3 ms·

The browser is unique for using the JS virtual machine to sandbox its executed code. It's very different from running a downloaded executable.

• rdtsc 13y ago
  The browser is not unique. There are other virtual machines out there. There are slew of IPC mechanisms. OS facilities. Containers, virtualization, chroot environments. Maybe they are not practical for this particular problem but somehow saying browser is magic because it is using a scripting a language VM isn't true in general. Thinking about, heck, a browser can even execute downloadable executable as well -- that is the PNaCl framework.
  • derefr 13y ago
    I think what the parent meant, was that the browser is unique in actually having an attack surface (the JS VM sandbox) that has been hardened by millions of people hitting it with arbitrary foreign code all day. Just because something else on your system happens to be a virtual machine, does not mean its security has been ascertained to nearly this extent. I wouldn't expect, say, VMWare, or the OpenType rendering engine, to hold up if millions of people were throwing arbitrary foreign code at them each day. But people don't--the code these VMs see is mostly trusted code they either created themselves, or got from a reputable source, and it's heavily the same 1000-2000 blobs.
• judk 13y ago
  MacOS uses a sandbox security model for all major apps now--but automatically silently loads 3rd party iTunes plugins into iTunes app security context.