Path: utzoo!attcan!utgpu!jarvis.csri.toronto.edu!mailrus!ames!coherent!dplatt
From: dplatt@coherent.com (Dave Platt)
Newsgroups: comp.sys.mac
Subject: Re: HP DeskJet & DataPak Printer Interface
Message-ID: <26073@coherent.com>
Date: 7 Jun 89 20:13:52 GMT
References: <19190@cup.portal.com>
Reply-To: dplatt@coherent.com (Dave Platt)
Distribution: usa
Organization: Coherent Thought Inc., Palo Alto CA
Lines: 44

In article <19190@cup.portal.com> DaleA@cup.portal.com (Dale M Arends) writes:
> I heard from Datapak about the interaction between Printer Interface III
> and GK.  According to them, they are storing the latest page format record
> in a CODE resource instead of a PREF (or other type of) resource.  They 
> are aware that this causes a problem but feel that what they are doing is
> "perfectly legal" and do not feel a need to change.  Their recommendation
> was to have GateKeeper not reject when a DRVR modifies a CODE resource.
> 
> My opinion is that it is a bogus "solution" and that doing so would nullify
> a large portion of GateKeeper's protection.  I feel that they are wrong and
> let them know.  If you agree, why dont you spread the word to the sites and
> maybe, if many complain to them, they will correct the problem.

I agree that this driver is doing something that it shouldn't;  every
other printer driver I've ever used stores its configuration in a PDEF,
or similar resource.  I called this problem to DataPak's attention the
day I received version 2.0 of their driver (a couple of months ago), and
suggested that they switch to a more-standard method of storing their
config info.  They said they'd look into it;  I'm sorry that they've
decided against making the change.  What they're doing is (technically)
legal, but I consider it a nonstandard and rather-dubious design.  It's
a shame... I like their driver very much.

Fortunately, the problem isn't as bad as you suspect.  Printer Interface
III stores its configuration information in its own DRVR resource (which
does contain executable code), _not_ in a CODE resource.  To date, I've
not heard of any Mac viruses that spread via DRVR resources... those
which infect applications, do so by modifying CODE resources.

So... one can remove DRVR from the list of resource-types that
GateKeeper protects, without opening the door to infection by viruses
such as nVIR.  I've been running in this mode for several months,
without any problems;  GateKeeper will still block infection by all
known viruses.





-- 
Dave Platt    FIDONET:  Dave Platt on 1:204/444        VOICE: (415) 493-8805
  UUCP: ...!{ames,sun,uunet}!coherent!dplatt     DOMAIN: dplatt@coherent.com
  INTERNET:   coherent!dplatt@ames.arpa,  ...@uunet.uu.net 
  USNAIL: Coherent Thought Inc.  3350 West Bayshore #205  Palo Alto CA 94303