3 ms·
Exactly my thought. The arbitrary code is executed only when the user tells to do so. This is not a bug, it is a feature. Computers are supposed to work like t
by niyazpk 17y ago
Exactly my thought.
The arbitrary code is executed only when the user tells to do so. This is not a bug, it is a feature. Computers are supposed to work like that.
Raymond Chen observes: (link: http://blogs.msdn.com/oldnewthing/archive/2008/05/16/8510192.aspx http://blogs.msdn.com/oldnewthing/archive/2008/05/16/8510192...)
It is not a security vulnerability that users with permission to shut down the computer can shut down the computer. This is another example of people getting excited that they were able to do something unusual. But just because you can do something unusual doesn’t mean that you’ve found a security vulnerability.
- scott_s 17y agoI thought of Raymond Chen, too! I Googled until I found the entry you found, but also this one (http://blogs.msdn.com/oldnewthing/archive/2006/05/08/592350.aspx http://blogs.msdn.com/oldnewthing/archive/2006/05/08/592350....), which has the observation: Code injection doesn't become a security hole until you have elevation of privilege. Chen's the one who originally made me realize the distinction between tricking someone into running a program, and an actual security vulnerability.