2 ms·

Is there a security feature that's intended to prevent you from misspelling random text in an application?

• Retric 9y ago
  I meant it like this: 'If the windows access control dialog box had "Cancell" instead of "Cancel" it's a bug in a security feature, but not an attack surface.' Now, you can make a semantic argument that it's a security issue based on what team needs to fix it, but IMO that's a meaningless distinction for users. What's distinct about a security bug is what it allows to happen.
  • 13of40 9y ago
    Sorry, I misunderstood you. In that case, the way I'd break it down is: Is that dialog a "security feature"? Sure. (Actually, that's a stretch, because it's just lipstick over the API, but...) Is it intended to block someone from being able to do something? No. I'm not saying these criteria are all inclusive - for example, if the buttons were mislabeled and "Cancel" actually applied ACL changes, I'd still call it a security bug. It seems like the bug this thread is talking about clearly does meet the criteria, though. If you look at the man page for kill[1] it says unless you're root, you're only allowed to kill processes running under your user, but the bug allows a low-privilege user to kill other users' processes. [1]https://developer.apple.com/legacy/library/documentation/Darwin/Reference/ManPages/man2/kill.2.html https://developer.apple.com/legacy/library/documentation/Dar...