Hackers used zerodays to infect Windows, iOS, and Android users

Post by anonymouse008 » Fri, Mar 19, 2021, 7:57 PM UTC

cutemonster wrote: post #110

jokoon wrote: post #80

I really don't understand why people decide to work in computer security, today it's really an arms race. I see how it's like games of lockpicking, but honestly I don't understand the value of it. It's like being in the arms trade: what matters is who you decide to trade with. Honestly, I'd rather see myself as anti-cyber-war at this point, like anti-war protests, meaning telling people to use computers for less crit…

> telling people to use computers for less critical tasks, and disengaging from certain areas. I think I a bit can understand how you think. Looking at some health care related apps, I was surprised to see how buggy they were (the user interface) and silly built, wrt security. On the other hand, without computers, the alternative seems to be that the health care staff picks up the phone and just assumes you are the o…

Post by trepatudo » Fri, Mar 19, 2021, 8:08 PM UTC

Post by mhh__ » Fri, Mar 19, 2021, 8:19 PM UTC

high_byte wrote: post #22

sneak wrote: post #11

How long until we realize that JIT was a mistake and that we should offer orders of magnitude slower JS in browsers that is actually safe (or start building webpages without JS at all again, which will probably never happen) lest we give every website the ability to take over our device? I'd pay real money for a browser with a slow, safe JS interpreter.

why do you assume an interpreter is any safer than JIT? kinda like saying arrays are better than matrices.

Post by lozaning » Fri, Mar 19, 2021, 8:41 PM UTC

caslon wrote: post #108

enkid wrote: post #51

Earlier quoted context omitted.

But these are attacks that worked across multiple systems. Heterogeneity is going to lead to more systems with less overall security work being done per system. Sure, using Firefox would have prevented the attacks we know about, but who's to say Google found all of the attacks. They exploit Chrome, Samsung browser, Windows, Android, iOS, and Safari. It seems silly to say "if we had one more, it would have stopped the…

> They exploit Chrome, Samsung browser, Windows, Android, iOS, and Safari. It seems silly to say "if we had one more, it would have stopped them." Samsung's browser and Chrome share 100% of attack surface; Safari and Chrome share likely near 70%. Windows and Android have Chrome built-in at the OS layer, iOS has Safari built in at the OS layer. In this case, something like Firefox which shares much less attack surface…

Post by edoceo » Fri, Mar 19, 2021, 8:54 PM UTC

zzo38computer wrote: post #101

ancarda wrote: post #90

Earlier quoted context omitted.

The only thing that comes to mind is having most websites be sites and not apps . Most sites don't need custom fonts, JavaScript, and CSS. If Firefox & Chrome had support for something lightweight like Gemini ( https://gemini.circumlunar.space/ ) then most sites could just use that. With that sort of setup, restrictions on the web like uMatrix would be a lot less painful because most sites wouldn't ever need to be wh…

I agree, and on my computer I disable custom fonts in the web browser anyways. A better web browser is really needed; one of things it can have is support for the Gemini protocol and file format. (It can also omit many things, as well as adding things.)