News for hackers. Stuff that matters.

A comment on Hackers used zerodays to infect Windows, iOS, and Android users. Parent comment

Re:Hackers used zerodays to infect Windows, iOS, and Android... by sneak on Friday March 19, 2021 @05:48AM (#26511552)
I saw; such a security-focused browser would naturally use only local, trusted fonts and strongly sandbox media playback/decode of any kind, probably in a different process.

We need slow and safe before we can have fast and safe. Either is better than the fast and unsafe we have now.

We should probably unfuck the dangerous morass that is turing-complete font file formats at some point, too.

[ Parent | on HN ]
Re:Hackers used zerodays to infect Windows, iOS, and Android... by novok on Friday March 19, 2021 @01:48PM (#26516272)
The direction of webdev is webasm delivering full almost-desktop level apps and SPAs vs the documents with some minor scripting of the past.

Slow & safe javascript will simply not be adopted by the market because there is zero incentive to do so. Change the incentives and you will get the change you want.

[ Parent | on HN ]
Re:Hackers used zerodays to infect Windows, iOS, and Android... by floatboth on Friday March 19, 2021 @06:21AM (#26511743)
Firefox at least uses the wasm sandbox for Graphite, the really fancy turing-complete font thing:

https://hacks.mozilla.org/2020/02/securing-firefox-with-weba...

Same with Ogg container parsing.

[ Parent | on HN ]