Linked by Thom Holwerda on Fri 20th Mar 2009 13:51 UTC, submitted by google_ninja
Privacy, Security, Encryption Fresh from winning the PWN2OWN contest yesterday, Charlie Miller has been interviewed by ZDNet. He talks about how Mac OS X is a very simple operating system to exploit due to the lack of any form of anti-exploit features. He also explains that the underlying operating system is much more important in creating a successful exploit than the bowser, why Chrome is so hard to hack, and many other things.
Thread beginning with comment 354162
To read all comments associated with this story, please click here.
The problem isn't any particular browser
by rajj on Fri 20th Mar 2009 17:47 UTC
rajj
Member since:
2005-07-06

The problem is that browsers in concert with javascript basically allow arbitrary code execution on your machine by potentially anyone on the planet. Call me skeptical, but making such a thing secure _and_ convenient at the same time seems like an intractable problem, and no amount of indirection is going to change that.

Reply Score: 2

google_ninja Member since:
2006-02-05

Javascript is used as a dom scripting language though, so its not arbitrary code. To get arbitrary code to run, it is embed and object tags, plus some kind of browser bug to get it to execute the plugin outside of any sort of sandbox.

Reply Parent Score: 2

rajj Member since:
2005-07-06

I should have said arbitrary input, but I don't think you can say that javascript is strictly restricted to DOM manipulation either.

The point stands; the end result of all of this is endless turd polishing. We start with a turd; we end with a smoother turd, but it's still a turd nevertheless.

Reply Parent Score: 2