3 ms·
I'm more worried about AV software. Code that also needs to be able to parse a large number of file formats, opens every file that enters your computer through
by Aaargh20318 3mo ago
I'm more worried about AV software. Code that also needs to be able to parse a large number of file formats, opens every file that enters your computer through one of many pathways, and generally runs at a high privilege level.
A huge attack surface that's easy to reach and with far reaching consequences if it can be exploited. Add to this that it's in wide use, often even mandated by corporate IT and its recipe for disaster.
- ignoramous 3mo ago> I'm more worried about AV software Media codecs pretty much, single-handedly even, drove about a new era of defenses and mitigations in Android: https://blog.isosceles.com/the-legacy-of-stagefright https://blog.isosceles.com/the-legacy-of-stagefright / https://archive.vn/x3d0Y https://archive.vn/x3d0Y
- cozzyd 3mo agoAV as in antivirus, not audio/visual
- mackman 3mo agoIn theory the parsing could run at a low privilege level subprocess. Root/admin is only needed to get the bytes.
- tatersolid 3mo agoThat’s generally too slow though; these things run in kernel space as they scan every I/O stream. Context switching and memory copies would kill performance.
- formerly_proven 3mo agohttps://i.imgur.com/t5jDXrt.png https://i.imgur.com/t5jDXrt.png "Why don't we unpack malware in the kernel" - "And so the search for intelligent life continues..."