4 ms·

"It rather involved being on the other side of this airtight hatchway." https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31283 https://devblogs.micros

• twhitmore 7y ago
  Raymond Chen in this article seems to rather minimize the severity of arbitrary code execution attacks allowed by buffer overruns. His logic is also faulty since he conflates 'End-User' permitted capabilities (what the App correctly allows the user/ request to do) with Application permissions to the OS. Really this seems like it might be blinded by too many years of C/ C++ & immersion in stale campus group-think.
  • LoSboccacc 7y ago
    it's not arbitrary, this program execs what the user asks it to exec. if some non user can get it to exec something the user doesn't want it to exec, then yeah, it can be a problem. but a non user has to go trough the user to have the dll in place, so the problem is the user and the vector social engineering, not a vulnerability.