4 ms·

Honestly your best bet is to turn your computer off & unplug it from the Internet. Sandboxes, VMs, BIOSes are all subject to bugs which could lead to security v

• marshray 15y ago
  If you do not trust the software you're running then you should not be running it. Yes, I often decline to run software. Even if I do "trust" the software and its author, running it may unnecessarily increase my attack surface. Honestly your best bet is to turn your computer off & unplug it from the Internet. Sandboxes, VMs, BIOSes are all subject to bugs which could lead to security vulnerabilities. Wrapping yourself in pillows may make you think you're safer, but it's not necessarily true & often is too much effort for most normal users. That's the same FUD I hear every time I tell someone "that particular feature set is beyond my risk/reward threshhold". Here's the counter-argument to that: Would you have your surgery at a hospital where the staff were playing Flash or WebGL Facebook games on the intravenous drug pump management console? We all have decisions to make about risk vs. benefit. I make mine with different considerations than yours. This is OK.
  • Klinky 15y ago
    Would you have your surgery at a hospital where the staff were playing Flash or WebGL Facebook games on the intravenous drug pump management console? This is quite a bit of FUD in it's own right. Would you use a computer who's only ability was to manage an intravenous pump? Apples vs Oranges. Even with medical devices being highly audited, not running Flash or WebGL & not being on the Internet, they still can end up with life threatening bugs. http://en.wikipedia.org/wiki/Therac-25 http://en.wikipedia.org/wiki/Therac-25
    • marshray 15y ago
      > Would you use a computer who's only ability was to manage an intravenous pump? Yes, I would prefer exactly such a thing for my IV pump. > Even with medical devices being highly audited, not running Flash or WebGL & not being on the Internet, There absolutely are many many medical devices running Windows XP embedded plugged in to hospital LANs around the country as we speak. In fact, I used to work on such a system. It was a total PoS from a security perspective. The mechanical engineers who designed it seriously didn't expect anyone would plug it into the LAN. Maybe they've improved it since then, I don't know. I no longer associate with those people. > they still can end up with life threatening bugs. http://en.wikipedia.org/wiki/Therac-25 http://en.wikipedia.org/wiki/Therac-25 Bonus points for knowing your history, but note that you're going back 25 years for such a bug. Adobe, lets see ... http://web.nvd.nist.gov/view/vuln/search-results?query=adobe&search_type=last3months&cves=on http://web.nvd.nist.gov/view/vuln/search-results?query=adobe... There we go CVE-2011-2460: Summary: Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2445, CVE-2011-2451, CVE-2011-2452, CVE-2011-2453, CVE-2011-2454, CVE-2011-2455, and CVE-2011-2459. CVSS Severity: 10.0 (HIGH) Published: 11/11/2011 So I had to look back only 11 days for my example, and that's not to mention the 15 other Adobe bugs with CVEs published that week. Still medical devices, like SCADA systems, do usually tend to suck because they're computer systems designed by people who've never secured a computer before. Guess what! Did you know you can kill someone wirelessly if they have a Medtronic insulin pump? http://www.reuters.com/article/2011/10/26/us-medtronic-idUSTRE79P52620111026 http://www.reuters.com/article/2011/10/26/us-medtronic-idUST... But that doesn't have much to do with my reasons for being wary of allowing WebGL.