News for hackers. Stuff that matters.

A comment on A Message about iOS Security. Parent comment

Re:A Message about iOS Security by saagarjha on Friday September 06, 2019 @01:46PM (#20897863)
The point of a browser's security model is to make it so that "remote code execution" does not mean "arbitrary remote code execution with elevated privileges".
[ Parent | on HN ]
Re:A Message about iOS Security by 693471 on Friday September 06, 2019 @01:54PM (#20897966)
If we really cared we'd only ship data and not code
[ Parent | on HN ]
Re:A Message about iOS Security by saagarjha on Friday September 06, 2019 @01:56PM (#20897990)
That's assuming that parsers don't have bugs in them.
[ Parent | on HN ]
Re:A Message about iOS Security by lonelappde on Friday September 06, 2019 @02:37PM (#20898454)
Code is data. There is no technical difference, only human interpretative models.
[ Parent | on HN ]
Re:A Message about iOS Security by jcranberry on Friday September 06, 2019 @04:13PM (#20899465)
He's obviously talking about shipping only non-executable data.
[ Parent | on HN ]
Re:A Message about iOS Security by 693471 on Friday September 06, 2019 @05:58PM (#20900281)
Correct
[ Parent | on HN ]
Re:A Message about iOS Security by stordoff on Friday September 06, 2019 @07:15PM (#20900724)
Still, is there a difference? If there is a bug in the parser, trip it and what was once non-executable might be executable.
[ Parent | on HN ]
Re:A Message about iOS Security by allset_ on Saturday September 07, 2019 @12:39AM (#20901817)
Yes. Without executable client side code you can't do things like heap spraying.
[ Parent | on HN ]
Re:A Message about iOS Security by saagarjha on Saturday September 07, 2019 @01:51AM (#20902049)
Oh, you totally can. You just have to do it by tricking the parser into going it for you.
[ Parent | on HN ]