Re:The modern HTTPS world has no place for old web servers
by gfxgirl on Wednesday May 13, 2020 @03:30PM
(#23170798)
It might be for this app but say the app displayed an image of the cloud cover. That image, from a MITM could be designed to exploit a know decoder bug (project zero just had a post about bunch they found in Apple's OSes). Browsers (or at least Chrome) run the image decompressors in the sandbox. Does Dashboard?
[ Parent
| on HN ]
Re:The modern HTTPS world has no place for old web servers
by xg15 on Wednesday May 13, 2020 @04:01PM
(#23171156)
If the threat model is random exploits, they can still do that. Heartbleed etc have shorn that even the TLS stack itself can contain catastrophic vulnerabilities, so it's likely there will show up more in the future.