[tialaramex]

I don't know about the BSDs but in Linux the reason is that a volunteer (in principle it could be a paid employee, I guess maybe it is for RHEL etc?) decides what gets installed

It is absolutely possible that when you plug in an LG display it installs and runs software on your Linux system†, just that rather than "Somebody at LG who earned a bonus" the decision maker was Sara in Portugal who fat fingered a change when trying to make a Python script for a PCI digital TV receiver work properly on 32-bit.

It does feel more like an amusing mistake in that case whereas even if LG tells us it's a mistake we know it was to earn $$$.

† Obviously YMMV but such "plug and play" features are commonplace because they're useful

[microtonal]

I have absolutely no clue what you are talking about. There is no mechanism in standard Linux distributions to automatically download software from a vendor when you plug a device (apart from firmware updates through fwupd, but those are curated).

So perhaps you could elaborate?

[tialaramex]

> no mechanism in standard Linux distributions

Now, when I first ran Linux in the mid-1990s, this was true. "Plug-and-play" is just peaking over the horizon. Other systems have had it for years (the Amigans for example) but for the PC it's pretty new.

But today a whole lot of mechanism is spun up when the kernel realises something new was added. A netlink socket talks to a udev daemon, in userspace and that daemon, being ordinary userspace software can do whatever it wants including of course run a bunch of arbitrary shell scripts, which can in turn do whatever they want. So yes of course they could download arbitrary software, or delete all your files with a Z in their name.

> from a vendor

Where the Adware comes from is of no consequence to the end user. "Um actually, the file came from Microsoft's servers" is irrelevant.

[Speaking more specifically of fwupd, which is ultimately fed by hardware vendors directly]

> but those are curated

I'm sure Microsoft considers that they are curating their system too. We both just think (I assume you're not here to defend Microsoft) their curation sucks.

I want to be sure we're pointing at the right thing here. The problem isn't that your Windows PC can end up running software because a device was plugged in, that's actually convenient and a benefit to many people and that works in Linux. The problem is what was delivered.

[microtonal]

But today a whole lot of mechanism is spun up when the kernel realises something new was added. A netlink socket talks to a udev daemon, in userspace and that daemon, being ordinary userspace software can do whatever it wants including of course run a bunch of arbitrary shell scripts, which can in turn do whatever they want. So yes of course they could download arbitrary software, or delete all your files with a Z in their name.

I know how udev works (old enough to have used Linux without hotplugging and the old hotplug scripts pre-udev).

You still haven't told me which distribution has a mechanism for udev that downloads arbitrary executable code from a vendor. It's a programmable system, so of course it is possible to implement this. My point is, I don't think any mainstream distribution does this.

[pessimizer]

> Where the Adware comes from is of no consequence to the end user. "Um actually, the file came from Microsoft's servers" is irrelevant.

Wrong. If I have a business relationship with MS where I've agreed to accept adware, this is meaningful. If I've bought a monitor that never informs me that it is installing adware, especially adware on their servers that could change at any time, this is a problem. It is different when the mailman opens my mailbox than when the person who cuts my grass opens my mailbox.

> The problem isn't that your Windows PC can end up running software because a device was plugged in, that's actually convenient and a benefit to many people and that works in Linux.

It's also a problem that Linux has allowed itself to be invaded by a creepy octopus of a user-hating system with tons of mutual dependencies, trying to gradually replace everything on your OS.

The problem is that Windows is running things without your explicit approval. The problem with Windows and new Linux is that it even has the ability to do so. Security became protecting the system from the user, rather than protecting the user from the network and devices.

The idea that userspace can do anything in userspace is a bit of a red herring, though. The question is how the malware gets into userspace in the first place. In the case of Windows and systemd, the malware is integral to the OS itself.

> that's actually convenient and a benefit to many people

To reiterate, it is not in any way convenient or a benefit to anyone that software is installed silently and secretly by their monitor. The idea that having to approve arbitrary software installation is some great inconvenience doesn't pass the laugh test.