5 ms·

> If browsers didn't do it then some other software would > fill the niche. Having general purpose computers to run > code written by other people is someth

> If browsers didn't do it then some other software would > fill the niche. Having general purpose computers to run > code written by other people is something everyone wants. It's fine to run code written by other people, but that code should be run in a safe, completely sandboxed environment. Modern smartphones have it right -- the user downloads an application, typically written in native code (or pseudo-native, for Android), and that application has only very limited access to the system. The $0.99 game I downloaded does not have the ability to inject keylogging code into my bank management application, and this is enforced by the OS itself. > Your attitude above seems to be that Javascript is a bad > thing, which IMHO is just insane. I don't think it's insane at all. Implementing applications as the moral equivalent of a highly-dynamic text document is what's insane. The concept of a "web app" is fundamentally broken, but despite users largely rejecting it (see: popularity of native apps vs safari apps on iPhone), nerds keep pushing it because it seems like a cool plot to a sci-fi novel. > And the bit about "security be damned" is just flat > wrong, as evidenced by the linked article. They're > working very hard at getting the sandbox architecture > right, and have been so successful that it takes a hack > of this magnitude to actually break it. This is security after the fact. If they actually cared about security, they'd disable Javascript, disable Flash, disable WebGL, and turn Chrome back into a web browser. When a boat is sinking because the hull was made of cardboard, don't point to the conveniently-placed bailing buckets as evidence of good engineering.

mbrubeck 14y ago
> Modern smartphones have it right -- the user downloads an application, typically written in native code (or pseudo-native, for Android), and that application has only very limited access to the system. But those access limits are enforced in similar ways to the access limits imposed by browsers on web content, and they are regularly broken in similar ways too. Just like a browser, the attack surface of a smartphone OS includes image rendering libraries, font rendering libraries, 2D and 3D graphics engines, media codecs, and, umm, JavaScript and HTML rendering engines. Systems like iOS and Android have copied (and improved, I will freely admit) one of the web's most important features -- what the brower calls the same-origin policy. It's the idea that one developer's code doesn't automatically have access to the data from all your other apps/sites. But modern desktop operating systems still don't have this feature, which is one reason desktop users are still way more willing to use your web site than they are to download and run your native application.
- jmillikin 14y ago
  When was the last time there was an outbreak of malware on Apple iTunes or Google Play? How many users were affected? Compare that to the near-monthly announcement of new browser security vulnerabilities, either in the browser itself or a bundled component (e.g. Flash). If a smartphone application exploits an image rendering or font library, it doesn't gain any additional permissions. It can't do anything with a vulnerable library that it couldn't do otherwise. The important attack surface on smartphones is local kernel exploits, which are rare. If every web page had its own full chroot/jail (or equivalent), then they would be as secure as native applications. But in the current model of web pages as accessed through a browser, this is impractical to implement.
  - recoiledsnake 14y ago
    >When was the last time there was an outbreak of malware on Apple iTunes or Google Play? Almost every day for Android? https://www.google.com/search?client=opera&rls=en&q=android&sourceid=opera&ie=utf-8&oe=utf-8&channel=suggest#q=android+malware&hl=en&client=opera&rls=en&channel=suggest&tbm=nws&ei=jnPWT5vmMfKM6QGvwKmsAw&start=0&sa=N&bav=on.2,or.r_gc.r_pw.r_cp.,cf.osb&fp=925c01eba69b37ea&biw=1920&bih=968 https://www.google.com/search?client=opera&rls=en&q=... >How many users were affected? Not as few as you think. One example http://www.crn.com/news/security/240000735/report-android-malware-growing-exponentially.htm;jsessionid=193pCSQvnlV46icNIw6Vug**.ecappj02 http://www.crn.com/news/security/240000735/report-android-ma... You can find many more if you look. http://www.techwireasia.com/3306/mobile-malware-on-the-rise-windows-no-longer-preferred-platform-for-attacks/ http://www.techwireasia.com/3306/mobile-malware-on-the-rise-...
  - mbrubeck 14y ago
    Yes, those are all valid and important points -- as I said above, mobile operating systems have taken the browser's conceptual model and improved it. They've made technical improvements (using the kernel's security policies and mechanisms) and non-technical ones (providing a trusted distribution channel with the ability to ban malware apps). I agree that browsers are behind in important ways. But I'm not so sure that local kernel exploits are that much rarer than, say, Chromium sandbox exploits, which play a similar role in mitigating vulnerabilities exposed to untrusted code. (Not all of those monthly vulnerability announcements actually allow code execution.) I think in practice the curated App Store model helps much more to prevent outbreaks of attacks in the wild. Google Play, which does not review apps before publishing them, has had malware problems. And since users and usability are still a weak link in the permission system, not all mobile malware even needs to circumvent technical measures to gain the privileges it wants. And browsers still offer safety advantages over native apps on the desktop systems that currently account for the majority of browser usage.
ktizo 14y ago
It's fine to run code written by other people, but that code should be run in a safe, completely sandboxed environment. There are no verifiably sandboxed environments on any consumer IT equipment. The $0.99 game I downloaded does not have the ability to inject keylogging code into my bank management application It might do. Implementing applications as the moral equivalent of a highly-dynamic text document I wasn't aware that moral equivalence was such an issue in dynamic text. Oh, that kind of dynamic text, you should have said. There's some tissues in the cupboard. nerds keep pushing it because it seems like a cool plot to a sci-fi novel Nope. Not enough spaceships, lasers or robots. If they actually cared about security, they'd disable Javascript, disable Flash, disable WebGL, and turn Chrome back into a web browser All of those bar webGL precede chrome by lots. And on that model of security, you might as well just not bother plugging in the computer in the first place. I do want a cardboard boat though. I wonder if Shigeru Ban will make one if everyone asks him really nicely.
acdha 14y ago
> It's fine to run code written by other people, but that code should be run in a safe, completely sandboxed environment. … which is what browsers do with JavaScript and have done since Netscape shipped the first Navigator beta with LiveScript. The problem is that no containment system is perfect because people want rich functionality which can be abused without significant care - your $.99 game certainly isn't supposed to be able to install a keylogger but in practice it's almost always been possible to do so because that operating system doesn't have magic security pixie dust, either, and mistakes are made. The only reason browsers have a bad reputation for security is because Microsoft exposed a ton of native code, ignoring advice from security experts, and completely neglected their responsibility as a platform maintainer for almost a decade. Firefox and Chrome are a different story, both having a better security track record than, say, a Microsoft operating system despite having a full rich experience. Chrome's better than your mobile operating system because it actually gets updated quickly whereas your mobile OS gets updated on a timescale of months (iOS, Android developer phones) to never (most Android phones and almost all others). > The concept of a "web app" is fundamentally broken, but despite users largely rejecting it (see: popularity of native apps vs safari apps on iPhone), nerds keep pushing it because it seems like a cool plot to a sci-fi novel. You have an uncommon and counter-factual understanding of the web and users. Please back up your claim that users don't actually want Gmail, Facebook, Flickr, Google Maps, etc. or that mobile users only want native applications despite mobile users showing heavy web activity. > This is security after the fact. If they actually cared about security, they'd disable Javascript, disable Flash, disable WebGL, and turn Chrome back into a web browser. Back into a 1995 web browser which wouldn't do anything which users expect. If you're so uncomfortable trusting a browser with a better security track record than most operating systems, you can easily disable all of those features but since the Chrome team both cares about and actually understands security they've focused on defense in depth and and rapid response rather than trying to convince users they don't actually want the things they ask for.

mbrubeck 14y ago

> Modern smartphones have it right -- the user downloads an application, typically written in native code (or pseudo-native, for Android), and that application has only very limited access to the system. But those access limits are enforced in similar ways to the access limits imposed by browsers on web content, and they are regularly broken in similar ways too. Just like a browser, the attack surface of a smartphone OS includes image rendering libraries, font rendering libraries, 2D and 3D graphics engines, media codecs, and, umm, JavaScript and HTML rendering engines. Systems like iOS and Android have copied (and improved, I will freely admit) one of the web's most important features -- what the brower calls the same-origin policy. It's the idea that one developer's code doesn't automatically have access to the data from all your other apps/sites. But modern desktop operating systems still don't have this feature, which is one reason desktop users are still way more willing to use your web site than they are to download and run your native application.

jmillikin 14y ago
When was the last time there was an outbreak of malware on Apple iTunes or Google Play? How many users were affected? Compare that to the near-monthly announcement of new browser security vulnerabilities, either in the browser itself or a bundled component (e.g. Flash). If a smartphone application exploits an image rendering or font library, it doesn't gain any additional permissions. It can't do anything with a vulnerable library that it couldn't do otherwise. The important attack surface on smartphones is local kernel exploits, which are rare. If every web page had its own full chroot/jail (or equivalent), then they would be as secure as native applications. But in the current model of web pages as accessed through a browser, this is impractical to implement.
- recoiledsnake 14y ago
  >When was the last time there was an outbreak of malware on Apple iTunes or Google Play? Almost every day for Android? https://www.google.com/search?client=opera&rls=en&q=android&sourceid=opera&ie=utf-8&oe=utf-8&channel=suggest#q=android+malware&hl=en&client=opera&rls=en&channel=suggest&tbm=nws&ei=jnPWT5vmMfKM6QGvwKmsAw&start=0&sa=N&bav=on.2,or.r_gc.r_pw.r_cp.,cf.osb&fp=925c01eba69b37ea&biw=1920&bih=968 https://www.google.com/search?client=opera&rls=en&q=... >How many users were affected? Not as few as you think. One example http://www.crn.com/news/security/240000735/report-android-malware-growing-exponentially.htm;jsessionid=193pCSQvnlV46icNIw6Vug**.ecappj02 http://www.crn.com/news/security/240000735/report-android-ma... You can find many more if you look. http://www.techwireasia.com/3306/mobile-malware-on-the-rise-windows-no-longer-preferred-platform-for-attacks/ http://www.techwireasia.com/3306/mobile-malware-on-the-rise-...
- mbrubeck 14y ago
  Yes, those are all valid and important points -- as I said above, mobile operating systems have taken the browser's conceptual model and improved it. They've made technical improvements (using the kernel's security policies and mechanisms) and non-technical ones (providing a trusted distribution channel with the ability to ban malware apps). I agree that browsers are behind in important ways. But I'm not so sure that local kernel exploits are that much rarer than, say, Chromium sandbox exploits, which play a similar role in mitigating vulnerabilities exposed to untrusted code. (Not all of those monthly vulnerability announcements actually allow code execution.) I think in practice the curated App Store model helps much more to prevent outbreaks of attacks in the wild. Google Play, which does not review apps before publishing them, has had malware problems. And since users and usability are still a weak link in the permission system, not all mobile malware even needs to circumvent technical measures to gain the privileges it wants. And browsers still offer safety advantages over native apps on the desktop systems that currently account for the majority of browser usage.

ktizo 14y ago

It's fine to run code written by other people, but that code should be run in a safe, completely sandboxed environment. There are no verifiably sandboxed environments on any consumer IT equipment. The $0.99 game I downloaded does not have the ability to inject keylogging code into my bank management application It might do. Implementing applications as the moral equivalent of a highly-dynamic text document I wasn't aware that moral equivalence was such an issue in dynamic text. Oh, that kind of dynamic text, you should have said. There's some tissues in the cupboard. nerds keep pushing it because it seems like a cool plot to a sci-fi novel Nope. Not enough spaceships, lasers or robots. If they actually cared about security, they'd disable Javascript, disable Flash, disable WebGL, and turn Chrome back into a web browser All of those bar webGL precede chrome by lots. And on that model of security, you might as well just not bother plugging in the computer in the first place. I do want a cardboard boat though. I wonder if Shigeru Ban will make one if everyone asks him really nicely.

acdha 14y ago

> It's fine to run code written by other people, but that code should be run in a safe, completely sandboxed environment. … which is what browsers do with JavaScript and have done since Netscape shipped the first Navigator beta with LiveScript. The problem is that no containment system is perfect because people want rich functionality which can be abused without significant care - your $.99 game certainly isn't supposed to be able to install a keylogger but in practice it's almost always been possible to do so because that operating system doesn't have magic security pixie dust, either, and mistakes are made. The only reason browsers have a bad reputation for security is because Microsoft exposed a ton of native code, ignoring advice from security experts, and completely neglected their responsibility as a platform maintainer for almost a decade. Firefox and Chrome are a different story, both having a better security track record than, say, a Microsoft operating system despite having a full rich experience. Chrome's better than your mobile operating system because it actually gets updated quickly whereas your mobile OS gets updated on a timescale of months (iOS, Android developer phones) to never (most Android phones and almost all others). > The concept of a "web app" is fundamentally broken, but despite users largely rejecting it (see: popularity of native apps vs safari apps on iPhone), nerds keep pushing it because it seems like a cool plot to a sci-fi novel. You have an uncommon and counter-factual understanding of the web and users. Please back up your claim that users don't actually want Gmail, Facebook, Flickr, Google Maps, etc. or that mobile users only want native applications despite mobile users showing heavy web activity. > This is security after the fact. If they actually cared about security, they'd disable Javascript, disable Flash, disable WebGL, and turn Chrome back into a web browser. Back into a 1995 web browser which wouldn't do anything which users expect. If you're so uncomfortable trusting a browser with a better security track record than most operating systems, you can easily disable all of those features but since the Chrome team both cares about and actually understands security they've focused on defense in depth and and rapid response rather than trying to convince users they don't actually want the things they ask for.