4 ms·

These are not delivered along with the notification-- they're provided (client-side) by the application that the notification was sent for. So, while a notifi

These are not delivered along with the notification-- they're provided (client-side) by the application that the notification was sent for. So, while a notification could display dynamic content here depending on the content of the notification (for example, this is the same mechanism as used by Mail on iOS for mail previews) and the preview code should take the untrusted nature of the content into account if it does, it doesn't have to and it's not any different than running the application itself in terms of security issues.

lupire 6y ago
A web browser displayed dynamic content all the time and is considered safe.
- chmod775 6y ago
  No. Nowadays you should still disable JavaScript as well as video playback in your browser if you want to be safe. There was a brief period some years ago where browsers looked "pretty safe", but we have quickly backtracked by stuffing JS and browsers full of new APIs that are creating new vulnerabilities. Edit: Yes. Downvoting will surely reduce the amount of CVEs. https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=chrome+v8 https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=chrome+v8 https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=chrome+sandbox https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=chrome+sand... https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=firefox https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=firefox There were also Chrome RCEs & sandbox escapes discovered in the wild as recently as November: https://twitter.com/benhawkes/status/1323374326150701057 https://twitter.com/benhawkes/status/1323374326150701057 https://googleprojectzero.github.io/0days-in-the-wild/0day-RCAs/2020/CVE-2020-16009.html https://googleprojectzero.github.io/0days-in-the-wild/0day-R... And for Firefox: https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2020/CVE-2020-6820.html https://googleprojectzero.github.io/0days-in-the-wild//0day-...
  - cooperaustinj 6y ago
    You'll be safe because you can't effectively use the modern internet :)
  - zamadatix 6y ago
    I mean you might as well just disable all connectivity on your computer if you only feel safe by not having CVEs show up in a search. Generally people want to still receive content though and are looking for the safest ways to do that, not ways to re-enact Bubble Boy, and for that browsers actually rank pretty good against most any other ways to get dynamic content.
    - chmod775 6y ago
      The question wasn't "what is the safest way to display dynamic content", the question was "is displaying dynamic content (this way) safe". And the answer is no. Web browsers are the safest way to run arbitrary code in a sandbox on your computer - which is what dynamic content in this context really means - the same way that aiming at your feet is the safest way to shoot yourself.
    - Hnrobert42 6y ago
      I’ve run NoScript for years. I selectively enable JS. It’s fine.
  - eckza 6y ago
    Dissenters and dissidents stick together; you have my vote.

lupire 6y ago

A web browser displayed dynamic content all the time and is considered safe.

chmod775 6y ago
No. Nowadays you should still disable JavaScript as well as video playback in your browser if you want to be safe. There was a brief period some years ago where browsers looked "pretty safe", but we have quickly backtracked by stuffing JS and browsers full of new APIs that are creating new vulnerabilities. Edit: Yes. Downvoting will surely reduce the amount of CVEs. https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=chrome+v8 https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=chrome+v8 https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=chrome+sandbox https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=chrome+sand... https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=firefox https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=firefox There were also Chrome RCEs & sandbox escapes discovered in the wild as recently as November: https://twitter.com/benhawkes/status/1323374326150701057 https://twitter.com/benhawkes/status/1323374326150701057 https://googleprojectzero.github.io/0days-in-the-wild/0day-RCAs/2020/CVE-2020-16009.html https://googleprojectzero.github.io/0days-in-the-wild/0day-R... And for Firefox: https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2020/CVE-2020-6820.html https://googleprojectzero.github.io/0days-in-the-wild//0day-...
- cooperaustinj 6y ago
  You'll be safe because you can't effectively use the modern internet :)
- zamadatix 6y ago
  I mean you might as well just disable all connectivity on your computer if you only feel safe by not having CVEs show up in a search. Generally people want to still receive content though and are looking for the safest ways to do that, not ways to re-enact Bubble Boy, and for that browsers actually rank pretty good against most any other ways to get dynamic content.
  - chmod775 6y ago
    The question wasn't "what is the safest way to display dynamic content", the question was "is displaying dynamic content (this way) safe". And the answer is no. Web browsers are the safest way to run arbitrary code in a sandbox on your computer - which is what dynamic content in this context really means - the same way that aiming at your feet is the safest way to shoot yourself.
  - Hnrobert42 6y ago
    I’ve run NoScript for years. I selectively enable JS. It’s fine.
- eckza 6y ago
  Dissenters and dissidents stick together; you have my vote.