3 ms·

Web specs go through Technical Architecture Group (tag) and Web Application Security Group. Operating systems are free to contribute & do help keep things in ch

Web specs go through Technical Architecture Group (tag) and Web Application Security Group. Operating systems are free to contribute & do help keep things in check, but this regulation/securing of the web has nothing to do with what operating systems are doing. > This means that going to the wrong web site can bork your machine Examples wanted. What are you talking about? This disinformation FUD is something web browsers & web security work absurdly hard to prevent. You're right that many native applications have no such guards, but you switch from talking about OSes to making fantastic claims against websites. Please provide some evidence of these extrodinary Fears Uncertainys and Doubts (FUDs) that you are spreading.

mikewarot 4y ago
It doesn't matter what the web SERVER is doing, it's the client on the PC that can get confused, and end up compromising the machine. The web client is a weak link, it always will be, because there are no limits (by default) on what it can do, by default, in most consumer operating systems.
- rektide 4y ago
  I don't think what you are talking about has happened in the last 10 years. And it was only bugs/deficiencies back before. Browsers are incredibly careful, better designed than OSes. For example, browsers all shipped protection against spectre/meltdown within weeks of the vulnerabilities being revealed. Browsers are extremely conservative & some of the best engineered sandboxes on the planet. If you could link to something, anything describing what specifically you think the threat is, what problems there are, I'd be most appreciative. This fear-centric conjecture you are spreading does not match what the intent of the browser is, which is to provide a tight secure sandbox such that a user can navigate anywhere at all and have a safe comfortable predictable time.
  - mikewarot 4y ago
    Here's an example from [1] "The current Chrome update addresses the fifth zero-day vulnerability in Google Chrome this year that is actively exploited by threat actors" The thing is, web browsers are just one "app" running on a PC, and there are many classes of programs. The blind trust the user's operating system puts into ANY program is a problem. [1] https://www.bleepingcomputer.com/news/security/google-fixes-fifth-chrome-zero-day-bug-exploited-this-year/ https://www.bleepingcomputer.com/news/security/google-fixes-...

mikewarot 4y ago

It doesn't matter what the web SERVER is doing, it's the client on the PC that can get confused, and end up compromising the machine. The web client is a weak link, it always will be, because there are no limits (by default) on what it can do, by default, in most consumer operating systems.

rektide 4y ago
I don't think what you are talking about has happened in the last 10 years. And it was only bugs/deficiencies back before. Browsers are incredibly careful, better designed than OSes. For example, browsers all shipped protection against spectre/meltdown within weeks of the vulnerabilities being revealed. Browsers are extremely conservative & some of the best engineered sandboxes on the planet. If you could link to something, anything describing what specifically you think the threat is, what problems there are, I'd be most appreciative. This fear-centric conjecture you are spreading does not match what the intent of the browser is, which is to provide a tight secure sandbox such that a user can navigate anywhere at all and have a safe comfortable predictable time.
- mikewarot 4y ago
  Here's an example from [1] "The current Chrome update addresses the fifth zero-day vulnerability in Google Chrome this year that is actively exploited by threat actors" The thing is, web browsers are just one "app" running on a PC, and there are many classes of programs. The blind trust the user's operating system puts into ANY program is a problem. [1] https://www.bleepingcomputer.com/news/security/google-fixes-fifth-chrome-zero-day-bug-exploited-this-year/ https://www.bleepingcomputer.com/news/security/google-fixes-...