4 ms·
Yes I know but the sheer number of articles aggregated across all browsers point to the architecture of the web being completely flawed. Consequentially, they'
by meaty 14y ago
Yes I know but the sheer number of articles aggregated across all browsers point to the architecture of the web being completely flawed.
Consequentially, they're all as bad as each other.
"More secure" is subjective i.e. it's more secure to us public but who the hell knows there aren't 100 zero day's out there in the wild changing hands for thousands of dollars.
- cheald 14y agoI think you're being needlessly dismissive of how hard a problem it is. There are legitimate use cases for capturing mouse position. You could certainly make a secure browser, but you're also going to strip it of much of the functionality that we enjoy today. The problem doesn't exist because people just aren't paying attention to security, or because the entire architecture of the web is flawed. The problem exists because it's a damn hard problem to deliver arbitrary executable code to clients on demand and let them run it and do useful things with it without compromising security and privacy. The browser vendors have really stepped it up in the last few years, and it takes a very narrow view of the web to see otherwise.
- meaty 14y agoNot really. It's not a hard problem to solve if you start at the right end of it rather than retrospectively apply it. Capturing the mouse position is perhaps legitimate for an "application" but not necessarily a "document". The web conveniently has turned from an information medium into a catch all for pretty much every hack that is imaginable. That's where it's all fallen over. "documents" are now "applications". This has lead to all of the crocks of shit out there. Office VBA and programmable documents are in a similar state. I firmly believe we need to make the distinction between a document and an application and have appropriate sandboxes and/or virtualization for each. Documents deliver information. Applications deliver means of interaction.
- ako 14y agoApparently there is a need to deliver documents with interaction. A browser is an application that delivers information, which delivers interaction... It's a mess, real world is never clean. And it's always changing...
- meaty 14y agoBack in the old days they wrote software which wrote documents (in fact the company I work for actually does this) and wrote software which parsed documents. If you need to interact with a document, you write an application which processes it and creates another document! That neatly assumes that documents are data and not code.
- brazzy 14y agoExcept that any "software which parses documents" is essentially an interpreter that runs code which it calls "documents".
- meaty 14y agoShould documents be Turing complete?
- Cthulhu_ 14y agoThey don't need to be in order to have weaknesses; just look at all the security problems coming from Adobe's PDF reader, which afaik can't execute code, but where the input (PDF documents), if cleverly crafted, can create buffer overflows allowing for arbitrary code execution.
- meaty 14y agoPDF files are code. They are a variant of postscript which is a Turing complete language. People have written web servers in postscript I understand. The issue you state is a property of three things: 1. The underlying language/vm allows code and data to be interchanged (c++). 2. The underlying vm allows memory to be overwritten and buffer lengths to be exceeded to start with. 3. Pdf allows arbitrary code to execute on your computer. My point demonstrated.
- Yaggo 14y ago> I firmly believe we need to make the distinction between a document and an application and have appropriate sandboxes and/or virtualization for each. You can go back to 1993 and turn your web application platform (a.k.a browser) into simple document reader by disabling javascript (+ plugins, whoever keeps them enabled anyway). Good luck with that.
- kyllo 14y agoOddly enough IE is the browser that seems to keep the option of disabling Javascript buried the deepest within their context menus. In Firefox it's just Preferences -> Content -> uncheck "Enable Javascript" (I do this to avoid NYTimes' paywall, lol) but in IE you have to scroll through an exceedingly long list of checkboxes that's a couple levels deep into their menus to find "Disable active scripting" because they still refuse to call it Javascript. I always forget where it is and have to hunt for it every time. Obnoxious.
- yuhong 14y agoYou are suppose to set the security level of the Internet zone to "High" (the default on Windows Server), or add the sites needed to the "Restricted Sites" zone.
- cheald 14y agoYou might enjoy elinks.
- meaty 14y agoelinks supports JavaScript via SpiderMonkey so no.