4 ms·

> from CompSci Maybe I'm missing something, but I don't see much that I would consider CS. This is an attempt at an engineering-style workaround. > malware T

by pdkl95 10y ago

> from CompSci Maybe I'm missing something, but I don't see much that I would consider CS. This is an attempt at an engineering-style workaround. > malware They explicitly include support for spyware with the mouse{over,out} (etc) events. > "ADsafe makes it possible to quickly and reliably determine that script is safe" That's incredibly hard. It's easy to hide arbitrary code even if all you have is a lambda expression[1] ("function () {}" in JavaScript). There are so many sharp corners and inconsistent gotchas in JavaScript - multiplied by the variations between browsers - that identifying a "safe" subset of the language is extremely difficult (or maybe undecidable). Douglas Crockford has been warned[2] almost a decade ago about the insecurity of mixing foreign JavaScript. The language simply wasn't designed with a security model sufficient for running untrusted code. [1] https://codon.com/programming-with-nothing https://codon.com/programming-with-nothing [2] https://www.youtube.com/watch?v=qfBL2sc2zUU https://www.youtube.com/watch?v=qfBL2sc2zUU

nickpsecurity 10y ago
"Maybe I'm missing something, but I don't see much that I would consider CS" It came from CompSci people researching sandboxing of JavaScript. The papers on the left show that. They later turned it into a more engineered solution and convenient web site. Uncommon with CompSci projects. I give them extra credit for that whether the method pans out or not. "They explicitly include support for spyware with the mouse{over,out} (etc) events." Is that limited to the site it executes in or would it have visibility to all sites? And anything you see that would lead to code injection outside hardware-level attacks?
- pdkl95 10y ago
  > It came from CompSci people researching sandboxing of JavaScript. Ahh! That makes more sense. > site it executes in They seem to be allowing capture of UI events on any element that is selectable through their (limited) query interface. This is probably to allow interactive designs or ad-network "auction" tracking, but it's still spyware.
alkonaut 10y ago
Then just make ADSense2 be a DSL that is translated to js on the client, but which is itself not js? The important thing is to get the major browsers on board so that ad nets have to use it in order not to be blocked by default. (Assuming that browsers have the browser users interests in mind, and not advertisers, this is sketchy at best in the case of Goog)

by pdkl95 10y ago

nickpsecurity 10y ago

"Maybe I'm missing something, but I don't see much that I would consider CS" It came from CompSci people researching sandboxing of JavaScript. The papers on the left show that. They later turned it into a more engineered solution and convenient web site. Uncommon with CompSci projects. I give them extra credit for that whether the method pans out or not. "They explicitly include support for spyware with the mouse{over,out} (etc) events." Is that limited to the site it executes in or would it have visibility to all sites? And anything you see that would lead to code injection outside hardware-level attacks?

pdkl95 10y ago
> It came from CompSci people researching sandboxing of JavaScript. Ahh! That makes more sense. > site it executes in They seem to be allowing capture of UI events on any element that is selectable through their (limited) query interface. This is probably to allow interactive designs or ad-network "auction" tracking, but it's still spyware.

alkonaut 10y ago

Then just make ADSense2 be a DSL that is translated to js on the client, but which is itself not js? The important thing is to get the major browsers on board so that ad nets have to use it in order not to be blocked by default. (Assuming that browsers have the browser users interests in mind, and not advertisers, this is sketchy at best in the case of Goog)