5 ms·
It's an Internet Explorer vulnerability. Shell level IE exploits are one of the reasons Firefox and Chrome have done so well, because they're more secure. Don't
by davedx 14y ago
It's an Internet Explorer vulnerability. Shell level IE exploits are one of the reasons Firefox and Chrome have done so well, because they're more secure. Don't paint every browser with the same brush.
- shin_lao 14y agoAn interesting statement, which would be more interesting if backed up by facts. All brothers are basically virtual machines running remote code, how could they be secure?
- meaty 14y agoYes I know but the sheer number of articles aggregated across all browsers point to the architecture of the web being completely flawed. Consequentially, they're all as bad as each other. "More secure" is subjective i.e. it's more secure to us public but who the hell knows there aren't 100 zero day's out there in the wild changing hands for thousands of dollars.
- cheald 14y agoI think you're being needlessly dismissive of how hard a problem it is. There are legitimate use cases for capturing mouse position. You could certainly make a secure browser, but you're also going to strip it of much of the functionality that we enjoy today. The problem doesn't exist because people just aren't paying attention to security, or because the entire architecture of the web is flawed. The problem exists because it's a damn hard problem to deliver arbitrary executable code to clients on demand and let them run it and do useful things with it without compromising security and privacy. The browser vendors have really stepped it up in the last few years, and it takes a very narrow view of the web to see otherwise.
- meaty 14y agoNot really. It's not a hard problem to solve if you start at the right end of it rather than retrospectively apply it. Capturing the mouse position is perhaps legitimate for an "application" but not necessarily a "document". The web conveniently has turned from an information medium into a catch all for pretty much every hack that is imaginable. That's where it's all fallen over. "documents" are now "applications". This has lead to all of the crocks of shit out there. Office VBA and programmable documents are in a similar state. I firmly believe we need to make the distinction between a document and an application and have appropriate sandboxes and/or virtualization for each. Documents deliver information. Applications deliver means of interaction.
- ako 14y agoApparently there is a need to deliver documents with interaction. A browser is an application that delivers information, which delivers interaction... It's a mess, real world is never clean. And it's always changing...
- meaty 14y agoBack in the old days they wrote software which wrote documents (in fact the company I work for actually does this) and wrote software which parsed documents. If you need to interact with a document, you write an application which processes it and creates another document! That neatly assumes that documents are data and not code.
- brazzy 14y agoExcept that any "software which parses documents" is essentially an interpreter that runs code which it calls "documents".
- meaty 14y agoShould documents be Turing complete?
- Cthulhu_ 14y agoThey don't need to be in order to have weaknesses; just look at all the security problems coming from Adobe's PDF reader, which afaik can't execute code, but where the input (PDF documents), if cleverly crafted, can create buffer overflows allowing for arbitrary code execution.
- meaty 14y agoPDF files are code. They are a variant of postscript which is a Turing complete language. People have written web servers in postscript I understand. The issue you state is a property of three things: 1. The underlying language/vm allows code and data to be interchanged (c++). 2. The underlying vm allows memory to be overwritten and buffer lengths to be exceeded to start with. 3. Pdf allows arbitrary code to execute on your computer. My point demonstrated.
- r00fus 14y agoInteresting - would this vulnerability exist when running IE rendering engine through, say IETab or via other browser shells, a la Maxthon?