5 ms·
So my ebooks can now contain executable root kits. Cool.
by rm-rf 15y ago
So my ebooks can now contain executable root kits.
Cool.
- tobylane 15y agoJavascript is pretty well jailed up, you can't communicate with local and remote files in the same javascript file.
- daeken 15y agoThat sort of protection has nothing to do with js, but rather the browser, which isn't in play here. Edit: It's implemented via Mobile Safari, as pointed out by justincormack -- this comment is invalid.
- justincormack 15y agoiBooks is implemented using mobile Safari, so the security model is the same. It uses CSS3 columns to make the pages going across.
- daeken 15y agoAh hah, I was mistaken. Thanks!
- deleted 15y ago[deleted]
- evinfinite 15y agoI find it rather silly to be worried about security given that Apple's one of the largest browser vendors in the world, directly or indirectly via WebKit. More accurately: all increasing of capabilities in non-immediately-apparent sources IS cause for concern. But that has to be weighted against the exhibited competence of the vendor. I find it unlikely that we-vet-everything our-brand-name-is-safe-computing-experiences Apple wouldn't have considered security in this move.
- rm-rf 15y agoPresumably they have. But given the number of times Safari has been remotely exploitable in the past, that's not necessarily reassuring.
- rm-rf 15y agoHow is this different than Adobe Reader, where the ability to execute code within a document reading application has resulted in world wide exploits of operating systems? If my document reader can execute any code in any language, then any document that I read has the potential to execute malicious code on my computer, and I now have an exploit vector that I need to consider when downloading documents & opening e-mail attachments. I understand that the code can be sandboxed, but before I implicitly trust the sandboxing technology, I'd have to see an example of an unexploitable sandbox. I don't know of any - but that doesn't mean they don't exist.
- rakkhi 15y agoChrome one has stood up the best thus far
- ComputerGuru 15y agoRight, but "the best" being a very misleading term for anyone not in the know. It too has failed to do the job.. But, of course, no code is perfect. Just keep that in mind. http://www.informationweek.com/news/security/attacks/229500086 http://www.informationweek.com/news/security/attacks/2295000...
- tobylane 15y agoAdobe gives the same access it has to save to any folder on the drive, to the scripts in the PDF. Apple doesn't make those kind of mistakes.