News for hackers. Stuff that matters.

A comment on On VBScript.

Re:On VBScript by qwerty456127 on Wednesday December 19, 2018 @09:35PM (#18722044)
> Windows 10 Fall Creators Update, Microsoft disabled VBScript execution in Internet Explorer in the Internet Zone and the Restricted Sites Zone by default

I'm very surprised this hasn't been done a decade ago.

[ Parent | on HN ]
Re:On VBScript by codeflo on Thursday December 20, 2018 @06:30AM (#18724027)
At this point, it's probably safe to assume that every feature in Windows that hasn't been touched for the last decade has severe security problems. And it's not only Microsoft -- maybe their approach to backwards compatibility makes them especially vulnerable, but similar things have happened in the free software ecosystem as well. It's basically a very insidious form of bitrot.

So what's the lesson here? Aggressively remove old features, as you suggest? Rewrite everything every few years? Software has become way too complex to closely audit everything forever...

[ Parent | on HN ]
Re:On VBScript by pjmlp on Thursday December 20, 2018 @09:10AM (#18724975)
Security only works properly when applied to all layers.

It is very educative to read about security models on Multitics, ClearPath, System 360/370, OS/400 among many other similar systems, their attack vectors, and what we ended up getting by having winner takes it all with UNIX based systems.

This year we celebrated 30 years of Morris worm.

[ Parent | on HN ]
Re:On VBScript by watersb on Thursday December 20, 2018 @08:34PM (#18730822)
> This year we celebrated 30 years of Morris worm.

Wow. That was one hell of a night. Melted down our university computer labs, packed with desperate undergrads trying to complete and turn in their projects before midnight deadline...

[ Parent | on HN ]
Re:On VBScript by fujimotos on Saturday December 22, 2018 @08:44AM (#18740529)
> Melted down our university computer labs

How did admins manage to disinfect servers? It should have been a hell of fun for them, provided it was the first pandemic ever.

[ Parent | on HN ]
Re:On VBScript by watersb on Wednesday December 26, 2018 @05:47PM (#18765566)
https://news.ycombinator.com/item?id=5302924

Hard reboot with email server disabled.

[ Parent | on HN ]
Re:On VBScript by giancarlostoro on Thursday December 20, 2018 @07:55AM (#18724481)
> but similar things have happened in the free software ecosystem as well.

Shellshock comes to mind.

https://en.wikipedia.org/wiki/Shellshock_(software_bug)

[ Parent | on HN ]