4 ms·

Kind of an ironic blog post now, this blog post was posted in January 2017. In May 2017 we learned about this, from Project Zero no less: https://bugs.chromiu

Kind of an ironic blog post now, this blog post was posted in January 2017. In May 2017 we learned about this, from Project Zero no less: https://bugs.chromium.org/p/project-zero/issues/detail?id=1252&can=1&q=windows%20defender&desc=5 https://bugs.chromium.org/p/project-zero/issues/detail?id=12... > (Microsoft, on the other hand, is generally competent.) I'd argue that the Project Zero issue, while fixed, shows that the design of Windows Defender is anything but competent. They have a full power JavaScript runtime engine running as SYSTEM. No sandboxing, no lowprivs, and the whole point is to run untrusted code.

Aaargh20318 9y ago
> They have a full power JavaScript runtime engine running as SYSTEM. No sandboxing, no lowprivs, and the whole point is to run untrusted code. I would have understood that if it was a small company and a lone developer made a mistake. However, this is Microsoft, a huge company. Lone developers don't get to decide things like this at companies the size of Microsoft. Most likely, meetings were held, architects were involved, code was reviewed. How did such a horrible decision make it through that process ?
- pjmlp 9y ago
  I imagine you don't have the pleasure on work on companies of that size.
- tomohawk 9y ago
  None of us is as dumb as all of us.