8 ms·

Is anyone else dismayed by the implicit view of these sorts of articles, that browsers should be complicated and full of all these insecure features? It remind

Is anyone else dismayed by the implicit view of these sorts of articles, that browsers should be complicated and full of all these insecure features? It reminds me strongly of PDF and Acrobat. PDF is great for mailing around print-ready documents, which are more-or-less guaranteed to look the same for every viewer. Writing a PDF renderer is not easy, but it is straightforward, and there are multiple stable implementations without significant security problems. Then Adobe comes along and they add forms, and 3D charts, or Javascript, or multimedia, and Acrobat grows from a document viewer into what is essentially a backdoor on every Windows computer. A similar thing is happening with browsers. The core purpose of a web browser is the ability to render HTML+CSS into a human-readable document. Then browser vendors added forms and Javascript, so XSS was invented. They added persistent data storage, so looking at cat pictures can compromise my bank account. And now, Chrome+Firefox are /competing/ to see who can add more features, security be damned. WebGL exposes your graphics drivers (never security-audited before) to the internet. <audio> and <video> expose multimedia codecs, which in the past have caused numerous security problems. Flash is, essentially, a cross-platform way to let arbitrary people run exploits on your machine. When will it stop? When will browser vendors take a collective breath, look around, and realize the insanity they've been perpetrating?

ajross 14y ago
If browsers didn't do it then some other software would fill the niche. Having general purpose computers to run code written by other people is something everyone wants. Your attitude above seems to be that Javascript is a bad thing, which IMHO is just insane. And the bit about "security be damned" is just flat wrong, as evidenced by the linked article. They're working very hard at getting the sandbox architecture right, and have been so successful that it takes a hack of this magnitude to actually break it.
- jmillikin 14y ago
  > If browsers didn't do it then some other software would > fill the niche. Having general purpose computers to run > code written by other people is something everyone wants. It's fine to run code written by other people, but that code should be run in a safe, completely sandboxed environment. Modern smartphones have it right -- the user downloads an application, typically written in native code (or pseudo-native, for Android), and that application has only very limited access to the system. The $0.99 game I downloaded does not have the ability to inject keylogging code into my bank management application, and this is enforced by the OS itself. > Your attitude above seems to be that Javascript is a bad > thing, which IMHO is just insane. I don't think it's insane at all. Implementing applications as the moral equivalent of a highly-dynamic text document is what's insane. The concept of a "web app" is fundamentally broken, but despite users largely rejecting it (see: popularity of native apps vs safari apps on iPhone), nerds keep pushing it because it seems like a cool plot to a sci-fi novel. > And the bit about "security be damned" is just flat > wrong, as evidenced by the linked article. They're > working very hard at getting the sandbox architecture > right, and have been so successful that it takes a hack > of this magnitude to actually break it. This is security after the fact. If they actually cared about security, they'd disable Javascript, disable Flash, disable WebGL, and turn Chrome back into a web browser. When a boat is sinking because the hull was made of cardboard, don't point to the conveniently-placed bailing buckets as evidence of good engineering.
  - mbrubeck 14y ago
    > Modern smartphones have it right -- the user downloads an application, typically written in native code (or pseudo-native, for Android), and that application has only very limited access to the system. But those access limits are enforced in similar ways to the access limits imposed by browsers on web content, and they are regularly broken in similar ways too. Just like a browser, the attack surface of a smartphone OS includes image rendering libraries, font rendering libraries, 2D and 3D graphics engines, media codecs, and, umm, JavaScript and HTML rendering engines. Systems like iOS and Android have copied (and improved, I will freely admit) one of the web's most important features -- what the brower calls the same-origin policy. It's the idea that one developer's code doesn't automatically have access to the data from all your other apps/sites. But modern desktop operating systems still don't have this feature, which is one reason desktop users are still way more willing to use your web site than they are to download and run your native application.
    - jmillikin 14y ago
      When was the last time there was an outbreak of malware on Apple iTunes or Google Play? How many users were affected? Compare that to the near-monthly announcement of new browser security vulnerabilities, either in the browser itself or a bundled component (e.g. Flash). If a smartphone application exploits an image rendering or font library, it doesn't gain any additional permissions. It can't do anything with a vulnerable library that it couldn't do otherwise. The important attack surface on smartphones is local kernel exploits, which are rare. If every web page had its own full chroot/jail (or equivalent), then they would be as secure as native applications. But in the current model of web pages as accessed through a browser, this is impractical to implement.
      - recoiledsnake 14y ago
        >When was the last time there was an outbreak of malware on Apple iTunes or Google Play? Almost every day for Android? https://www.google.com/search?client=opera&rls=en&q=android&sourceid=opera&ie=utf-8&oe=utf-8&channel=suggest#q=android+malware&hl=en&client=opera&rls=en&channel=suggest&tbm=nws&ei=jnPWT5vmMfKM6QGvwKmsAw&start=0&sa=N&bav=on.2,or.r_gc.r_pw.r_cp.,cf.osb&fp=925c01eba69b37ea&biw=1920&bih=968 https://www.google.com/search?client=opera&rls=en&q=... >How many users were affected? Not as few as you think. One example http://www.crn.com/news/security/240000735/report-android-malware-growing-exponentially.htm;jsessionid=193pCSQvnlV46icNIw6Vug**.ecappj02 http://www.crn.com/news/security/240000735/report-android-ma... You can find many more if you look. http://www.techwireasia.com/3306/mobile-malware-on-the-rise-windows-no-longer-preferred-platform-for-attacks/ http://www.techwireasia.com/3306/mobile-malware-on-the-rise-...
deleted 14y ago
[deleted]
obeattie 14y ago
So… what are you proposing? We go back to the web as it was in 1995?
- jmillikin 14y ago
  I propose we give up on the flawed idea of "web apps", and go back to native applications. Mac OS, iOS, and Android show us that this is both possible and practical. The web can continue to be what it was and should be, a set of interlinked documents to be interpreted by applications installed on the local computer.
  - jonknee 14y ago
    Why not just properly sandbox web apps?
    - jmillikin 14y ago
      You'd have to give each web page its own sandbox, at which point installing/using it is no more convenient than a native application.
      - tonfa 14y ago
        You'd lose portability across platform (OSX, Windows, Linux, each with a variety of browsers).
      - comex 14y ago
        Web pages already have sandboxes.
      - jonknee 14y ago
        Except open distribution and being automatically cross platform...
  - MatthewPhillips 14y ago
    You're using a web application right now.
azakai 14y ago
> Is anyone else dismayed by the implicit view of these sorts of articles, that browsers should be complicated and full of all these insecure features? You're taking a position 100% against all additions to web browsers, it seems. And some people responding to you are taking the 100% opposite position. But there is a middle ground. Browsers should include the minimal amount of technology possible, and strike a compromise between number of features and security (because more features always means less security). What the right compromise is, is of course debatable. But I don't want to just say "extremes are wrong, the right middle way is best" in a generic manner because that's always true. More specifically, Google is the browser vendor including the most nonstandard technologies these days, and therefore incurring the most risk. For example, NaCl, WebSQL, a large extension API (even including things like text to speech), a closed-source PDF reader, Adobe Flash, Chrome Web Store frontend, and apparently soon Dart. All those things add to the attack surface of Chrome, I would argue needlessly. Of course other browsers are guilty of similar things, just to a lesser extent. At least Microsoft does not bundle Silverlight with IE (but it will apparently bundle Flash..).
- jmillikin 14y ago
  I don't think my position is extreme. I'm not advocating for a removal of all browser features, merely removal of those which are unrelated to the browser's core purpose of document navigation and rendering. If browser vendors spent less money on implementing audio synthesis or OpenGL, they could spend more on font rendering, SPDY, and standards compliance.
  - azakai 14y ago
    > I'm not advocating for a removal of all browser features, merely removal of those which are unrelated to the browser's core purpose of document navigation and rendering. Fair enough, but what people consider to be documents has changed. Some documents have 3D elements in them, for example architectural content. And some documents benefit from embedding sounds, like Wikipedia pages that contain small relevant snippets of audio. So I think it's hard to know where to draw the line. But again, I do agree a line needs to be drawn. The browser industry as a whole should work together to define that, in a standards-based way.
gringomorcego 14y ago
I think people are ignoring the end plan. Native Client isn't for running apps quickly. It's for finally letting Google create a sandbox that they can run their own browser in. Probably won't happen until HVM support is growing at a certain level.
nikic 14y ago
This comment is wrong on just so many levels. You seem to think that browser are less secure than running native software. This is totally absurd. And this blog entry shows exactly that. In order to bypass the advanced sandboxing techniques employed by modern browsers you have to build up complex chains of dozens of bugs. This is very different with desktop software. Desktop software is protected far less than code running in the browser. So the idea that running apps in the browser makes you more vulnerable than running native applications seems very unrealistic. Also you seem to have the very nostalgic view that the web should be just static websites with a few links in between. This concept again seems completely absurd. From my point of view as a PHP programmer the dynamic web is pretty much the best thing that happened to mankind. It allows you to run software without having to install it. From everywhere. From the the point of view of the end user this is still true. Just look around. Look at Facebook, Twitter and stuff.
tytr 14y ago
Yes. I too am dismayed. There used to be something called MIME. There used to be separate specialised applications for different tasks. Guess what? There still are. Browsers have long had the ability to decode image formats. That much we expect from the browser. But audio? Video? "Web sockets"? There are better applications to handle these formats and tasks than a web browser. When I want to listen to audio, I use an application that is designed for that. When I want to watch video, I use an application that is designed for that. When I want to open sockets for peer-to-peer communication, I use an application that is designed for that. Everyone knows browsers suck for downloading. So why are we using them to download content (whether to a file or to a buffered cache)? Download the content using a program that is designed for downloading. View/play the content with applications designed for those tasks. Anyone who would criticise this approach is criticising the "UNIX way". Do one thing well. But watch how people will criticise it. Yes, it is insanity. These browsers are always going to have performance issues. If you want the best audio, video, peer-to-peer, etc., use applications that were designed for those purposes. As simple as possible. Simple applications. That is how you achieve performance, reliability and security. "Do-everything" browsers and Javascript are not not worth the risks they present.
- adhipg 14y ago
  The problem with such an approach is that it makes computers hard to use - hard enough that 99% will not want to use it.
- icebraining 14y ago
  Web sockets are not for P2P. They're just raw TCP sockets to servers with an initial HTTP-like handshake. Personally, I can fully understand your points, and I actually take exactly that approach (using youtube-dl + mplayer for Youtube, extracting the streaming URLs from online radios and plugging them in MPD, etc). But, as a Linux user, I'm all too accustomed to be left out from many applications because this platform isn't profitable enough to develop to. Browser applications break with the monoculture of Windows (or, on mobile, iOS+Android) because they're portable and open by default. And I think that has some value.
richardw 14y ago
I'd just like to point out that Google significantly raised the state of the art with respect to browser security, specifically because they made it central to their effort. They had a more secure browser within a year than the other vendors had created since the birth of the web. This is a minor setback and I have no doubt that they've learned not only just how to fix this set of bugs, but the bug classes they represent. Netscape won (at the time) partly on "features", so browser competitors have to release features, balanced with their other priorities. Can't go back, can only go forward as responsibly as possible. Chrome has done this admirably. I suggest looking at these tests through a half-full glass. There's a huge benefit in discovering multi-bug exploits, for Chrome, Google, other browser vendors and all users. When an attacker is looking to break into a computer, Chrome is not their most obvious starting point. In fact, IIRC Kevin Mitnick said this: "KH: What’s the most secure OS? Is there one that you can recommend? KM: I don’t know of any secure OS. In the past eight years, I’ve had 100% success at penetration testing on all of them. Wait, ChromeOS, ChromeOS is the most secure because of its very limited attack vector–there’s just nothing to exploit." http://www.zdnet.com/blog/security/ghost-in-the-wires-the-kevin-mitnick-interview/9357 http://www.zdnet.com/blog/security/ghost-in-the-wires-the-ke... That's progress, surely.
nikcub 14y ago
browsers are the new operating system, but what was learned in security architecture of operating systems wasn't carried across. chrome et al at the moment (and other browsers) are the security equivalent of DOS - single user, unprotected memory, no file permissions etc. a lot has been done well with isolating the browser from the operating system, but within the browser itself is where more and more interesting information is being held, and the security model there is almost non-existant.

ajross 14y ago

If browsers didn't do it then some other software would fill the niche. Having general purpose computers to run code written by other people is something everyone wants. Your attitude above seems to be that Javascript is a bad thing, which IMHO is just insane. And the bit about "security be damned" is just flat wrong, as evidenced by the linked article. They're working very hard at getting the sandbox architecture right, and have been so successful that it takes a hack of this magnitude to actually break it.

jmillikin 14y ago
> If browsers didn't do it then some other software would > fill the niche. Having general purpose computers to run > code written by other people is something everyone wants. It's fine to run code written by other people, but that code should be run in a safe, completely sandboxed environment. Modern smartphones have it right -- the user downloads an application, typically written in native code (or pseudo-native, for Android), and that application has only very limited access to the system. The $0.99 game I downloaded does not have the ability to inject keylogging code into my bank management application, and this is enforced by the OS itself. > Your attitude above seems to be that Javascript is a bad > thing, which IMHO is just insane. I don't think it's insane at all. Implementing applications as the moral equivalent of a highly-dynamic text document is what's insane. The concept of a "web app" is fundamentally broken, but despite users largely rejecting it (see: popularity of native apps vs safari apps on iPhone), nerds keep pushing it because it seems like a cool plot to a sci-fi novel. > And the bit about "security be damned" is just flat > wrong, as evidenced by the linked article. They're > working very hard at getting the sandbox architecture > right, and have been so successful that it takes a hack > of this magnitude to actually break it. This is security after the fact. If they actually cared about security, they'd disable Javascript, disable Flash, disable WebGL, and turn Chrome back into a web browser. When a boat is sinking because the hull was made of cardboard, don't point to the conveniently-placed bailing buckets as evidence of good engineering.
- mbrubeck 14y ago
  > Modern smartphones have it right -- the user downloads an application, typically written in native code (or pseudo-native, for Android), and that application has only very limited access to the system. But those access limits are enforced in similar ways to the access limits imposed by browsers on web content, and they are regularly broken in similar ways too. Just like a browser, the attack surface of a smartphone OS includes image rendering libraries, font rendering libraries, 2D and 3D graphics engines, media codecs, and, umm, JavaScript and HTML rendering engines. Systems like iOS and Android have copied (and improved, I will freely admit) one of the web's most important features -- what the brower calls the same-origin policy. It's the idea that one developer's code doesn't automatically have access to the data from all your other apps/sites. But modern desktop operating systems still don't have this feature, which is one reason desktop users are still way more willing to use your web site than they are to download and run your native application.
  - jmillikin 14y ago
    When was the last time there was an outbreak of malware on Apple iTunes or Google Play? How many users were affected? Compare that to the near-monthly announcement of new browser security vulnerabilities, either in the browser itself or a bundled component (e.g. Flash). If a smartphone application exploits an image rendering or font library, it doesn't gain any additional permissions. It can't do anything with a vulnerable library that it couldn't do otherwise. The important attack surface on smartphones is local kernel exploits, which are rare. If every web page had its own full chroot/jail (or equivalent), then they would be as secure as native applications. But in the current model of web pages as accessed through a browser, this is impractical to implement.
    - recoiledsnake 14y ago
      >When was the last time there was an outbreak of malware on Apple iTunes or Google Play? Almost every day for Android? https://www.google.com/search?client=opera&rls=en&q=android&sourceid=opera&ie=utf-8&oe=utf-8&channel=suggest#q=android+malware&hl=en&client=opera&rls=en&channel=suggest&tbm=nws&ei=jnPWT5vmMfKM6QGvwKmsAw&start=0&sa=N&bav=on.2,or.r_gc.r_pw.r_cp.,cf.osb&fp=925c01eba69b37ea&biw=1920&bih=968 https://www.google.com/search?client=opera&rls=en&q=... >How many users were affected? Not as few as you think. One example http://www.crn.com/news/security/240000735/report-android-malware-growing-exponentially.htm;jsessionid=193pCSQvnlV46icNIw6Vug**.ecappj02 http://www.crn.com/news/security/240000735/report-android-ma... You can find many more if you look. http://www.techwireasia.com/3306/mobile-malware-on-the-rise-windows-no-longer-preferred-platform-for-attacks/ http://www.techwireasia.com/3306/mobile-malware-on-the-rise-...

deleted 14y ago

[deleted]

obeattie 14y ago

So… what are you proposing? We go back to the web as it was in 1995?

jmillikin 14y ago
I propose we give up on the flawed idea of "web apps", and go back to native applications. Mac OS, iOS, and Android show us that this is both possible and practical. The web can continue to be what it was and should be, a set of interlinked documents to be interpreted by applications installed on the local computer.
- jonknee 14y ago
  Why not just properly sandbox web apps?
  - jmillikin 14y ago
    You'd have to give each web page its own sandbox, at which point installing/using it is no more convenient than a native application.
    - tonfa 14y ago
      You'd lose portability across platform (OSX, Windows, Linux, each with a variety of browsers).
    - comex 14y ago
      Web pages already have sandboxes.
    - jonknee 14y ago
      Except open distribution and being automatically cross platform...
- MatthewPhillips 14y ago
  You're using a web application right now.

azakai 14y ago

> Is anyone else dismayed by the implicit view of these sorts of articles, that browsers should be complicated and full of all these insecure features? You're taking a position 100% against all additions to web browsers, it seems. And some people responding to you are taking the 100% opposite position. But there is a middle ground. Browsers should include the minimal amount of technology possible, and strike a compromise between number of features and security (because more features always means less security). What the right compromise is, is of course debatable. But I don't want to just say "extremes are wrong, the right middle way is best" in a generic manner because that's always true. More specifically, Google is the browser vendor including the most nonstandard technologies these days, and therefore incurring the most risk. For example, NaCl, WebSQL, a large extension API (even including things like text to speech), a closed-source PDF reader, Adobe Flash, Chrome Web Store frontend, and apparently soon Dart. All those things add to the attack surface of Chrome, I would argue needlessly. Of course other browsers are guilty of similar things, just to a lesser extent. At least Microsoft does not bundle Silverlight with IE (but it will apparently bundle Flash..).

jmillikin 14y ago
I don't think my position is extreme. I'm not advocating for a removal of all browser features, merely removal of those which are unrelated to the browser's core purpose of document navigation and rendering. If browser vendors spent less money on implementing audio synthesis or OpenGL, they could spend more on font rendering, SPDY, and standards compliance.
- azakai 14y ago
  > I'm not advocating for a removal of all browser features, merely removal of those which are unrelated to the browser's core purpose of document navigation and rendering. Fair enough, but what people consider to be documents has changed. Some documents have 3D elements in them, for example architectural content. And some documents benefit from embedding sounds, like Wikipedia pages that contain small relevant snippets of audio. So I think it's hard to know where to draw the line. But again, I do agree a line needs to be drawn. The browser industry as a whole should work together to define that, in a standards-based way.

gringomorcego 14y ago

I think people are ignoring the end plan. Native Client isn't for running apps quickly. It's for finally letting Google create a sandbox that they can run their own browser in. Probably won't happen until HVM support is growing at a certain level.

nikic 14y ago

This comment is wrong on just so many levels. You seem to think that browser are less secure than running native software. This is totally absurd. And this blog entry shows exactly that. In order to bypass the advanced sandboxing techniques employed by modern browsers you have to build up complex chains of dozens of bugs. This is very different with desktop software. Desktop software is protected far less than code running in the browser. So the idea that running apps in the browser makes you more vulnerable than running native applications seems very unrealistic. Also you seem to have the very nostalgic view that the web should be just static websites with a few links in between. This concept again seems completely absurd. From my point of view as a PHP programmer the dynamic web is pretty much the best thing that happened to mankind. It allows you to run software without having to install it. From everywhere. From the the point of view of the end user this is still true. Just look around. Look at Facebook, Twitter and stuff.

tytr 14y ago

Yes. I too am dismayed. There used to be something called MIME. There used to be separate specialised applications for different tasks. Guess what? There still are. Browsers have long had the ability to decode image formats. That much we expect from the browser. But audio? Video? "Web sockets"? There are better applications to handle these formats and tasks than a web browser. When I want to listen to audio, I use an application that is designed for that. When I want to watch video, I use an application that is designed for that. When I want to open sockets for peer-to-peer communication, I use an application that is designed for that. Everyone knows browsers suck for downloading. So why are we using them to download content (whether to a file or to a buffered cache)? Download the content using a program that is designed for downloading. View/play the content with applications designed for those tasks. Anyone who would criticise this approach is criticising the "UNIX way". Do one thing well. But watch how people will criticise it. Yes, it is insanity. These browsers are always going to have performance issues. If you want the best audio, video, peer-to-peer, etc., use applications that were designed for those purposes. As simple as possible. Simple applications. That is how you achieve performance, reliability and security. "Do-everything" browsers and Javascript are not not worth the risks they present.

adhipg 14y ago
The problem with such an approach is that it makes computers hard to use - hard enough that 99% will not want to use it.
icebraining 14y ago
Web sockets are not for P2P. They're just raw TCP sockets to servers with an initial HTTP-like handshake. Personally, I can fully understand your points, and I actually take exactly that approach (using youtube-dl + mplayer for Youtube, extracting the streaming URLs from online radios and plugging them in MPD, etc). But, as a Linux user, I'm all too accustomed to be left out from many applications because this platform isn't profitable enough to develop to. Browser applications break with the monoculture of Windows (or, on mobile, iOS+Android) because they're portable and open by default. And I think that has some value.

richardw 14y ago

I'd just like to point out that Google significantly raised the state of the art with respect to browser security, specifically because they made it central to their effort. They had a more secure browser within a year than the other vendors had created since the birth of the web. This is a minor setback and I have no doubt that they've learned not only just how to fix this set of bugs, but the bug classes they represent. Netscape won (at the time) partly on "features", so browser competitors have to release features, balanced with their other priorities. Can't go back, can only go forward as responsibly as possible. Chrome has done this admirably. I suggest looking at these tests through a half-full glass. There's a huge benefit in discovering multi-bug exploits, for Chrome, Google, other browser vendors and all users. When an attacker is looking to break into a computer, Chrome is not their most obvious starting point. In fact, IIRC Kevin Mitnick said this: "KH: What’s the most secure OS? Is there one that you can recommend? KM: I don’t know of any secure OS. In the past eight years, I’ve had 100% success at penetration testing on all of them. Wait, ChromeOS, ChromeOS is the most secure because of its very limited attack vector–there’s just nothing to exploit." http://www.zdnet.com/blog/security/ghost-in-the-wires-the-kevin-mitnick-interview/9357 http://www.zdnet.com/blog/security/ghost-in-the-wires-the-ke... That's progress, surely.

nikcub 14y ago

browsers are the new operating system, but what was learned in security architecture of operating systems wasn't carried across. chrome et al at the moment (and other browsers) are the security equivalent of DOS - single user, unprotected memory, no file permissions etc. a lot has been done well with isolating the browser from the operating system, but within the browser itself is where more and more interesting information is being held, and the security model there is almost non-existant.