3 ms·
Part of the problem is that the term "security" has taken on a very narrow meaning. A bug that crashes a word processor has just as much to do with security as
by delano 18y ago
Part of the problem is that the term "security" has taken on a very narrow meaning. A bug that crashes a word processor has just as much to do with security as one that allows an escalation of privileges.
- tptacek 18y agoExactly how is it that you figure that a Word'07 crasher is "just as bad" as Word'07 remote code execution? Losing my most important document is still far less damaging to me than losing all my browser cookies, which is what the attacker in the latter scenario wins.
- delano 18y agoYa I agree, if you compare the two directly but you have to consider the chance of either event occurring. A highly likely crash that destroys my most important document is more serious to than the much less likely event that an attacker would specifically choose my computer. My point is to broaden the notion of security, not to attenuate concern over remote attacks.
- tptacek 18y agoHuge numbers of people have their machines drafted into botnet by drive-by clientside document vulnerabilities like this. Nobody has to choose you as a specific target to make that happen.