Linked by David Adams on Wed 16th Apr 2008 15:58 UTC, submitted by supergear
IBM researcher Mark Dowd has outlined a Flash vulnerability that could allow for a rare cross-platform web-based exploit. Matasano Chargen uses a Super Mario metaphor, an example we can all relate to, to illuminate it.
Thread beginning with comment 309903
To view parent comment, click here.
To read all comments associated with this story, please click here.
To view parent comment, click here.
To read all comments associated with this story, please click here.
Member since:2006-01-10
Member since:2005-07-24
"given enough eyeballs, all bugs are shallow"
The premise of that claim: "Given enough eyeballs", is often taken as a given. Everyone who has done a security audit of Gnash, please raise your hand.
I'm a strong advocate of open source. But I would be remiss not to state that eyeballs per line of code can be quite variable.
Member since:2005-11-13
Member since:2006-01-26
How are such exploits unique to proprietary software?
I would say the lesson learned here for anyone who still believes that proprietary software is safer due to the closed-code is: It doesn't matter - someone with the know-how and determination will still figure out how the software works and find exploits.
Thus, open source has the advantage that *more* people can evaluate the source and find such flaws prior to compilation rather than via low level debugger and disassembly.
Also, if someone wanted to fix this in a mission critical environment before an official patch is available, they would be able to. Something that is not so easy with proprietary closed-source software.
edit: fixed wrong word in my sentence
Edited 2008-04-16 18:12 UTC
Member since:2006-09-01
The exploits they were talking about seem to have a lot to do with the Flash AVM, which just happens to be open source.
http://www.mozilla.org/projects/tamarin/
Member since:2005-07-06
Read Touvan's comment above, then read the article again. You will see that this exploit required detailed knowledge of the internal workings of the VM. If the VM had been closed source developing this exploit would have been more difficult.
Edited 2008-04-16 21:07 UTC
Member since:
2005-07-07
How are such exploits unique to proprietary software?