4 ms·
I have read it. It's not clear what code runs inside the interpreter. What reason is there to even have such an interpreter in a highly privileged process?
by LeoNatan25 7y ago
I have read it. It's not clear what code runs inside the interpreter.
What reason is there to even have such an interpreter in a highly privileged process?
- benmmurphy 7y agoIf the interpreter was running code written by Avast then it wouldn't be a security issue. Having an interpreter running code you have written vs writing the code in C++ is not necessarily better or worse from a security point of view.
- saagarjha 7y agoGenerally the interpreter is probably better, once you have enough memory-managed code that it outweighs the number of vulnerabilities in your native code by virtue of its significantly lower bug rate.
- tremon 7y agoHighly disagree here. Javascript's DOM parsing functionality has but one purpose: presentation manipulation, i.e. rendering. Having something like that running as SYSTEM is a security issue in itself, regardless of where the code comes from. FFS, even display drivers don't run with full system privileges anymore.
- mosdl 7y agoJS has no DOM API, browsers provide JS an API to use. Plus DOM had nothing to do with rendering, it's just tree manipulation APIs.
- GoblinSlayer 7y ago>What reason Benchmarks. It's faster if you don't push all the scanned data through a process boundary.