5
$\begingroup$

Apologies if this is overly paranoid.

I recently discovered the Wolfram Demonstrations Project and intend to play with them to understand some of the power of Mathematica.

I have one slight concern: given that Mathematica has all types of system access, what guarantees do I have about these demonstrations (i.e. that they don't maliciously modify my file system, steal ssh keys, install trojans, etc ... )

I would prefer an answer of the form: "option XYZ lets you disable all of that for specific notebooks" rather than an answer of the form "everyone loves each other and would never do that!"

Improve this question
$\endgroup$
9
  • 1
    $\begingroup$ Well, the source code is there for you to see :) If you still doubt it, don't run it. Same goes for any software/program. I don't see how/why Mathematica programs/demonstration CDFs are special in any way... $\endgroup$
    – rm -rf ♦
    Jul 16, 2012 at 0:55
  • 4
    $\begingroup$ Each Demonstration's content is rigorously reviewed by experts in relevant fields, and automated software-quality-assurance methods are used to check its operation. I presume they have a whitelisted set of commands. $\endgroup$
    – rm -rf ♦
    Jul 16, 2012 at 2:28
  • 2
    $\begingroup$ @term-rewritica CDF is "sandboxed" in the sense that it can't include functions that access your system. Of course it's always possible that there's a bug, and someone put enough work into exploiting it ... but it's unlikely, especially considering that demonstrations are reviewed by people before they are published. $\endgroup$
    – Szabolcs
    Jul 16, 2012 at 7:13
  • 3
    $\begingroup$ R.M. is on target. There is actually a black list of disallowed functions for material that appears on the Demonstrations site. These include things that might change the state of your Mathematica session, or mess with your OS. $\endgroup$
    – Daniel Lichtblau
    Jul 16, 2012 at 17:46
  • 1
    $\begingroup$ @DanielLichtblau Is there any chance/need/advantage of such a filter being integrated into Mathematica to check arbitrary CDFs or notebooks for such content (besides the usual dynamic content warning)? $\endgroup$
    – Yves Klett
    Jul 17, 2012 at 7:54

1 Answer 1

Reset to default
2
$\begingroup$

All the demonstrations uploaded to the Wolfram Demonstrations Project (WDP) are CDF documents, which you can open with the CDF player or Player Pro or Mathematica. The CDF player (which is what you open it in, by default) has a set of restrictions. Specifically, you cannot

  • Create new documents/files or save files
  • Change or save the state of the kernel/front end
  • Evaluate or edit input cells

So the possibility of anything being done to your system with a CDF player is minimal. If you're using Mathematica, the program is free to do all of the above (standard warnings for dynamic content still apply).

In addition, Daniel Lichtblau confirms that there is a blacklist of disallowed functions for all submissions that end up on the WDP. These include things that can change the state of your Mathematica session or mess with your OS.

To summarize, I believe it should be safe for you to interact with the demonstration in your browser before downloading.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.