OSNews

Thank you for my chance to say why:

Pwn2Own have the clean rules, with increasing exposure of way to attack a machine, the attacker should get user data. Your post was: is not a big vulnerability as it doesn't do much worse as a root kit let's say. Pwn2Own tries to expose the security leaks in security model of the user land applications, mostly the browser and it's component as is the default application you may find in mostly every OS, even into a phone OS one, and in one way it do it really well.

The inaccuracy comes that probably the security is done by saving data, not applications. Is hard to do from userland a change of executables in Linux or using OS X limited user (or guest) or even XP limited account.

The most permissions tries to protect credentials and data and most of security tries also to do the same thing (Active Directory's permissions or better SELinux or AppArmor force the application in case of a buffer overflow or any other break, that may happen) to save data, not applications.

So for me it seems (with no offense, as you are a OSNews webmaster and you with Eugenia creates the OSNews site and I respect this deeply on you!) that you remember the security as a flaw of OS as it was in Windows 98-XP era, when viruses (all mallware) and scamware was the biggest problem.

So based on this thoughts I've seen that your post seems misleading... tell me if I'm wrong.

Edit: I'm not native English speaker so I've did fixes here and there

Edited 2009-03-20 23:51 UTC