Linked by Thom Holwerda on Fri 20th Mar 2009 13:51 UTC, submitted by google_ninja
Privacy, Security, Encryption Fresh from winning the PWN2OWN contest yesterday, Charlie Miller has been interviewed by ZDNet. He talks about how Mac OS X is a very simple operating system to exploit due to the lack of any form of anti-exploit features. He also explains that the underlying operating system is much more important in creating a successful exploit than the bowser, why Chrome is so hard to hack, and many other things.
Thread beginning with comment 354126
To view parent comment, click here.
To read all comments associated with this story, please click here.
RE[2]: Comment by sadyc
by foljs on Fri 20th Mar 2009 14:54 UTC in reply to "RE: Comment by sadyc"
foljs
Member since:
2006-01-09

Why?

Apple decided not to release their code, why would they have a right to know the exploits other people find for them?

They've chosen that model, now they have to deal with the downsides.


Do you even know what you're talking about?

Safari's engine (Webkit) is released as fully open source --and it's used by many other browsers, including Google Chrome.

Reply Parent Score: 3

RE[3]: Comment by sadyc
by wanderingk88 on Fri 20th Mar 2009 15:10 in reply to "RE[2]: Comment by sadyc"
wanderingk88 Member since:
2008-06-26

A web browser is not just its rendering engine.

If it was, Chrome would have the same vulnerabilities as Safari.

Please learn to shut up when you don't know what you're talking about.

Reply Parent Score: 3

RE[4]: Comment by sadyc
by Vanders on Fri 20th Mar 2009 16:33 in reply to "RE[3]: Comment by sadyc"
Vanders Member since:
2005-07-06

Depends on what the vulnerability is. If you can find a way to use a bug in the way that a CSS file is parsed (As an example) you'll probably find you could craft an exploit that would work on most of the browsers that use that Webkit.

Reply Parent Score: 2

RE[4]: Comment by sadyc
by tyrione on Fri 20th Mar 2009 18:13 in reply to "RE[3]: Comment by sadyc"
tyrione Member since:
2005-11-21

A web browser is not just its rendering engine.

If it was, Chrome would have the same vulnerabilities as Safari.

Please learn to shut up when you don't know what you're talking about.


Chrome runs on Windows. The hacker was citing/implying that the randomization support in Windows is the reason Chrome gains that security.

Chrome on OS X would have that vulnerability, until 10.6 arrives.

Reply Parent Score: -1

RE[4]: Comment by sadyc
by bousozoku on Sat 21st Mar 2009 06:23 in reply to "RE[3]: Comment by sadyc"
bousozoku Member since:
2006-01-23

A web browser is not just its rendering engine.

If it was, Chrome would have the same vulnerabilities as Safari.

Please learn to shut up when you don't know what you're talking about.


If a vulnerability lies in WebKit, what about open source would say that Google didn't modify WebKit?

You're right that Safari isn't totally open source but that doesn't mean that the vulnerabilities aren't in the open source portions.

I don't use Safari on either platform because I don't trust Apple since they don't seem to care. Mozilla's Firefox developers care more but there are still plenty of vulnerabilities and it's completely open source and users still get hosed.

Reply Parent Score: 2