4 ms·
Props on the fast fix; anti-props on running an unsandboxed JavaScript engine at SYSTEM privileges and feeding it files from remote.
by scarybeast 9y ago
Props on the fast fix; anti-props on running an unsandboxed JavaScript engine at SYSTEM privileges and feeding it files from remote.
- inlined 9y agoI'm really surprised here. When I worked on Windows we used the STRIDE model and had to do formal threat model analysis for every component. The reviews I was in was in for win 8 took a full day. A TMA should have immediately showed that a security boundary was needed.
- UnoriginalGuy 9y agoIf anyone is interested in STRIDE there's an MSDN article here: https://msdn.microsoft.com/en-us/library/ee823878(v=cs.20).aspx https://msdn.microsoft.com/en-us/library/ee823878(v=cs.20).a...
- djsumdog 9y agoLarge company with multiple teams and varying levels of people? I met someone who worked on Office. He told me there were parts of Excel that used a shared code base for Mac/Win/Web, parts that were just Mac/Web with different Win components, and for the Excel graphs, the labels for the graphs were unified for all three platforms but drawing the graph was individual to each platform. Mac Office was a fork from years ago they're finally trying to rebase and bring back into mainline. Some large companies aren't really unified entities with universal standards. You can be using a standard unified approach for the company and still be seated next to an intern not forced to use version control or a brand new Uni hire that's on a totally different process due to the team they get hired into.
- gpvos 9y agoTMA = ? (I'm guessing Threat Model Analysis?)
- inlined 9y agoYes. It's a formal doc that models information following between different actors separated by security boundaries