Linked by Kroc Camen on Sat 17th Oct 2009 05:27 UTC
Microsoft Whilst it's not okay in Microsoft's eyes for Google to install a plugin into Internet Explorer, increasing the potential surface area of attack, when Microsoft do it to Firefox, it's a different matter. Now a security hole has been found in a plugin that Microsoft have been silently installing into Firefox.
Permalink for comment 389777
To read all comments associated with this story, please click here.
RE[3]: Opt-in
by Erunno on Sat 17th Oct 2009 10:49 UTC in reply to "RE[2]: Opt-in"
Erunno
Member since:
2007-06-22

Chrome and Safari on Snow Leopard place plugins on their own thread and in a sandboxed environment, which helps; but ultimately the whole nature of plugins is completely flawed and unsafe from the get-go.


Actually, both run plug-ins in separate processes and not threads. Chrome does not use a sandbox for them as Google encountered too many compatibility problems to be turned on by default. To lessen the attack area at least somewhat Google lets the process which does the IPC run with minimal rights. While the plug-in can still wreck havoc this way at least Chrome itself is somewhat secured.

Edited 2009-10-17 10:52 UTC

Reply Parent Score: 4