9 ms·
Looking at the holes and crocks of shit we see every damn day related to HTTP, HTML, JavaScript and the whole programming model that surrounds them, it's about
by meaty 14y ago
Looking at the holes and crocks of shit we see every damn day related to HTTP, HTML, JavaScript and the whole programming model that surrounds them, it's about time someone just shot it all and started again putting security and privacy first rather than playing whack-a-mole all the time.
Unfortunately I fear this is not possible based on the sheer momentum that this ball of sticky tape and string has.
I think the sheer number of articles that paper HN all the time over browser and protocol vulnerabilities, leaks and problems back up my assertion.
EDIT: just to add, my frustrations are based on having to spend 5 hours porting some JS code so it works properly on all browsers.
- lucian1900 14y agoAnything you replace it with will have tons of vulnerabilities as well. Formal verification might help, but that's entirely orthogonal to the programming model. Sure, it sucks to develop for. But it's not fundamentally impossible to make it secure and private.
- derleth 14y ago> it's about time someone just shot it all and started again putting security and privacy first rather than playing whack-a-mole all the time. I agree fully. So do the people working on Algol-68, PL/I, Multics, the Canon Cat, Plan 9, and, perhaps most relevant to this, Project Xanadu. (Esperanto probably deserves a mention here, but it's duking it out somewhere with Volapük, Ido, Interlingua, Loglan, and Lojban.)
- meaty 14y agoI think only the Plan 9 people have got the idea so far. The problem that has shot us as a race is that in the 1990s, technology became suddenly ubiquitous and whatever was lying around was glued together to fill a niche which took off before people had a chance to think about it and engineer something sound. An analogy perhaps: http://megaswf.com/s/2529389/ http://megaswf.com/s/2529389/
- eitland 14y agoGood point. A valid counterexample would be the well though out text book examples of minix (and gnu hurd) vs Linux. Sometimes paralysis by analysis is a bigger problem than bugs and bad architecture. And often the alternative to "usable" isn't "perfect" but "never shipped".
- meaty 14y agoGood counterexample.
- takluyver 14y agoAs a biologist, I've got to point out that our entire existence is based on evolution gluing together whatever was around to fill a niche, without thinking about proper engineering. Which is why, to give just one example, the nerves in our eyes run in front of the light sensitive cells, necessitating a blind spot where the nerve leaves the eye. More seriously, I think we as humans benefit much more from getting technological developments quickly, than we would by waiting years or decades for them to be soundly engineered first. I doubt we can even foresee all the possible problems until we start using things at a large scale.
- meaty 14y agoYeah and biology killed a lot of things in the process. On a microscopic timescale we want to avoid doing that with our software.
- deleted 14y ago[deleted]
- jl6 14y agoThis is a tempting option in so many situations, not just software. But it never works because you can never wipe the slate truly clean. The state of the world is dependent on the previous state of the world.
- majc2 14y agoYes, reminds me of this essay from Joel Spolsky: http://www.joelonsoftware.com/articles/fog0000000069.html http://www.joelonsoftware.com/articles/fog0000000069.html
- J_Darnley 14y agoJust removing javascript from a browser would cure most ills these days, and not all of them security issues.
- paulgb 14y agoLikewise, disabling the internet would do wonders for computer security.
- jayferd 14y agoThree guidelines for computer security: 1) Don't have a computer 2) Don't turn one on 3) For goodness' sake, don't connect one to a network.
- kamjam 14y agoNumber 3 is easily bypassed, I saw it down by Tom Cruise once in a movie where he simply abseiled into the room. True story.
- javajosh 14y agoI see that to other responses have taken the sarcastic route, and I was strongly tempted to join them. Instead, I'm going to control myself and respond to this as if it was serious. The simple fact is that there is a high demand for interactive applications. One of the best ways to distribute these applications is the web using JavaScript. If, for some reason, this distribution channel were removed (let's say it was removed by law) the demand would still be there, and the 'older' channel still remains - native apps. If the average person uses, say, 20 webapps heavily and a few hundred glancingly, and let's say that 10% of these survive the transition (probably a high figure) that's still a good handful of new native apps, each of them with their own security issues.
- J_Darnley 14y agoIt was serious apart from the fact that I know it would never happen and will see little support here due to this website's infatuation with JS. Every website that I see using JS these days would work much better with some GET or POST requests. Some examples: * Using JS to load the next page for instance. That should be a simple request to the server for a /page2/. * Using JS to change sort orders. Again a simple request for a new page should be made to the server. * Pages not loading a full list in one go but making several requests for more entries via JS. The server should just return one long page. * Searches not being sent to the server but using the browser to search which does a new search for every character. * The same searches above hijacking the back button so that I can go back one key from round -> roun -> rou -> ro ->r -> no search -> at last, back one page! * Images being hidden behind a javascript link when it should be a simple hyperlink to the image. As for every website writing their own native software, at least some that I can think of could be substituted for old ones. Think ftp (or better yet sftp) for uploading files.
- davedx 14y agoIt's an Internet Explorer vulnerability. Shell level IE exploits are one of the reasons Firefox and Chrome have done so well, because they're more secure. Don't paint every browser with the same brush.
- shin_lao 14y agoAn interesting statement, which would be more interesting if backed up by facts. All brothers are basically virtual machines running remote code, how could they be secure?
- meaty 14y agoYes I know but the sheer number of articles aggregated across all browsers point to the architecture of the web being completely flawed. Consequentially, they're all as bad as each other. "More secure" is subjective i.e. it's more secure to us public but who the hell knows there aren't 100 zero day's out there in the wild changing hands for thousands of dollars.
- cheald 14y agoI think you're being needlessly dismissive of how hard a problem it is. There are legitimate use cases for capturing mouse position. You could certainly make a secure browser, but you're also going to strip it of much of the functionality that we enjoy today. The problem doesn't exist because people just aren't paying attention to security, or because the entire architecture of the web is flawed. The problem exists because it's a damn hard problem to deliver arbitrary executable code to clients on demand and let them run it and do useful things with it without compromising security and privacy. The browser vendors have really stepped it up in the last few years, and it takes a very narrow view of the web to see otherwise.
- meaty 14y agoNot really. It's not a hard problem to solve if you start at the right end of it rather than retrospectively apply it. Capturing the mouse position is perhaps legitimate for an "application" but not necessarily a "document". The web conveniently has turned from an information medium into a catch all for pretty much every hack that is imaginable. That's where it's all fallen over. "documents" are now "applications". This has lead to all of the crocks of shit out there. Office VBA and programmable documents are in a similar state. I firmly believe we need to make the distinction between a document and an application and have appropriate sandboxes and/or virtualization for each. Documents deliver information. Applications deliver means of interaction.
- mattmanser 14y agoDo you know how hard that would be? It's not momentum, the browser is essentially a universal OS, the holes would still be there if you started again from scratch.
- meaty 14y agoYes I do know how hard that would be. I didn't say it would be easy. Actually the browser is a non-universal OS which has several vendor extensions and incompatibilities which poke you in the eye day after day. It's like the UNIX fragmentation in the 90's (OSF/1=Firefox, HPUX=Chrome, Solaris=IE, UNICOS=Opera). It's possible to build something without holes. You just have to hire the right people and actually think about it before adding shitty features.
- derleth 14y ago> OSF/1=Firefox, HPUX=Chrome, Solaris=IE, UNICOS=Opera Oh, this is fun: Xenix=lynx, BSD=Konqueror, Plan 9=Uzbl http://uzbl.org/ http://uzbl.org/
- killahpriest 14y agoStop being naive.
- duncans 14y ago> It's possible to build something without holes. You just have to... bozo bit: flipped
- deleted 14y ago[deleted]
- pixl97 14y ago>It's possible to build something without holes. http://www.schneier.com/blog/archives/2009/10/proving_a_compu.html http://www.schneier.com/blog/archives/2009/10/proving_a_comp... I'm guessing you're planning on releasing your document viewer/OS sometime around the head death of the universe.
- delano 14y agoThe world is a lovely, messy place.
- 7952 14y agoAre you suggesting that there is something uniquely vulnerable about web technologies? Problems occur at every level of the stack from the OS on the client up to the server software. The big advantage of that programming model is how different elements can be loosely coupled. You can fix a problem by swapping individual parts of the stack without changing the experience.
- meaty 14y agoYes, the data has code in it... Once that one is out, you're screwed. That applies to most of computer science ironically.
- CJefferson 14y agoI don't think that's unique to the web. Word and Excel documents have code in them. So do PDFs and PostScript files. At this point, other than plain text everything seems to have code in it.
- meaty 14y agoI did state in another reply that office VBA suffers the same problems. PostScript as well as you state. All these have been notoriously problematic formats with respect to security.
- brazzy 14y agoIf you think there is a clear and fundamental difference between data and code, you do not understand security.
- meaty 14y agoActually I do, to the point I have been appointed a couple of security positions in the past in the defence industry. Code is executable. Data is not. There should be no level of turing completeness. Taking C as an example, loading a char* with data that contains code and jumping to it or letting it overwrite the code segment is precisely where it breaks down. The same is true when your json payload contains a function or your css contains an expression. The main problem at the moment is that technologies freely interchange the two concepts. Code should be entirely immutable once compiled and data should not be executable.
- Yaggo 14y ago> EDIT: just to add, my frustrations are based on having to spend 5 hours porting some JS code so it works properly on all browsers. Tells nothing more than someone has written shitty code in the beginning.
- meaty 14y agoWell yes its shitty code that has to work on numerous old shitty browsers.
- Yaggo 14y ago> Looking at the holes and crocks of shit we see every damn day related to HTTP, HTML, JavaScript Many "browser vulnerabilities" (esp. non-IE) are actually vulnerabilities of Flash, an entirely different [and dying] platform.
- ams6110 14y agoThe problem is not the technology, it's human nature. There are a certain number of scumbags out there, who will lie, cheat, spy, eavesdrop, backstab, whatever it takes to get something for themselves. This has been going on since we've existed as a species and I see no reason to expect it to ever stop.
- meaty 14y agoAnd that's more of a reason not to execute code from them isn't it?
- dasil003 14y agoIf 20 years ago some clairvoyant genius had foreseen what web applications would become, and decided to create a sane and secure alternative, and by some miracle had managed to pull it off without falling into numerous tarpits owing to an unsinkable combination of intelligence, persistence and vision, it still never would have taken off because it would be too complicated to gain traction compared to the simplicity of HTML. The key thing you need to wrap your head around is that software ecosystems are not designed; they accrete and evolve organically, and no one has any power to change that.
- pjmlp 14y agoIt is called the desktop.
- dasil003 14y agoNo. The desktop is not cross-platform, cross-media and installation free. Your flippant dismissal of the real advances that the web brought to common computing renders your opinion moot.
- pjmlp 14y agoNeither is the web. As consultant, part of my job is to do web applications when the customers demand it, and web development is everything but cross-platform. The amount of hacks one has to write to have CSS, JavaScript and HTML working flawlessly across all desired operating systems, browser versions and handsets renders the cross-platform argument moot. As for installation free, the same is possible with the desktop applications as well.
- dasil003 14y agoThere's never been anything in the history of computing that is 10% as cross-platform and cross-media as the web. Your head is firmly embedded in the sand my friend.
- 14y ago
- drivebyacct2 14y agoBecause inventing something from scratch is a fool-proof way to have bug and exploit free code. What are you even doing these days that requires "porting JS code"? I haven't had to do that for ages and it was on poorly written JS to begin with.
- meaty 14y agoChanging the fundamentals at the core is what I'd like to see. This code has to work right down to ie6.
- jiggy2011 14y agoThat's more a problem with having to support IE6. If you redesigned a whole new ecosystem from scratch, you will still have IE6 users who don't support it so you'll have to provide a "fallback mode" anyway.
- kamjam 14y agoAnd you're complaining about crappy browser security and you're then supporting IE6? Why support such an outdated browser when you know it has numerous well documented and unpatched vulnerabilities? Yes, yes, I know, the powers that be need this support for some explainable support even though worldwide IE6 usage is <1% etc etc. Whatever, it's just not worth the hassle. Show them a message and tell them to upgrade or use an alternate browser. I refuse to take any work on (I was freelance until recently) which requires IE6 support, and is a specific question I ask at interview time.
- meaty 14y agoThose statistics are meaningless when a big chunk of the world is a darknet. Our client has 3,000 windows 2000/ie6 workstations still. None of these ever see the world wide web. The numbers are entirely irrelevant. 28% of our client base is on ie6. My point is that it shouldn't be an issue to start with.
- egeozcan 14y agoThe limited nature of the environment actually makes it much more secure and I'd guess that IE is not written in JavaScript. =)