21–30 of 159 posts
Tragedy of our generation is that people who are so smart and determined to find and exploit these vulnerabilities, can't find better uses for their talents.
Well, Chrome is indeed the new Internet Explorer. A new favorite target for threat actors.
Oh wait.
Tragedy of our generation is that people who are so smart and determined to find and exploit these vulnerabilities, can't find better uses for their talents.
Or, maybe downloading arbitrary code from the internet without even a same-origin check, and being able to dynamically construct executable JavaScript from downloaded binary data masked as image and then have a whole generation of developers depend on this model wasn't so good an idea after all.
Earlier quoted context omitted.
Or, maybe downloading arbitrary code from the internet without even a same-origin check, and being able to dynamically construct executable JavaScript from downloaded binary data masked as image and then have a whole generation of developers depend on this model wasn't so good an idea after all.
It enables SaaS and makes economic sense and sadly the latter is the only thing that matters when it comes to mass human behaviour.
Earlier quoted context omitted.
Or maybe society isn't providing them an accessible application for their talents.
Don't improve the product, just find dumber customers! Don’t lose weight, just buy bigger trousers! Don’t take personal responsibility, just blame society!
Earlier quoted context omitted.
The writer of this exploit was almost certainly paid more than the bug bounty reward.
Yeah, that’s a hard thing. Because the exploit is almost certainly worth more to the buyer than having it fixed is worth to Google.
For now, I hope. Google can and should pay equivalent amounts.
As I understand these RCEs (in general; perhaps not this particular one), a frequent root cause seems to be saving instruction pointer on the stack adjacent to untrustworthy data which may have propagated down the call chain. Are there no initiatives being attempted to change this convention? Like not save the IP on the stack? Perhaps at the CPU architecture level or at the compiler level?