News for hackers. Stuff that matters.

A comment on It’s time to kill the web app. Parent comment

Re:It’s time to kill the web app by smsm42 on Sunday September 24, 2017 @04:40AM (#15323926)
> I could disable ActiveX and Java and be reasonably confident that visiting a webpage would not pwn my computer

Unfortunately, this is not entirely true. There were bugs in image processing, PDF processing (some browsers would load it without user prompting), Flash, video decoders, etc. IIRC even in JS engines, though those are more rare. Of course, you could go text-only, but then you couldn't properly access about 99% of modern websites.

[ Parent | on HN ]
Re:It’s time to kill the web app by rtpg on Sunday September 24, 2017 @04:49AM (#15323944)
When there would be a bug in PDF processing, you end up with a RCE, right?

But downloading an EXE is basically allowing arbitrary code execution on your machine no matter what. So _even with the security bugs_, webapps are basically safer than installing a native app on desktop, at least in its current state.

I see your point though. There are still a lot of entry points we need to be careful about

[ Parent | on HN ]
Re:It’s time to kill the web app by pjmlp on Sunday September 24, 2017 @01:45PM (#15325685)
It doesn't help that curl | sh has become trendy.
[ Parent | on HN ]
Re:It’s time to kill the web app by tinus_hn on Sunday September 24, 2017 @08:54AM (#15324502)
The Javascript security model breaks down in the case of file:///, no overflows are required. The security you get today is more flimsy than you probably think. And it used to be far worse.
[ Parent | on HN ]