3 ms·
Maybe, and I know this sounds crazy, secure chat clients shouldn't execute user/potential-attacker supplied code at all???
by bigiain 9y ago
Maybe, and I know this sounds crazy, secure chat clients shouldn't execute user/potential-attacker supplied code at all???
- jrochkind1 9y agoOf course they shouldn't, that is the bug, I think? The authors thought they were displaying user-supplied HTML, not executing user-supplied code. You can say secure chat clients should not display HTML messages, but that's a pretty different thing.
- fjsolwmv 9y agoYes the only problem is that the text markup language happens to include by default a Turing complete network-enabled live-interpreted programming language because 25 years ago someone wanted to write a funny message in the Netscape status bar.