3 ms·

It's just about not allowing 3rd party code to have writable code pages. In principle, this is good - most programs don't write code to memory, unless they're s

It's just about not allowing 3rd party code to have writable code pages. In principle, this is good - most programs don't write code to memory, unless they're suffering a security problem. It's just unfortunate that the few legitimate uses of this are also culled.

btrask 14y ago
If they were serious about security, they'd do without JIT in their own browsers too. But that would be silly.
- TazeTSchnitzel 14y ago
  But IE10, unlike competing browsers, isn't just a "browser" on Windows 8, it's one of the fundamental development platforms built into the OS, along with .NET, WinRT, and Win32. Of course it has special privileges
- batista 14y ago
  Exactly, that _would_ be silly. I don't get this kind of arguments "if you are serious about X you should go all the way, else forget about it altogether". You can both be serious about something AND reach some reasonable compromise. In this case, it is enough that they only allow one JIT that they control and can update/revoke etc immediately.
modeless 14y ago
It's not good in principle. There are many legitimate uses of writeable code pages, and as long as they're not the default they are unlikely to cause security problems. Don't forget that these apps all run in a sandbox already, so an app exploit won't get you system access anyway. All the excuses Apple/Microsoft give are just that: excuses. The real reason interpreters and self-modifying code are prohibited is to prevent competition with the first-party browsers and app frameworks.
- ctoshok 14y ago
  um, interpreters aren't prohibited.
  - shmerl 14y ago
    They are prohibited by Apple to be even built with iOS SDK, if they interpret the code downloaded from the Web, which is naturally the case with browsers and JavaScript.
abecedarius 14y ago
If it were a default prohibition that could be overridden for a project that really needs it, I wouldn't complain. But as it is it's an unreasonable cost for the benefit for everyone but the platform owner. (Cost: obvious. Benefit: some hacks get harder, but with no essential change to what's possible in the way that memory protection or high-level programming languages change the game. E.g. instead of native code your hack uses https://en.wikipedia.org/wiki/Return-oriented_programming https://en.wikipedia.org/wiki/Return-oriented_programming .)

btrask 14y ago

If they were serious about security, they'd do without JIT in their own browsers too. But that would be silly.

TazeTSchnitzel 14y ago
But IE10, unlike competing browsers, isn't just a "browser" on Windows 8, it's one of the fundamental development platforms built into the OS, along with .NET, WinRT, and Win32. Of course it has special privileges
batista 14y ago
Exactly, that _would_ be silly. I don't get this kind of arguments "if you are serious about X you should go all the way, else forget about it altogether". You can both be serious about something AND reach some reasonable compromise. In this case, it is enough that they only allow one JIT that they control and can update/revoke etc immediately.

modeless 14y ago

It's not good in principle. There are many legitimate uses of writeable code pages, and as long as they're not the default they are unlikely to cause security problems. Don't forget that these apps all run in a sandbox already, so an app exploit won't get you system access anyway. All the excuses Apple/Microsoft give are just that: excuses. The real reason interpreters and self-modifying code are prohibited is to prevent competition with the first-party browsers and app frameworks.

ctoshok 14y ago
um, interpreters aren't prohibited.
- shmerl 14y ago
  They are prohibited by Apple to be even built with iOS SDK, if they interpret the code downloaded from the Web, which is naturally the case with browsers and JavaScript.

abecedarius 14y ago

If it were a default prohibition that could be overridden for a project that really needs it, I wouldn't complain. But as it is it's an unreasonable cost for the benefit for everyone but the platform owner. (Cost: obvious. Benefit: some hacks get harder, but with no essential change to what's possible in the way that memory protection or high-level programming languages change the game. E.g. instead of native code your hack uses https://en.wikipedia.org/wiki/Return-oriented_programming https://en.wikipedia.org/wiki/Return-oriented_programming .)