Bringing Wine into Main

[Kees Cook]

On Mon, Dec 22, 2008 at 07:45:51PM -0500, Scott Kitterman wrote:
> On Monday 15 December 2008 05:22, Scott Ritchie wrote:
> > After some discussion with a few core devs at UDS, I feel it is time to
> > formally propose that Wine be moved into main.  Popcon says 10% of our
> > users have Wine installed already, and this is only the case today: we
> > don't even count Wubi installs, and some fraction of the 2 billion
> > Windows users would switch if we made Wine easier.
> 
> I'm all for making it easier, but I don't think it need to be in Main for
> this to happen.

I would basically agree with this.  Some items I didn't see mentioned (or
missed) in the thread:

Supporting an entire second operating system is not how I'd like to
spend my time on the security team.  I'd like to see an upstream fix
for needing the lower 64k of memory[1] so that people aren't forced to
lose that protection if they install Wine.  Additionally, since Wine is
so good it emulates some worms and malware, we need to make sure that
Wine does not auto-run[2] executables.  AFAIK, this is currently fixed,
but can sometimes sneak in via different avenues.

I recognize the utility of having Wine available to Ubuntu users, and
it sounds like there is a great plan in place to continue to improve it.
However I fundamentally see no reason for it to be in main.  I made this
same argument about asterisk: putting something in main doesn't suddenly
make it better.  Making a package better should be the goal in itself.

-Kees

[1] https://bugs.launchpad.net/ubuntu/+source/wine/+bug/114025
[2] https://bugs.launchpad.net/ubuntu/+source/wine/+bug/85338

-- 
Kees Cook
Ubuntu Security Team