4 ms·

I've been using the web for over twenty years and it has never harmed my computer or invaded my system in any way. I do think I've seen adware and scumware that

I've been using the web for over twenty years and it has never harmed my computer or invaded my system in any way. I do think I've seen adware and scumware that may have originated on the web on friends computers but I'm pretty sure they did something like allow a toolbar to be installed. Can you give an example of an exploit that did not require user permission,did not use a plugin, and that allowed arbitrary code execution from the internet ?

TomMarius 9y ago
Yes. The web itself is harmless; it's the stuff you download and run that harms you.
- stult 9y ago
  Guns aren't dangerous! It's the bullets that will get you!
  - netheril96 9y ago
    This is not an appropriate analogy. Guns and bullets are designed to kill, but browsers and the download capability are not designed to infect your computer. Rather, they are designed with an opposite goal.
    - alpos 9y ago
      An "infection" in this case would be the execution of some other person's code on my computer. Browsers have been designed specifically to do this since Javascript was invented. The only difference between malware and "regular-ware" is whether the code meets certain user expectations about what it will and will not do.
  - TomMarius 9y ago
    Yes, exactly. What's your point though?
dpwm 9y ago
Anecdotally, I've never experienced remote code execution through a browser either. However, the most widely used browser for many years did have plenty of remote execution vulnerabilities that did not rely on plugins or toolbars [0]. [0] https://www.cvedetails.com/vulnerability-list.php?vendor_id=26&product_id=9900&version_id=40341&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&month=0&cweid=0&order=3&trc=210&sha=5411f6c0ba16d3310735d74991fd34aa27cb29e5 https://www.cvedetails.com/vulnerability-list.php?vendor_id=...
- netheril96 9y ago
  Exploiting remote execution vulnerabilities is doable, but why do that when one has the easy route of exploiting gullible users instead?
will4274 9y ago
> I've been using the web for over twenty years and it has never harmed my computer or invaded my system in any way How do you know? Basically every browser has a RCE vulnerability a month and has for 20 years. From ancient JPEG vulnerabilities to modern video codecs and DOM manipulation vulnerabilities.
blub 9y ago
Would the recent Spectre vulnerability be an acceptable example for you? There are a gazillion others, but this one is nice and sweet and exposes the whole web app strategy as completely bankrupt from a security perspective.

TomMarius 9y ago

Yes. The web itself is harmless; it's the stuff you download and run that harms you.

stult 9y ago
Guns aren't dangerous! It's the bullets that will get you!
- netheril96 9y ago
  This is not an appropriate analogy. Guns and bullets are designed to kill, but browsers and the download capability are not designed to infect your computer. Rather, they are designed with an opposite goal.
  - alpos 9y ago
    An "infection" in this case would be the execution of some other person's code on my computer. Browsers have been designed specifically to do this since Javascript was invented. The only difference between malware and "regular-ware" is whether the code meets certain user expectations about what it will and will not do.
- TomMarius 9y ago
  Yes, exactly. What's your point though?

dpwm 9y ago

Anecdotally, I've never experienced remote code execution through a browser either. However, the most widely used browser for many years did have plenty of remote execution vulnerabilities that did not rely on plugins or toolbars [0]. [0] https://www.cvedetails.com/vulnerability-list.php?vendor_id=26&product_id=9900&version_id=40341&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&month=0&cweid=0&order=3&trc=210&sha=5411f6c0ba16d3310735d74991fd34aa27cb29e5 https://www.cvedetails.com/vulnerability-list.php?vendor_id=...

netheril96 9y ago
Exploiting remote execution vulnerabilities is doable, but why do that when one has the easy route of exploiting gullible users instead?

will4274 9y ago

> I've been using the web for over twenty years and it has never harmed my computer or invaded my system in any way How do you know? Basically every browser has a RCE vulnerability a month and has for 20 years. From ancient JPEG vulnerabilities to modern video codecs and DOM manipulation vulnerabilities.

blub 9y ago

Would the recent Spectre vulnerability be an acceptable example for you? There are a gazillion others, but this one is nice and sweet and exposes the whole web app strategy as completely bankrupt from a security perspective.