4 ms·
> a sandbox strong enough to run completely untrusted code No browser has provided that either. In fact, browsers are by definition a security anti-feature be
by blub 9y ago
> a sandbox strong enough to run completely untrusted code
No browser has provided that either.
In fact, browsers are by definition a security anti-feature because they are always connected to the network and the customer/user data lives on the network.
Even if they manage to solve the problem of computers getting hacked when visiting websites they are very unlikely to solve the problems of tracking and private data vacuuming.
- jeremyjh 9y agoI've been using the web for over twenty years and it has never harmed my computer or invaded my system in any way. I do think I've seen adware and scumware that may have originated on the web on friends computers but I'm pretty sure they did something like allow a toolbar to be installed. Can you give an example of an exploit that did not require user permission,did not use a plugin, and that allowed arbitrary code execution from the internet ?
- TomMarius 9y agoYes. The web itself is harmless; it's the stuff you download and run that harms you.
- stult 9y agoGuns aren't dangerous! It's the bullets that will get you!
- netheril96 9y agoThis is not an appropriate analogy. Guns and bullets are designed to kill, but browsers and the download capability are not designed to infect your computer. Rather, they are designed with an opposite goal.
- alpos 9y agoAn "infection" in this case would be the execution of some other person's code on my computer. Browsers have been designed specifically to do this since Javascript was invented. The only difference between malware and "regular-ware" is whether the code meets certain user expectations about what it will and will not do.
- TomMarius 9y agoYes, exactly. What's your point though?
- dpwm 9y agoAnecdotally, I've never experienced remote code execution through a browser either. However, the most widely used browser for many years did have plenty of remote execution vulnerabilities that did not rely on plugins or toolbars [0]. [0] https://www.cvedetails.com/vulnerability-list.php?vendor_id=26&product_id=9900&version_id=40341&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&month=0&cweid=0&order=3&trc=210&sha=5411f6c0ba16d3310735d74991fd34aa27cb29e5 https://www.cvedetails.com/vulnerability-list.php?vendor_id=...
- netheril96 9y agoExploiting remote execution vulnerabilities is doable, but why do that when one has the easy route of exploiting gullible users instead?
- will4274 9y ago> I've been using the web for over twenty years and it has never harmed my computer or invaded my system in any way How do you know? Basically every browser has a RCE vulnerability a month and has for 20 years. From ancient JPEG vulnerabilities to modern video codecs and DOM manipulation vulnerabilities.
- blub 9y agoWould the recent Spectre vulnerability be an acceptable example for you? There are a gazillion others, but this one is nice and sweet and exposes the whole web app strategy as completely bankrupt from a security perspective.
- pcwalton 9y agoBrowsers do a whole lot better than the status quo for apps in the '90s and early 2000s, which was "offer a Windows .EXE to download, and monetize with spyware".
- pjmlp 9y agoWeb apps are already spyware by default, as everything gets done on a computer I don't have access to. Just plain pretty TTYs.
- pcwalton 9y agoThere is a world of difference between analytics and tracking and, say, CoolWebSearch. You don't see Web apps hijacking your home page, filling your bookmarks with casino ads, installing toolbars, or replacing competitors' banner ads.
- blub 9y agoYes, they are much better than your example, which is one of the worst things that could happen. :) But paid software in the 90s and 2000s was fine, no network connectivity, didn't even check for updates. Heck, a lot of freeware was fine. Then the market changed and spyware as a service became very profitable. The genius of this Spyware 2.0 was that it offered some benefits while not abusing the collected data in any obvious ways, like stealing your money. Browsers are helpless against this, in fact they are enabling the whole business model through their support of web apps and increasingly complex APIs.