Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I discovered a browser bug

jakearchibald.com

Post reply on HN
Print view View original

11–20 of 137 posts

Re: I discovered a browser bug

#11

Post by dec0dedab0de »

yoz-y wrote: post #9
WorkLifeBalance wrote: post #6

Earlier quoted context omitted.

Do you want to reinforce established monopolies? Because I can't think of a better way of doing that than having a technical difference between "trusted" and "untrusted" sites.

What about differentiating applications and web sites? The line between the two is blurry, I know, but I would be happy if the document metaphor were divorced from the application one.

Absolutely, there should be a different port for web pages than applications. Even if we started by disabling js on port 80

Re: I discovered a browser bug

#12

Post by krapp »

dec0dedab0de wrote: post #11
yoz-y wrote: post #9

Earlier quoted context omitted.

What about differentiating applications and web sites? The line between the two is blurry, I know, but I would be happy if the document metaphor were divorced from the application one.

Absolutely, there should be a different port for web pages than applications. Even if we started by disabling js on port 80

But what about applications that link to web pages or web pages that link to applications?

What valid reason is there to have an "application" and any documentation or related HTML material from the same site on different ports? Or, as some have pointed out elsewhere when this has come up, to have "applications" and "documents" use completely different protocols, languages and native clients, when both are often used together?

Re: I discovered a browser bug

#13

Post by _bxg1 » 

  For example, the request may have the following header:
  Range: bytes=50-100
  …which is requesting bytes 50-100 (inclusive) of the resource.
I haven't finished the article, but I've seen how this movie ends...

Re: I discovered a browser bug

#14

Post by felix_nagaand »

simion314 wrote: post #4
obl wrote: post #2

It's quite incredible how the web managed to get along with such a janky sandbox model. It's a very important thing that users trust their browser and won't hesitate a second to enter an unknown URL. They see "going to a webpage" as the equivalent to looking at a poster in the street, not eating candy provided by a random stranger. Eroding this trust would ruin it for everyone, even well behaved static websites witho…

I use a private window for banking/paypal , I don't trust the extensions or the other tabs so for this cases I get more security.

That hardly helps. For true security devote a device purely to banking. Preferably a diskless device running an updated live CD on a security oriented distro with no rewritable storage attached connecting out over a VPN through an equally dedicated firewalled router. Then you're just left to worry about your bioses getting infected off an unpatched or 0d exploit.

Re: I discovered a browser bug

#15

Post by makmanalp »

obl wrote: post #2

It's quite incredible how the web managed to get along with such a janky sandbox model. It's a very important thing that users trust their browser and won't hesitate a second to enter an unknown URL. They see "going to a webpage" as the equivalent to looking at a poster in the street, not eating candy provided by a random stranger. Eroding this trust would ruin it for everyone, even well behaved static websites witho…

The web didn't used to be able to do much, and we're using browsers that depended on tons of multi-decade old code, so I see how it happened. Agreed on the main point though.

Re: I discovered a browser bug

#18

Post by r3bl »

felix_nagaand wrote: post #14
simion314 wrote: post #4

Earlier quoted context omitted.

I use a private window for banking/paypal , I don't trust the extensions or the other tabs so for this cases I get more security.

That hardly helps. For true security devote a device purely to banking. Preferably a diskless device running an updated live CD on a security oriented distro with no rewritable storage attached connecting out over a VPN through an equally dedicated firewalled router. Then you're just left to worry about your bioses getting infected off an unpatched or 0d exploit.

He identified his threat model (other tabs + addons doing something shady) and made a security assessment based off of it.

You're here bullshitting that he needs "true security" like he's dealing with APTs trying to access his bank account. He's not. He's concerned about other tabs + addons, and private browsing mode is a solution with the slightest friction for his threat model.

Please, in the future, try making security assessments based on the actual threat model.

EDIT: "threat" instead of "thread".

Re: I discovered a browser bug

#19

Post by Retric »

krapp wrote: post #12
dec0dedab0de wrote: post #11

Earlier quoted context omitted.

Absolutely, there should be a different port for web pages than applications. Even if we started by disabling js on port 80

But what about applications that link to web pages or web pages that link to applications? What valid reason is there to have an "application" and any documentation or related HTML material from the same site on different ports? Or, as some have pointed out elsewhere when this has come up, to have "applications" and "documents" use completely different protocols, languages and native clients, when both are often used…

'Application' can be backward compatible with documents just fine. That does not mean a new category 'Document' that has reduced capability is useless.

Banking websites for example don't need to be Applications and added protection for cross-site scripting etc. would be beneficial. Restrict things further and you default to supporting screen readers etc.

Re: I discovered a browser bug

#20

Post by obl »

WorkLifeBalance wrote: post #6
obl wrote: post #2

It's quite incredible how the web managed to get along with such a janky sandbox model. It's a very important thing that users trust their browser and won't hesitate a second to enter an unknown URL. They see "going to a webpage" as the equivalent to looking at a poster in the street, not eating candy provided by a random stranger. Eroding this trust would ruin it for everyone, even well behaved static websites witho…

Do you want to reinforce established monopolies? Because I can't think of a better way of doing that than having a technical difference between "trusted" and "untrusted" sites.

Well, I personally would be fine with the fair policy of disabling js everywhere but I'm sure most would not agree, so what's the alternative ?

If anything, Spectre class attacks really showed how hard it is to properly sandbox arbitrary programs.

Yes, the CPUs are complex, but the attacks happen on a high conceptual level, level at which the CPU is fairly simple. It's not like they rely on an obscure detail or bug.

No one (publicly) figured those out for 2 decades when the involved ideas (speculation, cache timings) are well known, common and did not change.

This indicates that for something with such a large surface as the various web standards, where both the spec and the implementations are changing all the time, there is very little hope.

Post reply on HN