News for hackers. Stuff that matters.
Re:Linus Torvalds: “Do No Harm” by quink on Wednesday November 22, 2017 @04:07AM (#15755428)
I'm reminded of a recent security fix for IE11 that Microsoft pushed out earlier this year:

https://developer.microsoft.com/en-us/microsoft-edge/platfor...

It killed printing from iframes completely. Great that they solved the security problem, whatever it may have been. They also broke a major piece of browser functionality that a lot of enterprises rely on fundamentally. Hell, even printing shipping labels from eBay was broken, and so was hilariously Microsoft Dynamics 365. And our own product.

And the first response by Microsoft on this very link? "Won't Fix" and keep a major bit of fundamental browser functionality - printing a document - not working. "Do No Harm".

Re:Linus Torvalds: “Do No Harm” by pjmlp on Wednesday November 22, 2017 @05:39AM (#15755819)
Because there is a workaround, applications just need to be updated.

"Either use Print Preview instead of print button or if currently using window.print() in javascript change this to document.execCommand('print’, false, null)"

Re:Linus Torvalds: “Do No Harm” by AnIdiotOnTheNet on Wednesday November 22, 2017 @10:37AM (#15757567)
> Because there is a workaround, applications just need to be updated.

What actually happened: people reverted the patch. In the real world, you can't expect timely or even correct response from vendors you rely on. It sucks, but it's how it is.

Re:Linus Torvalds: “Do No Harm” by torpcoms on Thursday November 23, 2017 @08:15AM (#15764802)
Then after you get compromised in some way, you will start to look for better vendors.
Re:Linus Torvalds: “Do No Harm” by AnIdiotOnTheNet on Thursday November 23, 2017 @12:05PM (#15766363)
Only if the cost*risk of a future compromise is > cost of replacing the product. This is rarely going to be the case for business critical software.
Re:Linus Torvalds: “Do No Harm” by quink on Wednesday November 22, 2017 @03:14PM (#15760164)
> applications just need to be updated

Updated away from web standards to false and null and random string. And then they made window.print work again.

Additionally what guarantee was there that execCommand(magicString) where magicString is `print` wouldn’t be removed in the next security “fix” because the security fix should have broken this too as it did window.print? After all, it seems to do the same thing. Answer: none at all and then you’re back to square one.