6 ms·

> it is within their (the website) responsibility to ensure that ads and/or content should not cause harm to a visitor. I don't think that's been established.

by ryan-c 10y ago

> it is within their (the website) responsibility to ensure that ads and/or content should not cause harm to a visitor. I don't think that's been established. With the current state of advertising on the internet, it's not even possible to do this. In general, websites use advertising networks which do not allow them to proactively vet the content. Even if they did, no amount of vetting can guarantee the content is benign (active content can do naughty things only some of the time or on some platforms, or things not yet recognized as naughty - this is also why antivirus isn't reliable). So, clearly the solution is to not allow Javascript or flash, right? Nope - exploits in image parsers, font parsers, video parsers, audio parsers, etc. come out fairly often. This could maybe be dealt with by contracts between websites and advertising networks specifying that the advertising network will be liable for malicious content, but I don't see that happening.

Dylan16807 10y ago
>exploits in image parsers, font parsers, video parsers, audio parsers, etc. come out fairly often. Exploits in jpg/png are very rare. At worst, all you have to do is make the ad network [re]compress the image.
- Silhouette 10y ago
  Exploits in jpg/png are very rare. A major security issue with probably the most popular automated image processing toolkit in existence came to light just the other day. That particular one would be used for attacking servers, but there have been client-side vulnerabilities in other common resources such as fonts before too. Assuming that just because a format is common the software processing it won't introduce any vulnerabilities is not a great idea. In any case, the relative rarity isn't really the point. Either it's ethically and/or legally correct to assign blame for malicious advertising to the final host site that the user actually visits, or it isn't. That's the principle we're really debating, and the rest is just a degree of risk.
  - Dylan16807 10y ago
    >A major security issue with probably the most popular automated image processing toolkit in existence came to light just the other day. Because of all the weird formats it supports. That's why I said jpg/png, not 'images'. Any software that supports 200 formats probably has severe bugs on the rare ones. Doesn't matter for making a secure image server where you can dictate the format. >In any case, the relative rarity isn't really the point. Either it's ethically and/or legally correct to assign blame for malicious advertising to the final host site that the user actually visits, or it isn't. That's the principle we're really debating, and the rest is just a degree of risk. Whether they are being negligent is relevant. Allowing known-risky formats that keep failing over and over is negligent.
    - Silhouette 10y ago
      Allowing known-risky formats that keep failing over and over is negligent. But if you look at this from the opposite direction, you're essentially arguing that we should only use technologies that are known, or at least reasonably expected, to be extremely safe. Given that in general humanity hasn't yet figured out how to create such technologies, and that numerous formats we use every day on the web to great overall benefit would not qualify, that seems a tall order.
      - Dylan16807 10y ago
        > But if you look at this from the opposite direction, you're essentially arguing that we should only use technologies that are known, or at least reasonably expected, to be extremely safe. No I'm not. Go ahead and use a new technology. But don't use a proven-bad technology. If you tried a reasonable amount and don't know about security holes, that's one thing. If someone shows you the security holes, and you don't fix them, that is where you're a bad actor.
        Silhouette 10y ago
        Go ahead and use a new technology. But don't use a proven-bad technology. But the "proven bad" technology you're talking about here is just incorporating any third party content in your site. Obviously that is a security risk if the third party isn't perfect about policing what they host. On the other hand, billions of resources are served in that way every day, and the web is a much better place for it. Only a tiny fraction of those third party resources are hostile, and most of the ones that are will be closed down rapidly by the third party service themselves once discovered. So is this really in "proven bad", "known-risky" territory, or are we actually talking about "very rare" dangers and a lot of hyperbole here?
- ryan-c 10y ago
  > Exploits in jpg/png are very rare. I would like to introduce you to libpng: https://www.cvedetails.com/vulnerability-list/vendor_id-7294/Libpng.html https://www.cvedetails.com/vulnerability-list/vendor_id-7294...

by ryan-c 10y ago

Dylan16807 10y ago

>exploits in image parsers, font parsers, video parsers, audio parsers, etc. come out fairly often. Exploits in jpg/png are very rare. At worst, all you have to do is make the ad network [re]compress the image.

Silhouette 10y ago
Exploits in jpg/png are very rare. A major security issue with probably the most popular automated image processing toolkit in existence came to light just the other day. That particular one would be used for attacking servers, but there have been client-side vulnerabilities in other common resources such as fonts before too. Assuming that just because a format is common the software processing it won't introduce any vulnerabilities is not a great idea. In any case, the relative rarity isn't really the point. Either it's ethically and/or legally correct to assign blame for malicious advertising to the final host site that the user actually visits, or it isn't. That's the principle we're really debating, and the rest is just a degree of risk.
- Dylan16807 10y ago
  >A major security issue with probably the most popular automated image processing toolkit in existence came to light just the other day. Because of all the weird formats it supports. That's why I said jpg/png, not 'images'. Any software that supports 200 formats probably has severe bugs on the rare ones. Doesn't matter for making a secure image server where you can dictate the format. >In any case, the relative rarity isn't really the point. Either it's ethically and/or legally correct to assign blame for malicious advertising to the final host site that the user actually visits, or it isn't. That's the principle we're really debating, and the rest is just a degree of risk. Whether they are being negligent is relevant. Allowing known-risky formats that keep failing over and over is negligent.
  - Silhouette 10y ago
    Allowing known-risky formats that keep failing over and over is negligent. But if you look at this from the opposite direction, you're essentially arguing that we should only use technologies that are known, or at least reasonably expected, to be extremely safe. Given that in general humanity hasn't yet figured out how to create such technologies, and that numerous formats we use every day on the web to great overall benefit would not qualify, that seems a tall order.
    - Dylan16807 10y ago
      > But if you look at this from the opposite direction, you're essentially arguing that we should only use technologies that are known, or at least reasonably expected, to be extremely safe. No I'm not. Go ahead and use a new technology. But don't use a proven-bad technology. If you tried a reasonable amount and don't know about security holes, that's one thing. If someone shows you the security holes, and you don't fix them, that is where you're a bad actor.
      - Silhouette 10y ago
        Go ahead and use a new technology. But don't use a proven-bad technology. But the "proven bad" technology you're talking about here is just incorporating any third party content in your site. Obviously that is a security risk if the third party isn't perfect about policing what they host. On the other hand, billions of resources are served in that way every day, and the web is a much better place for it. Only a tiny fraction of those third party resources are hostile, and most of the ones that are will be closed down rapidly by the third party service themselves once discovered. So is this really in "proven bad", "known-risky" territory, or are we actually talking about "very rare" dangers and a lot of hyperbole here?
ryan-c 10y ago
> Exploits in jpg/png are very rare. I would like to introduce you to libpng: https://www.cvedetails.com/vulnerability-list/vendor_id-7294/Libpng.html https://www.cvedetails.com/vulnerability-list/vendor_id-7294...