quotheth

5 ms·

1.
by quotheth 9y ago
> Why should an application developer implement a sandbox? Because they are the ones who understand the necessary capabilities of their program and the ones who have access to the source code... > That's a huge waste of time and
2.
by quotheth 9y ago
I think this is the wrong attitude. No one is better suited to implement a sandbox than the developer of the application. The fact that most developers are not trained to do so is just a reflection of our field's terrible progress re:
3.
by quotheth 9y ago
How many apps do this?
4.
by quotheth 9y ago
Your argument seems to be that because there are multiple ways to exploit people that closing any of those methods is not useful. I shouldn't have to explain why this is not a meaningful argument. What I will say is that in many cases
5.
by quotheth 9y ago
Sure it is. If I have a Chrome exploit that I want to deliver to you and I'm on your network I can inject it into the webpage.
6.
by quotheth 9y ago
> It's impossible to get a valid SSL certificate for an appliance running within someone their lan Can you not just create a certificate and push it to the system as a trusted cert? > And opening ports would make the appliance ev
7.
by quotheth 9y ago
I'll assume you intended to write 'insecure'. I'd say the main issue is that anyone between you and that website can inject scripts into the site in order to phish/ exploit you.
8.
by quotheth 9y ago
OK, so in your example they create a certificate and use HTTPS and I'm unsure what the problem is. And why would they think outside of their internet only box when they're providing an internet browser ?
9.
by quotheth 9y ago
The "premature optimization is the root of all evil" thing is totally blown out of proportion. I think what they're saying is don't use that quote as a reason to write garbage slow code.
10.
by quotheth 9y ago
None of these are likely the reason - it should be as simple as Java's own managed heap preallocating that space.
11.
by quotheth 9y ago
Do you think there's much overlap between the people generating reports and the people in charge of hosting their domain/ managing certs?
12.
by quotheth 9y ago
I can't tell what this post is implying - that sec analysts are like... a fake job? Can you please elaborate?
13.
by quotheth 9y ago
An attacker needs the ability to compute on your local machine. Javascript is the way to do that in a browser. With just CSS this should be impossible/ very unlikely. I guess it is probably technically possible, but I do not expect to
14.
by quotheth 9y ago
I work for a company with a massive rust codebase. Rust is very much about building production code. What is 'good production code' ? * Few errors * Readable, well documented * Testable, has tests, has testing tools like quickchec
15.
by quotheth 9y ago
I personally find Rust quite a joy to read.
16.
by quotheth 9y ago
Yep, it's disabled by default. It is a great indicator of the forward thinking work they do, though. And from a corp perspective we can push out policies to enable site isolation for high risk websites (SSO). "The only interesting
17.
by quotheth 9y ago
My point with site isolation was more their continued effort to push interesting, compelling security improvements. Currently, from a corp perspective, enabling site isolation for internal high security websites (SSO pages etc) is possible
18.
by quotheth 9y ago
Vulnerability counting is never a metric for security when comparing counts across products. It's very helpful for counting within a product. One simple example - A and B are browsers. A has a bounty program that they invest millions i
19.
by quotheth 9y ago
There is no universal metric for security. What I will say is that Edge and Firefox are doing an excellent job - I'm really impressed. Chrome is still the safest browser today, in my opinion. Site isolation, which was released recently
20.
by quotheth 9y ago
I read posts like this and it's just so clear to me why we're so fucked.
21.
by quotheth 9y ago
I don't get what you're arguing - this has nothing to do with the developer mindset. He just has to flip a compiler switch and vulnerabilities won't be trivially exploitable anymore. It's totally irresponsible.
22.
by quotheth 9y ago
This is really just not accurate. You can say that AVs are crap, but please don't put all of your eggs in the 'proactive security' basket. At one point that was actually the prevailing attitude, and it just failed absolutely
23.
by quotheth 9y ago
It isn't even per function call in all implementations.
24.
by quotheth 9y ago
I feel strongly that you do not understand the performance implications of the mentioned mitigation techniques.
25.
by quotheth 9y ago
Really? My comment doesn't add anything meaningful to the discussion? I linked to a far more informative post that actually discusses a technical issue . Frankly, the response should have been what was linked on HN, not some rant. I c
26.
by quotheth 9y ago
> None of this is adult. Really? The long technical explanation, with the word "shouty" is not adult? The plea for sensible discussion? Your post isn't worth responding to beyond that. You've taken extreme liberties i
27.
by quotheth 9y ago
I asked you to provide an example of the situation you described. I was as specific as you were. I will try to be more straightforward. You've stated that Linus has a unique role, and that he has to be this way or he'll lose the k
28.
by quotheth 9y ago
Can you show me an example where a leader of an OSS project had reasonable discussions with other developers (read: n steps below calling them morons who write garbage code), and as a result their project was "stolen" by a powerfu
29.
by quotheth 9y ago
A human being can only have one account on one website. How about this - you delete your post, and I delete my post, and we both contribute to the conversation by removing useless posts!
30.
by quotheth 9y ago
See my edit: I don't want to continue this discussion as I have a fairly high up comment and I think this is just a bunch of clutter for the purpose of meta discussion. Talk about 'makes for boring reading'.

More ›