3 ms·
As much as I am tired of the crappy code produced by some JS developers this time they are innocent. If you had read the article you would have known that the J
by jeltz 7y ago
As much as I am tired of the crappy code produced by some JS developers this time they are innocent. If you had read the article you would have known that the JS code executed here is JS found on the Interent, not any JS written by Avast. The bugs are in Avast's C++ code (or possibly C).
- saagarjha 7y ago> If you had read the article you would have known that the JS code executed here is JS found on the Interent, not any JS written by Avast. I think this makes it worse.
- SahAssar 7y agoYes, but it also means that this is not implemented because of "low-effort JS developers".
- LeoNatan25 7y agoI have read it. It's not clear what code runs inside the interpreter. What reason is there to even have such an interpreter in a highly privileged process?
- benmmurphy 7y agoIf the interpreter was running code written by Avast then it wouldn't be a security issue. Having an interpreter running code you have written vs writing the code in C++ is not necessarily better or worse from a security point of view.
- saagarjha 7y agoGenerally the interpreter is probably better, once you have enough memory-managed code that it outweighs the number of vulnerabilities in your native code by virtue of its significantly lower bug rate.
- tremon 7y agoHighly disagree here. Javascript's DOM parsing functionality has but one purpose: presentation manipulation, i.e. rendering. Having something like that running as SYSTEM is a security issue in itself, regardless of where the code comes from. FFS, even display drivers don't run with full system privileges anymore.
- mosdl 7y agoJS has no DOM API, browsers provide JS an API to use. Plus DOM had nothing to do with rendering, it's just tree manipulation APIs.
- GoblinSlayer 7y ago>What reason Benchmarks. It's faster if you don't push all the scanned data through a process boundary.
- JdeBP 7y agoThe bugs aren't in the code, and this whole subthread begun from what LeoNatan25 wrote is a tangent. The bugs are in the design, of downloading programs from random untrusted anybodies on the World Wide Web and running them, indeed of downloading programs from random untrusted anybodies on the World Wide Web and running them with elevated privileges. In order to test whether they are malicious, no less.