3 ms·
To eliminate further attack vectors, uninstall both the browser and the OS ; ). I just want to point out that's there's a big difference between having an inte
by shanemhansen 14y ago
To eliminate further attack vectors, uninstall both the browser and the OS ; ).
I just want to point out that's there's a big difference between having an interpreter on your machine like python, ruby, or java, and having a browser plugin that executes remote code by default.
There's nothing wrong with the former, there's everything wrong with the latter.
- jebblue 14y agoDo you mean Java in the browser? If so, what do you think is happening when your JavaScript code hits your server's REST code returning JSON?
- karlmdavis 14y agoThe primary difference is that JSON isn't considered executable-- at least not by any Java JSON libraries that I've seen; it's just data. (Yes, non-executable data can still deliver a malicious payload, e.g. http://technet.microsoft.com/en-us/security/bulletin/ms04-028 http://technet.microsoft.com/en-us/security/bulletin/ms04-02.... It's just much less common-- presumably because it's a much smaller attack surface.)
- justincormack 14y agoyou forget the time when json was usually called with exec... But mostly it is buffer overflow bugs that get you now.
- lttlrck 14y agowhat do you think is happening? Browsers don't use Java to parse/encode JSON... JSON is a Javascript facility.