4 ms·
> the deal has been simple: you click a link, arbitrary code runs on your device, and a stack of sandboxes keeps that code from doing anything nasty. At most,
by jMyles 6mo ago
> the deal has been simple: you click a link, arbitrary code runs on your device, and a stack of sandboxes keeps that code from doing anything nasty.
At most, Mythos has reminded us that this "deal" is subject to frequent cycles of being compromised-and-patched.
From time to time, I have run browsers configured for opt-in javascript (eg, umatrix), but man it's a lot of work to live that way.
- robocat 6mo agoAnd JavaScript is only one vector. Heaps of prior examples of buffer overruns processing image formats, or the FFmpeg mentioned by Anthropic's Mythos article. Admittedly JavaScript is often used as part of a chain to simplify attack (e.g. repeating heap spray to attack a use-after-free reliably). The interesting part is that Anthropic have talked about automating finding vulnerabilities and also automating exploitation of those vulnerabilities.