News for hackers. Stuff that matters.
Re:Update Regarding Add-Ons in Firefox by dwaite on Saturday May 04, 2019 @02:07PM (#19828124)
Typically software signatures are not just pass/fail, but used to give audited entitlements for API.

So a secure system would let you run Doom, but could forbid:'

- Access to the filesystem outside the application domain due to potential for exfiltrating or destroying user data

- Likewise, access to global system data may be limited

- Access to the network due to (raw TCP/UDP) traffic not having been audited for security, and the network connectivity being usable for exfiltration

- Access to run full-screen due to the ability to perform user phishing attacks by presenting fake UI.

- The ability to disable system-registered keyboard sequences (on windows, such as the windows key or sticky keys)

- Access to mouse events outside its window

- Access to key scan data, although this likely will be emulated

- Access to change display color modes to e.g. 256 color indexed, although this will likely be emulated as well

Re:Update Regarding Add-Ons in Firefox by overgard on Saturday May 04, 2019 @04:04PM (#19828958)
Right but that's why we have sandboxes and virtual machines. There's no need to use a calendar date to enforce security.