3 ms·

Things that do more have a larger attack surface.

• pyre 11y ago
  Exactly. This is why the argument of "well, you can't complain about Flash/Java exploits because the browser itself also has exploits too" is not valid. By adding Flash/Java to the browser you are increasing the attack surface of the browser "package" as a whole.
  • Silhouette 11y ago
    By adding Flash/Java to the browser you are increasing the attack surface of the browser "package" as a whole. By adding HTML5 video and now its DRM-related infrastructure, WebGL, and other features that developers used to use Flash/Java for, you are also increasing the attack surface of the browser "package" as a whole. The comparison is a perfectly reasonable one.
    • pyre 11y ago
      On the other hand, those will be separate implementations on different browsers, so it reduces the applicability of any one exploit. An exploit in Flash or Java becomes cross-browser.
      • Silhouette 11y ago
        On the other hand, those will be separate implementations on different browsers Unless more than one browser uses, say, the same video codecs, or the same third-party DRM-related module, or the same system services for doing hardware-accelerated 3D rendering. There may be some marginal advantage to having different implementations in different browsers, but marginal is probably all it is. Realistically, as things we used to do in the likes of Flash or Java move into browser-native implementations, there is still no reason to assume that the people writing those implementations will magically produce completely secure implementations where no-one ever has before.