4 ms·
Ugh, my Win32 security knowledge is non-existent, but this sounds horrible. Seems to me that nothing marked 'from web' and non-executable should be loadable int
by cromwellian 6y ago
Ugh, my Win32 security knowledge is non-existent, but this sounds horrible. Seems to me that nothing marked 'from web' and non-executable should be loadable into a memory segment which can be executed, and nothing in the system partition should be overridable like this. This sounds like a flaw in the OS design.
The real irony of the comments on HN that "it's dead on mobile because Apple won't support it", is iOS is one of the few operating systems where this kind of API is trust worth. I would not expect iOS to give Safari privileges to see any files other data files the Safari process itself created by user interaction, or something on say, a Permission-protected directory (e.g. Photos). Ditto for OSX.
If anything, the API really a selling point for OSX/iOS security architecture, in that it can be made safe.
- elcritch 6y ago> Seems to me that nothing marked 'from web' and non-executable should be loadable into a memory segment which can be executed, Welcome to modern macOS and Safari. It’s a good idea, but puts up a block to third part or open source software. For now you can right-click and override (who knows for how long before Apple wants 30% of the price of all your desktop software too). I’d be more okay with the Mac version if you could add custom chains of trust.
- BrandoElFollito 6y ago> nothing marked 'from web' and non-executable should be loadable into a memory segment How would you "mark something 'from web'"? This is a file after all. There are ways to sign files (executable or not) but there is no 'from web' flag as far as I know.
- fortran77 6y agoSure there is: https://textslashplain.com/2016/04/04/downloads-and-the-mark-of-the-web/ https://textslashplain.com/2016/04/04/downloads-and-the-mark... Windows File System is very advanced and has metadata streams.
- lultimouomo 6y ago> How would you "mark something 'from web'"? This is a file after all. Files can have metadata, and most modern filesystems provide some kind of file attribute facility. On macOS browsers do exactly what described, setting a file attribute on downloaded files. The user will then be warned when trying to execute the file.
- vlovich123 6y agoYou would be incorrect. File Quarantine on OSX: > https://support.apple.com/en-us/HT201940 https://support.apple.com/en-us/HT201940 Alternate data stream on Windows: > https://www.howtogeek.com/70012/what-causes-the-file-downloaded-from-the-internet-warning-and-how-can-i-easily-remove-it/ https://www.howtogeek.com/70012/what-causes-the-file-downloa... I wouldn't be surprised if Linux had it but I haven't used desktop Linux in a long time so I don't know what to search for, but generally having browsers annotate their file streams isn't an uncommon thing to support for filesystems & browsers.
- BrandoElFollito 6y agoOK thanks - so this is a NTFS feature, meaning that if the file is stored on an non-NTFS partition, or sent further that "flag" is cancelled.
- yjftsjthsd-h 6y agoA decent number of linux filesystems do support extended attributes, which is how I assume you'd do this (actually, looking at https://en.wikipedia.org/wiki/Extended_file_attributes https://en.wikipedia.org/wiki/Extended_file_attributes a lot of OSs support xattrs), but I'm not aware of any browsers using them to mark downloads.
- vlovich123 6y agoI'm not aware of any browsers that don't mark files downloaded from the web as such.