Re:Microsoft embeds nagware into IE patch
by userbinator on Friday March 11, 2016 @06:30AM
(#11265966)
"remotely exploitable" usually means "visit a suspicious website in IE with all the default settings, including JavaScript, enabled".
don't recommend that they turn off windows updates.
...unless you also recommend they use a different browser (e.g. FireFox with NoScript) and don't use the default settings. IMHO the amount of bugs that remain remotely exploitable with such a configuration (or even just IE with most of the extra stuff turned off) is reduced to be essentially none --- and if one does show up, like the WMF exploit (remember that?) you'll probably be able to install a patch just for it. IE has a Trusted Sites functionality, so you can whitelist the sites that really need that stuff if you must use it, with other random sites on the Internet being allowed much less exploitable functionality.
That said, I hope someone figures out the security-relevant portion of the update and how to patch out the other crap. But then again, with what Windows is these days, the binaries are probably signed and there will be tons of other hoops to jump through to get that to work...
don't recommend that they turn off windows updates.
...unless you also recommend they use a different browser (e.g. FireFox with NoScript) and don't use the default settings. IMHO the amount of bugs that remain remotely exploitable with such a configuration (or even just IE with most of the extra stuff turned off) is reduced to be essentially none --- and if one does show up, like the WMF exploit (remember that?) you'll probably be able to install a patch just for it. IE has a Trusted Sites functionality, so you can whitelist the sites that really need that stuff if you must use it, with other random sites on the Internet being allowed much less exploitable functionality.
That said, I hope someone figures out the security-relevant portion of the update and how to patch out the other crap. But then again, with what Windows is these days, the binaries are probably signed and there will be tons of other hoops to jump through to get that to work...