That's incorrect. If the detected filetype doesn't match the defined filetype for the extension, then the upload is rejected. (However note that at this moment we don't have very solid detection for OGG.) The warning on image pages about malicious code is bullshit -- we should remove it, since it has nothing to do with reality. Greg, don't be afraid to pop things into bugzilla or work with us over in SVN to fix things up. :) -- brion vibber (brion @ wikimedia.org)

Gregory Maxwell wrote: [snip] Let's conduct this discussion on bugzilla instead of the Wikimedia Foundation list, maybe? :) -- brion vibber (brion @ wikimedia.org)