2 ms·

The root problem here seems to be that web browsers (and to some extent servers) have become quite insecure in practice due to the insane complexity of all the

The root problem here seems to be that web browsers (and to some extent servers) have become quite insecure in practice due to the insane complexity of all the different protocols they now support. If you are using Mosaic to access ancient web sites the most an attacker can do is to change the content. Now remote attackers have a simply vast attack surface. They can actually run code on your computer. History has shown such code can never be perfectly sandboxed. So you need to be very sure you are where you think you are and that you are only getting content from that place. TLS is an essential band aid fix. The same sort of thing comes up anywhere HTML is used. People sometimes claim that email is inherently insecure. In most cases it turns out that html email is inherently insecure. It seems that any popular protocol eventually gets extended to the point where it is impossible to keep it secure. It also seems that the popularity of the protocol causes a period of denial.

ipython 6y ago
Let’s be honest: remote attackers could run remote code on your computer running mosaic a lot easier than today with modern chrome. RCE in mosaic or Netscape was probably trivial, it just wasn’t as well studied as today. Just look at how many times those browsers would crash in the normal course of web browsing, even back then. Nobody was intensely fuzzing their html parsing engines, image processing libraries, scripting elements, plugins etc. Heck, IE used to load and run arbitrary code as “activex” controls. No fancy exploit needed!
- anthk 6y ago
  Opera not much, it was pretty decent and full of features. But nearly all decent "web" software required IE with Active X thru an OCX. Also there was a Netscape plugin I think.
mpolichette 6y ago
I don't agree... I think browsers are not the weak link here. I'll agree they have a large attack surface, but the communication channel needs to be secure regardless of what client receives it. > the most an attacker can do is to change the content. Sure , but I would argue, depending on on the content, that malicious content can be just as bad as malicious code. Just ask anyone who has been phished.

ipython 6y ago

Let’s be honest: remote attackers could run remote code on your computer running mosaic a lot easier than today with modern chrome. RCE in mosaic or Netscape was probably trivial, it just wasn’t as well studied as today. Just look at how many times those browsers would crash in the normal course of web browsing, even back then. Nobody was intensely fuzzing their html parsing engines, image processing libraries, scripting elements, plugins etc. Heck, IE used to load and run arbitrary code as “activex” controls. No fancy exploit needed!

anthk 6y ago
Opera not much, it was pretty decent and full of features. But nearly all decent "web" software required IE with Active X thru an OCX. Also there was a Netscape plugin I think.

mpolichette 6y ago

I don't agree... I think browsers are not the weak link here. I'll agree they have a large attack surface, but the communication channel needs to be secure regardless of what client receives it. > the most an attacker can do is to change the content. Sure , but I would argue, depending on on the content, that malicious content can be just as bad as malicious code. Just ask anyone who has been phished.