3 ms·

I had to argue for the fix of more than one bug like this in another OS back in the day, and I take a more fundamental view of it: Does the OS have a security f

by 13of40 9y ago

I had to argue for the fix of more than one bug like this in another OS back in the day, and I take a more fundamental view of it: Does the OS have a security feature that's intended to prevent you from doing this? Does the exploit allow you to do it anyway? In this case the answer to both questions is "yes" which makes it a security bug.

Retric 9y ago
Misspelling some random text in an application is generally not it a security issue. Website that don't render correctly when a screen resizes is again not a security issue. Sure, their are a lot of things that can become security issues, but a lot of code has little to do with how a program operates.
- 13of40 9y ago
  Is there a security feature that's intended to prevent you from misspelling random text in an application?
  - Retric 9y ago
    I meant it like this: 'If the windows access control dialog box had "Cancell" instead of "Cancel" it's a bug in a security feature, but not an attack surface.' Now, you can make a semantic argument that it's a security issue based on what team needs to fix it, but IMO that's a meaningless distinction for users. What's distinct about a security bug is what it allows to happen.
    - 13of40 9y ago
      Sorry, I misunderstood you. In that case, the way I'd break it down is: Is that dialog a "security feature"? Sure. (Actually, that's a stretch, because it's just lipstick over the API, but...) Is it intended to block someone from being able to do something? No. I'm not saying these criteria are all inclusive - for example, if the buttons were mislabeled and "Cancel" actually applied ACL changes, I'd still call it a security bug. It seems like the bug this thread is talking about clearly does meet the criteria, though. If you look at the man page for kill[1] it says unless you're root, you're only allowed to kill processes running under your user, but the bug allows a low-privilege user to kill other users' processes. [1]https://developer.apple.com/legacy/library/documentation/Darwin/Reference/ManPages/man2/kill.2.html https://developer.apple.com/legacy/library/documentation/Dar...

by 13of40 9y ago

Retric 9y ago

Misspelling some random text in an application is generally not it a security issue. Website that don't render correctly when a screen resizes is again not a security issue. Sure, their are a lot of things that can become security issues, but a lot of code has little to do with how a program operates.

13of40 9y ago
Is there a security feature that's intended to prevent you from misspelling random text in an application?
- Retric 9y ago
  I meant it like this: 'If the windows access control dialog box had "Cancell" instead of "Cancel" it's a bug in a security feature, but not an attack surface.' Now, you can make a semantic argument that it's a security issue based on what team needs to fix it, but IMO that's a meaningless distinction for users. What's distinct about a security bug is what it allows to happen.
  - 13of40 9y ago
    Sorry, I misunderstood you. In that case, the way I'd break it down is: Is that dialog a "security feature"? Sure. (Actually, that's a stretch, because it's just lipstick over the API, but...) Is it intended to block someone from being able to do something? No. I'm not saying these criteria are all inclusive - for example, if the buttons were mislabeled and "Cancel" actually applied ACL changes, I'd still call it a security bug. It seems like the bug this thread is talking about clearly does meet the criteria, though. If you look at the man page for kill[1] it says unless you're root, you're only allowed to kill processes running under your user, but the bug allows a low-privilege user to kill other users' processes. [1]https://developer.apple.com/legacy/library/documentation/Darwin/Reference/ManPages/man2/kill.2.html https://developer.apple.com/legacy/library/documentation/Dar...