Re:Pwning coworkers thanks to LaTeX
by saint_fiasco on Tuesday November 29, 2016 @09:52AM
(#13063328)
Malware writers might take advantage of your trust for your coworkers and spread their viruses as email attachments from trusted (infected) sources.
It's like Office macro viruses but for nerds.
Yes, but that's not a problem for LaTeX specifically.
This is being a bit paranoid, but do your colleagues pgp sign their messages? How do you know it is really coming from them?
Fair point. I mean, I do sign with PGP when I have someone's key but this often runs into trouble with spam filters or people going "I lost my key" or "I want to read it in the train and I don't have my privkey on my mobile device". So it's a valid point.
You don't need to encrypt it, just sign it - no privkey required to read a signed message, and you don't need someone else's pubkey to do so.
Of course it won't help if your coworkers don't also sign things they send to you.
and how do you know your colleague is not a spy, or a double agent, or an advanced AI seeking to take down the human race ... /paranoia
Re:Pwning coworkers thanks to LaTeX
by saint_fiasco on Tuesday November 29, 2016 @09:57AM
(#13063370)
Or just has an email client that got infected with a virus. Remember Office macro viruses? How we laughed at how stupid it was that a simple word processor apparently needed vulnerable turing-complete macros?
Now we actually compile source files into documents and get surprised that someone might trick you into running malware.
If a colleague sends me something to review, I trust that he doesn't want to hack me. Someone can always use physical access to capture my keystrokes in some way.
> doesn't mean it's not genuinely exploitable
Agreed, so the message should be "don't run random LaTeX files from the internet or classmates or something", not "oh hey look at me annoying colleagues at work".