4 ms·

Worth mentioning that both w3m and lynx are horribly insecure. Although I guess it’s very unlikely that anyone would actually bother to exploit such niche softw

by rosndo 5y ago

Worth mentioning that both w3m and lynx are horribly insecure. Although I guess it’s very unlikely that anyone would actually bother to exploit such niche software.

detaro 5y ago
Are they, despite not having most of the attack surface other browsers have (due to not supporting a lot of features)?
- rosndo 5y ago
  Yes. The problem is that the features which they do support (which are still plentiful) are not particularly well implemented. Parsing HTML is difficult.
  - antiframe 5y ago
    Do you know of any current vulnerabilities in w3m? The last one I saw was in 2010 and fixed. Is it just not studied enough and there could be many undiscovered vulnerabilities? Beings up an interesting question of how to evaluate unknown vulnerabilities to determine if something is horribly insecure.
    - rosndo 5y ago
      It’s not studied because nobody cares about w3m or Lynx. I’m just making these statements based on my own experience with fuzzing both a few years ago.
      - rkta 5y ago
        > nobody cares about w3m or Lynx I'd say, this is a security feature - even if the code is not the most secure. Out of interest, did you report your findings from fuzzing? Did things got fixed?
  - tannhaeuser 5y ago
    Not that difficult if still laborious when following the construction of IETF HTML and W3C HTML 4.x as an SGML vocabulary ab initio which already covers the vast majority of what people coming from XML have problems understanding, such as tag inference eg automatically ending span-level markup on block-level content. Plus some irregularities introduced with URLs, and with CSS and JavaScript to prevent those from being displayed as content in old browsers. Then add some more oddities introduced with WHATWG HTML 5.1+ arguably by accident and due to ignorance and lack of a formal grammar.
- Seirdy 5y ago
  They both parse untrusted content content without any sandboxing. I typically send content through rdrview[0] before piping through w3m-sandbox[1], which should be pretty safe. I also only browse one site per w3m instance. [0]: https://github.com/eafer/rdrview https://github.com/eafer/rdrview [1]: https://git.sr.ht/~seirdy/bwrap-scripts/tree/trunk/item/w3m-sandbox https://git.sr.ht/~seirdy/bwrap-scripts/tree/trunk/item/w3m-...

by rosndo 5y ago

Worth mentioning that both w3m and lynx are horribly insecure. Although I guess it’s very unlikely that anyone would actually bother to exploit such niche software.

detaro 5y ago

Are they, despite not having most of the attack surface other browsers have (due to not supporting a lot of features)?

rosndo 5y ago
Yes. The problem is that the features which they do support (which are still plentiful) are not particularly well implemented. Parsing HTML is difficult.
- antiframe 5y ago
  Do you know of any current vulnerabilities in w3m? The last one I saw was in 2010 and fixed. Is it just not studied enough and there could be many undiscovered vulnerabilities? Beings up an interesting question of how to evaluate unknown vulnerabilities to determine if something is horribly insecure.
  - rosndo 5y ago
    It’s not studied because nobody cares about w3m or Lynx. I’m just making these statements based on my own experience with fuzzing both a few years ago.
    - rkta 5y ago
      > nobody cares about w3m or Lynx I'd say, this is a security feature - even if the code is not the most secure. Out of interest, did you report your findings from fuzzing? Did things got fixed?
- tannhaeuser 5y ago
  Not that difficult if still laborious when following the construction of IETF HTML and W3C HTML 4.x as an SGML vocabulary ab initio which already covers the vast majority of what people coming from XML have problems understanding, such as tag inference eg automatically ending span-level markup on block-level content. Plus some irregularities introduced with URLs, and with CSS and JavaScript to prevent those from being displayed as content in old browsers. Then add some more oddities introduced with WHATWG HTML 5.1+ arguably by accident and due to ignorance and lack of a formal grammar.
Seirdy 5y ago
They both parse untrusted content content without any sandboxing. I typically send content through rdrview[0] before piping through w3m-sandbox[1], which should be pretty safe. I also only browse one site per w3m instance. [0]: https://github.com/eafer/rdrview https://github.com/eafer/rdrview [1]: https://git.sr.ht/~seirdy/bwrap-scripts/tree/trunk/item/w3m-sandbox https://git.sr.ht/~seirdy/bwrap-scripts/tree/trunk/item/w3m-...