3 ms·
> Now take a singleplayer game, or a text editor. It's not a security risk if these crash, so do you need the safety Any program that operates on untrusted dat
by quotemstr 4y ago
> Now take a singleplayer game, or a text editor. It's not a security risk if these crash, so do you need the safety
Any program that operates on untrusted data can be a security vulnerability. If an attacker can make your text editor execute arbitrary code if you open a specially crafted file, that's a major security problem. Why would you create the risk of this sort of problem on purpose when we have adequate safe languages these days?
Instead of making people decide on a case-by-case basis when "security really matters", let's make all programs safe. I mean, isn't your suggestion that text editors have not security implications evidence in itself that people will get it wrong when asked, "Does my program need security?".
- swinglock 4y agoEven an offline game is dangerous. What if the save files are backed up and that storage is compromised? This allows an attacker to escalate access from one computer or service to others.
- unsafecast 4y agoThese are issues for the operating system to care about, not every single application. With pledge and unveil (or similar), you can solve most of this once.
- unsafecast 4y agoNot if the entire editor is untrusted. This is the job of the operating systems, and simple mechanisms like pledge and unveil can solve most of this.