4 ms·
Are you suggesting that there is something uniquely vulnerable about web technologies? Problems occur at every level of the stack from the OS on the client up
by 7952 14y ago
Are you suggesting that there is something uniquely vulnerable about web technologies? Problems occur at every level of the stack from the OS on the client up to the server software. The big advantage of that programming model is how different elements can be loosely coupled. You can fix a problem by swapping individual parts of the stack without changing the experience.
- meaty 14y agoYes, the data has code in it... Once that one is out, you're screwed. That applies to most of computer science ironically.
- CJefferson 14y agoI don't think that's unique to the web. Word and Excel documents have code in them. So do PDFs and PostScript files. At this point, other than plain text everything seems to have code in it.
- meaty 14y agoI did state in another reply that office VBA suffers the same problems. PostScript as well as you state. All these have been notoriously problematic formats with respect to security.
- brazzy 14y agoIf you think there is a clear and fundamental difference between data and code, you do not understand security.
- meaty 14y agoActually I do, to the point I have been appointed a couple of security positions in the past in the defence industry. Code is executable. Data is not. There should be no level of turing completeness. Taking C as an example, loading a char* with data that contains code and jumping to it or letting it overwrite the code segment is precisely where it breaks down. The same is true when your json payload contains a function or your css contains an expression. The main problem at the moment is that technologies freely interchange the two concepts. Code should be entirely immutable once compiled and data should not be executable.
- zmj 14y agoHow do you implement an interactive page under that model?
- loungin 14y agoMaybe we should think about moving away from interactive pages. What does all that interaction get us, really?
- drivebyacct2 14y ago>Actually I do, to the point I have been appointed a couple of security positions in the past in the defence industry. >Code is executable. >Data is not. There should be no level of turing completeness. I'm sorry for the defence industry.