ubuntu-x-swat team mailing list archive

[fuggum <632293@xxxxxxxxxxxxxxxxxx>]

*** This bug is a security vulnerability ***

Public security bug reported:

Binary package hint: xserver-xorg-input-synaptics

a few related bugs: 1, 611992, 556019, 483121, 380126, 191024, many,
many more, unassigned, undecided, unassigned...

synopsis:  bug #1 has much to do with hardware oem's working with ms to
design products to work with their 0$ and provide drivers.  to make some
progress on bug #1 it is critical that a ***trusted*** hardware
certification program exist that can assist partners, resellers, isvs,
systems integrators, support organizations and consumers in selecting
hardware that just works with ubuntu, ***especially when the oem ships
the system with ubuntu installed***.

case in point:  dell ships vostro v13 with ubuntu 9.04 installed.
cannonical lists vostro v13 as certified on 10.04 with only a note that
proprietary drivers are required for wifi.  cool, i buy one...

reality:  there is no ubuntu support (hardy through maverick) whether
supplied by dell or canonical, for the synaptics touchpad in the v13.
haven't found any other linux 2.6 distro that supports it either, not
even the 2.6.36 git tree.   works fine with dell supplied xp driver.
looking through the bug reports, it seems that most of the newer
gesturing touchpads on many notebooks from various manufacturers and
oems also are suffering similar issues.

potential security implications:  since the touchpad cannot be
configured and disabled while typing (except via Fn-F6 on the v13),
heaven only knows what configuration changes you're making on your
system, or the remote server or device you're configuring, or how many
items you just **really** bought on that website, or what other
information you've inadvertently cut-and-pasted into whatever
form/site/config file.  it's virtually impossible to use the keyboard
without touching the huge touchpad on this machine.

notice that synaptics does indeed provide support for linux to oems: see
http://www.synaptics.com/about/press/press-releases/synaptics-gesture-
suite%E2%84%A2-now-available-popular-linux-operating-systems

one would think that the ability to configure a touchpad as a touchpad,
not just a generic ps/2 mouse would be a critical accessibility check in
a certification program.

this "certification" is quite misleading, and reflects poorly on dell,
canonical and synaptics.

what will it take to be able to ***trust*** ubuntu's hardware certification?
imho. canonical needs to take ownership and:
1.  the vostro v13 should be removed from the "certified" status until it really works.
2.  ensure touchpad recognition by kernel, all relevant drivers and configuration capability is present by default to achieve certified status
3.  ensure oem's work with component device manufacturers and canonical engineering and quality control to supply requisite patches with their own distributions of ubuntu at the very least, better to work upstream where appropriate.
4.  provide a facility to rate and or refute the certifications published at http://webapps.ubuntu.com/certification/

cheers,

p.s.  in my case, i've exhausted all support options and am returning
the machine to dell for a refund.

** Affects: xserver-xorg-input-synaptics (Ubuntu)
     Importance: Undecided
         Status: New

** Visibility changed to: Public

-- 
ubuntu "certified" hardware misleading, and key contributor to lack of progress on bug #1
https://bugs.launchpad.net/bugs/632293
You received this bug notification because you are a member of Ubuntu-X,
which is subscribed to xserver-xorg-input-synaptics in ubuntu.