Make a bingo card out of the phrases:

• “We didn’t do anything wrong.”
• “We paid Company X to do that.”
• “What’s a computer license?”
• “How much do they want?”
• “If it’s free then why are we talking?”
• “If it’s free then what did we pay Company X for?”
• “What does GNU mean?”
• [… some time later …]
• “Can’t we just pay them?”
• “Don’t pay Company X because they fucked this up.”
• “Why do we have to give everyone the changes we paid for?”
• “Whatever. I don’t want to hear about this again.”

Add your own phrases. It’s a fun game for all ages.

They’re revisions to the USB standard. USB stands for “Universal Serial Bus.” In the before times there used to be different connectors and formats for sending data over wires for a lot of things. Eventually USB came along and solved a lot of problems all at once: https://simple.wikipedia.org/wiki/USB

Who defines the untrusted applications though?

¯\(ツ)/¯

If GNOME wrote it then they probably trust it. If you’re using GNOME, then you’ve accepted their security model on some level.

At least you know to go look for it. Attackers will only get more sophisticated:

https://ioctl.fail/preliminary-analysis-of-aur-malware/

according to their stated security model, untrusted applications must not be allowed to communicate with the secret service.

That won’t be a popular stance to take when someone eventually steals a bunch of cached, unlocked credentials off of D-BUS because of an oversight somewhere in the npm/aur/pip/cargo/whatever ecosystem.

More rabbit hole:

• https://www.openbsd.org/papers/bsdcan14-libressl/mgp00001.html
• https://gpg.fail/ (including the presentation)
• https://github.com/FiloSottile/age
• https://jedisct1.github.io/minisign/
• https://github.com/jedisct1/encpipe