3 ms·

https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=chromium https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=chromium

Ajedi32 9y ago
As opposed to native desktop apps, which get all the same permissions by default that a web app requires a zero-day sandbox escape vulnerability to achieve?
- Sir_Cmpwn 9y ago
  Native desktop apps are limited in number are nowhere near the dumpster fire the web is. My desktop isn't routinely downloading and executing payloads from the web. They're clearly different.
  - Ajedi32 9y ago
    This is about the Web USB API, not the entire web in general. Are you routinely granting web pages access to your USB devices? That's not a permission that web apps get by default (unlike with native desktop apps btw). It comes down to this: if you ever found yourself in a situation where you needed to connect a USB device to a remote service, would you prefer to download that service's unsandboxed native code to your PC and execute it? Or execute some JS in the browser sandbox and grant it limited access to that one specific device?
    - Sir_Cmpwn 9y ago
      >if you ever found yourself in a situation where you needed to connect a USB device to a remote service I have never found myself in that situation. That sounds like a really silly idea.
      - Spivak 9y ago
        Attaching a bootable USB drive to a HTML5 based KVM? Sure it could be accomplished in other ways buy why not this way?
        Sir_Cmpwn 9y ago
        Why an HTML5 based KVM? A desktop app would be great for that!
      - Ajedi32 9y ago
        Then click "deny", or (in the case of a native app) refuse to install the executable. Either way you're safe. For those that _do_ require [such use cases][1] though; they can now do so without needing to expose their system to an unsandboxed native app. [1]: https://wicg.github.io/webusb/#motivating-applications https://wicg.github.io/webusb/#motivating-applications
        Sir_Cmpwn 9y ago
        I know to do that. How about my grandma, who just clicks whatever button looks like it'll make the message go away sooner? The web is a disaster and WebUSB is a prime piece of evidence supporting this.
        Ajedi32 9y ago
        Would that include the "Run" button on a downloaded executable? While obviously we want to do as much as we can to discourage users from shooting themselves in the foot, there are limits. At some point, eventually you _do_ have to trust that the user knows what he's doing. Giving users a choice on when to allow a page access to one specific USB device is not a "disaster".
      - jperras 9y ago
        Just because you've never dreamed up a situation where it might be useful doesn't mean that they don't exist.
        Sir_Cmpwn 9y ago
        Clarification: I've never wanted to do that in a web browser.
    - cestith 9y ago
      There are operating systems which don't by default give every application running as every user account access to every storage device.

As opposed to native desktop apps, which get all the same permissions by default that a web app requires a zero-day sandbox escape vulnerability to achieve?

Sir_Cmpwn 9y ago
Native desktop apps are limited in number are nowhere near the dumpster fire the web is. My desktop isn't routinely downloading and executing payloads from the web. They're clearly different.
- Ajedi32 9y ago
  This is about the Web USB API, not the entire web in general. Are you routinely granting web pages access to your USB devices? That's not a permission that web apps get by default (unlike with native desktop apps btw). It comes down to this: if you ever found yourself in a situation where you needed to connect a USB device to a remote service, would you prefer to download that service's unsandboxed native code to your PC and execute it? Or execute some JS in the browser sandbox and grant it limited access to that one specific device?
  - Sir_Cmpwn 9y ago
    >if you ever found yourself in a situation where you needed to connect a USB device to a remote service I have never found myself in that situation. That sounds like a really silly idea.
    - Spivak 9y ago
      Attaching a bootable USB drive to a HTML5 based KVM? Sure it could be accomplished in other ways buy why not this way?
      - Sir_Cmpwn 9y ago
        Why an HTML5 based KVM? A desktop app would be great for that!
    - Ajedi32 9y ago
      Then click "deny", or (in the case of a native app) refuse to install the executable. Either way you're safe. For those that _do_ require [such use cases][1] though; they can now do so without needing to expose their system to an unsandboxed native app. [1]: https://wicg.github.io/webusb/#motivating-applications https://wicg.github.io/webusb/#motivating-applications
      - Sir_Cmpwn 9y ago
        I know to do that. How about my grandma, who just clicks whatever button looks like it'll make the message go away sooner? The web is a disaster and WebUSB is a prime piece of evidence supporting this.
        Ajedi32 9y ago
        Would that include the "Run" button on a downloaded executable? While obviously we want to do as much as we can to discourage users from shooting themselves in the foot, there are limits. At some point, eventually you _do_ have to trust that the user knows what he's doing. Giving users a choice on when to allow a page access to one specific USB device is not a "disaster".
    - jperras 9y ago
      Just because you've never dreamed up a situation where it might be useful doesn't mean that they don't exist.
      - Sir_Cmpwn 9y ago
        Clarification: I've never wanted to do that in a web browser.
  - cestith 9y ago
    There are operating systems which don't by default give every application running as every user account access to every storage device.