« first day (1169 days earlier)      last day (3867 days later) » 

3:00 PM
@JourneymanGeek apparently, "the quick brown fox jumped over the lazy dog" (a common font test sentence because it has all alphabetical characters) says otherwise :P
need a pic of @Bob jumping and a pic of @JourneymanGeek laying down asleep, then i can literally depict "the quick brown fox jumping over the lazy dog"
 
@allquixotic: can. Its often not worth the effort
(that said, my canine alter ego has a fear of heights and unstable ground)
 
@JourneymanGeek Reasonable fears, countless people fall to their deaths or are suffocated in sink holes every year.
@JourneymanGeek I'm not saying it will happen to you, I'm just saying it could. It really could. Just think about that for a while. Have a good day!
 
oh, was dropped as a puppy. still occationally has leg issues.
 
I gotta think, this would really take my MythBuntu PVR to the next level, for $100 I'm really thinking about it...
@Bob ...this is pretty hard... CLISP or ARC? Fuck, without having actually written hello world in either of them that could easily be either since it's clearly an RPN S-Expression which both languages are...
 
3:06 PM
@hjpotter92 I once told my wife that caching was why the dishes in the kitchen appeared not to be done. She didn't buy it. — Andrew Barber 8 mins ago
 
@JimmyHoffa Wait, what, $100?!?!?! That's got to be a catch.
 
@ThatHelpVampireGuy It's craigslist... the catch is it will suck money out of your electric bill like a siphon, and that guy doesn't want it anymore
@Bob What score did you get? This quiz is tricky lol
 
"keyboard, mouse, and nice LCD,"
 
@JimmyHoffa There's no craigslist in Brazil. All I know is it's some sort of classified ADs site
 
is probably worth it for 10 quid too
@ThatHelpVampireGuy: pretty much. And its often cheap and/or dodgy
 
3:08 PM
@JourneymanGeek so if she hits F5 they will be done?
 
Bob
@JimmyHoffa Just got 2000.
I think the first time I ever did it, I got like 400.
 
@allquixotic No, it's caching, she has to wait the cache expiration period for them to be done.
 
Bob
Depends a lot on your luck as well - and I do a lot of it by elimination.
 
@Bob it's damn tricky that's for sure
 
Bob
3:10 PM
Yup. Though the esoteric ones tend to be obvious :P
 
@Bob Eh, I'm depressed, I called the SML one OCaml, and the sad thing is I've written code in both languages
They're just so damn similar
 
Bob
You also do start memorising them after a bit, which combined with the randomness makes it hard to compare scores.
@JimmyHoffa The Lisp ones are worse...
 
@Bob True, but I mean, OCaml is meant to be SML with an objective extension, they're basically the same damn language, it's like having C's hello world and asking "Is this C or C++?"
 
Bob
@JimmyHoffa They actually do the latter :P
 
@Bob Fuck that. lol
 
3:13 PM
Vala and C#'s hello world are also pretty similar except I think Vala's includes would be different
 
Bob
I guess it's "which one is more natural", and if something works in two related languages then which language is the more basic/older one.
 
I got 500 and 1 life left...let's see where I can go from here.. Just called CoffeeScript AppleScript (I've never written both, mostly because whenever i saw either of them I was all "YUCK, I'll stick with JavaScript thx"
Welp, got 600
then called some garbage XPath that was XQuery (anyone writing either language doing something as complex as that should be shivved BTW, that is an inappropriate approach to XML manipulation...)
 
Bob
@JimmyHoffa AppleScript is very distinctive. In the "I want to go vomit" kind of way :\
 
@Bob I feel that way about CoffeeScript too though..
 
@JimmyHoffa CoffeeScript is just JS without semicolons and var (lolol)
 
3:15 PM
@allquixotic Those are two of JS's best features!
 
@allquixotic it can be, but it's got syntax extensions everywhere
the example was clearly not JavaScript
 
Bob
@allquixotic Nope.
Their Vala example:
class Sample : Object {
    void greeting () {
        stdout.printf ("Hello World\n");
    }

    static void main (string[] args) {
        var sample = new Sample ();
        sample.greeting ();
    }
}
 
eh, close enough. it looks like C# to me.
 
Bob
That is clearly not C# - C# has a PascalCased Main
 
yeah yeah and stdout isn't a class or static variable
BUT STILL
 
Bob
3:19 PM
lol
 
What kind of a pervert puts a space between the function name and the ()?
12
 
Bob
a lot of c-like languages will look similar
@OliverSalzburg Apparently all my lecturers :(
 
@OliverSalzburg a ( lot ( of ( people ( like ( doing ( that
 
@OliverSalzburg This was common in C
 
also, SO-ChatBot's author does that ::(
@Bob don't you mean : ( ?
 
3:20 PM
That sucks : (
 
Bob
!!tell 11752080 no
 
I'm going to start doing that for emotes
 
that cat makes me laugh every time
 
Bob
!!tell 11752086 no
 
grumpy is soooo adorable
 
I just went to this website java.com/en/download/installed.jsp?detect=jre and it offered me the option of installing the java plugin. To what extent is java a plugin for a web browser, and to what extent is it installed on windows?
 
@barlop it's both, out of the box
 
Bob
@barlop Java's plugin is used to run web applets and open a large security hole.
Never have it installed and enabled without click-to-play or similar.
 
I like that it just gave me some code and asked if it was Assembly, C or TCL -- Really? It thinks TCL is similar to C or Assembly?
 
3:22 PM
@Bob what do you use to make it click to play?
 
when you install the default Java distribution from Oracle, you get: (1) a browser plugin to run Java Applets and WebStart applications on IE; (2) a browser plugin to run Java Applets and WebStart applications on Firefox/Chrome/Opera; and (3) the Java runtime and/or development kit for desktop applications
 
Bob
@barlop Depends on your browser.
 
items (1) and (2) are horribly insecure
 
Bob
FF has native click-to-play.
 
item (3) is perfectly secure in most cases
 
3:22 PM
(4) The Ask toolbar
5
 
@allquixotic wow, nice explanation, thanks
 
It just gave me Shakespeare, and the irony is it could have been Perl.
 
Bob
@JimmyHoffa wait what?
 
@Bob well, for chrome, for ff, for IE
 
Bob
ehhh nah, not valid Perl
 
3:23 PM
.
 
Bob
Perl requires semicolons :P
@barlop In FF, navigate to about:config and search for plugins.click_to_play
 
@Bob Perl allows free words
 
Bob
enable that, then go to about:addons, click plugins on the left and select Ask To Activate on the Java one
 
also @barlop, every security vulnerability I've found so far does not exploit anything with "Java WebStart" -- WebStart is basically something like: download a bunch of Java Desktop JAR files (zip files of Java classes), and run them on the local system as if you had downloaded them directly
 
Bob
@JimmyHoffa pretty sure you'd get a syntax error on the EOL though?
 
3:24 PM
Black Perl is a famous piece of Perl poetry. It was posted to Usenet on April 1, 1990. It is written in Perl 3 and will not parse under Perl 5. Multiple independent updates to Black Perl to make it parsable in Perl 5 have been published. The full text of the poem is reproduced below. Attribution While the poem itself is signed Larry Wall, the original message was posted with forged message headers, causing uncertainty of authorship. Sharon Rauenzahn, born Hopkins, has been suspected, but has denied authorship. Randal Schwartz has claimed that Larry Wall is in fact the author, and later...
 
you could almost include Java WebStart in the list of secure components of Java
 
BEFOREHAND: close door, each window & exit; wait until time.
    open spellbook, study, read (scan, select, tell us);
write it, print the hex while each watches,
    reverse its length, write again;
    kill spiders, pop them, chop, split, kill them.
        unlink arms, shift, wait & listen (listening, wait),
sort the flock (then, warn the "goats" & kill the "sheep");
    kill them, dump qualms, shift moralities,
    values aside, each one;
        die sheep! die to reverse the system
        you accept (reject, respect);
 
the problems that have been cropping up are basically breaching the "sandbox" that Java Applets attempt to set up
the sandbox environment of a Java Applet is supposed to let you run Java code in a restricted environment that doesn't grant filesystem access, native code, or anything else that running an .exe from Windows Explorer would usually give you, while still allowing it to create a GUI and do computations
 
so if you wanted to run, say, bitcoins, which uses java, how would you go about installing java
 
Or with the perligata library...
        #! /usr/local/bin/perl -w

        use Lingua::Romana::Perligata;

        adnota Illud Cribrum Eratothenis

        maximum tum val inquementum tum biguttam tum stadium egresso scribe.
        vestibulo perlegementum da meo maximo .
        maximum tum novumversum egresso scribe.
        da II tum maximum conscribementa meis listis.
        dum damentum nexto listis decapitamentum fac sic
               lista sic hoc tum nextum recidementum cis vannementa da listis.
               next tum biguttam tum stadium tum nextum tum novumversum
 
3:25 PM
think of the Java applet sandbox, in an ideal world, as behaving similarly to Flash
 
is the java applet sandbox something within the browser or external to the browser?
 
Bob
@allquixotic unfortunately, in the real world, it's riddled with security vulnerabilities
 
@barlop well if you install Java, then disable the browser plugins, you'll be secure, and running the bitcoin app as a desktop application
@barlop the Java applet sandbox is what the browser plugin provides
 
Bob
@barlop all plugins run external to the browser, i.e. they could potentially have full access to the system
 
3:26 PM
but every bitcoin app I know is basically a .jar file that you download from the internet normally, then there's a batch file that calls javaw.exe -jar whatever.jar
 
Bob
the browser does not have any control over what the plugin can do
the plugin must implement this itself
 
@Bob no, just because a thing within the rbowser can potentially access outside, that doesn't mean it runs outside of it
 
which is "secure", in the sense that, you have to give your explicit consent to run that, and any potential vulnerabilities in there are equally possible in any other programming language -- C, C++, .NET, anything
 
Bob
@barlop they run outside of any sandboxing the browser provides to normal client-side scripting (i.e. JS)
 
think of running java -jar something.jar as being no more or less secure than downloading some-site.com/potentially-malicious.exe, then double clicking it once downloaded
 
3:27 PM
@allquixotic ok so do you never use java plugins, or do you use a click to run type set up?
 
Bob
in modern browsers, they are always executed literally out-of-process - but that makes no difference
 
the problem is that Java Applets have the intention of being so secure (sandboxed) that they can run without you having to give your permission, and they can't compromise your system
but in actual practice they CAN compromise your system
@barlop I have the Java browser plugins disabled
 
Bob
if it's not being sandboxed by the browser, for all intents and purposes it is running outside the browser with some access to what's inside the browser
it doesn't matter if it shares a process or not
 
@Bob nothing to do with intents and purposes.. there is a difference in meaning between something running winthin a browser and something running from outside of it
 
Bob
@barlop what would be your definition of running "inside a browser", then?
 
3:29 PM
@barlop Browser plugins all run outside the browser, then.
They are not browser code, and are loaded externally.
 
@Bob good question. I guess.. to look at it from the other direction. If Windows can see it and point to it in some dialog box, like it appears in control panel.. then that's outside the browser.
 
Bob
@barlop that is a horrible definition, really
 
@DarthAndroid Running "outside" the browser is a bit of a misnomer there...
 
@Bob but if it only runs when the browser runs and the browser initiates it then i'd call that inside the browser.. and if it's a browser plugin, that's inside the browser.
if it's an EXE you run external from the browser that's outside the browser.
if it starts with windows, then that's outside the browser.
 
Bob
a single process can load any number of external libraries, which can execute arbitrary code when loaded
 
3:31 PM
The security vulnerability from them involves the fact that they run inside the browser, just not technically like a webpage
 
@Bob yeah but the question is distinct from security
 
@barlop Flash, java, silverlight are all things you can call outside of the browser.
Most other plugins are too
 
Bob
They are called by or run by the browser, but they run outside the browser.
 
@darth well, java has a native to windows aspect. not a plugin
 
So do all the rest
 
3:31 PM
the Java development kit is not a plugin at all.
Fine so what's your point?
 
Bob
the plugin is merely an interface the browser uses to communicate with external code
 
I can double-click a *.swf and windows will run it.
I can double-click a *.jar and windows will run it
 
@DarthAndroid Both of these statements are terribly inaccurate...
 
plugins are merely a way for a browser to call an external something.
 
I don't know what you mean by windows running it darth.
 
3:33 PM
@barlop Assuming I have the appropriate runtime installed, launch and execute code from it.
 
Bob
it lets the browser provide a video and audio interface, and potentially interaction with other browser objects - however, the plugins will execute native code directly on the system without going through the browser
 
don't worry too much about it @barlop -- just install Java, disable the plugins or enable click to play for applets, then download your bitcoin app and go
no need to overcomplicate it
 
@allquixotic and for Chrome?
 
Bob
a browser plugin runs outside the browser, but interacts with the browser
 
i'll see if there is a click to play for chrome..
 
3:34 PM
@Bob ??? Why would you say that?
 
@JimmyHoffa Because that's what they do.
 
@Bob What process does the plugin run inside of?
 
thanks @allquixotic yeah it has a click to play I just googled it.
 
dllhost? svchost? I'm pretty sure it's inside of the browsers process
 
so sorted for chrome or FF..
 
3:34 PM
that's where the vulnerabilitys come from
 
Bob
@JimmyHoffa the process they run inside of is immaterial
 
@JimmyHoffa Firefox and Chrome both dynamically load the plugin DLL into a plugin host process that then communicates using some form of IPC with the renderer process for networking, graphics, etc
 
Bob
different browsers will load plugins into different processes, nowadays not part of the browser process itself
 
it's literally in the same shared memory space bounded by a process as understood by the kernel as the browser
 
back in the bad old days, the browser plugin used to be dynamically loaded into the main browser process, but both Firefox and Chrome have stopped doing that, because it makes it harder to make use of a buffer overflow exploit
 
3:35 PM
Err, the kernel doesn't understand it as anything other than a process
 
@JimmyHoffa incorrect
 
@allquixotic ah fair.
 
Bob
also, plugins have the capability to load further processes directly using system calls
 
so you'd have to exploit the IPC to access browser resources
 
Bob
@JimmyHoffa the vulnerabilities come from the plugins having full access to the system (as far as the user can, anyway), outside of any browser sandboxing
 
3:36 PM
@JimmyHoffa The point is, all browser plugins have full access to the system as if you had double-clicked a *.exe file.
 
@JimmyHoffa also, on Windows 7/8/8.1, the plugin process is run with reduced trust (look up Mandatory Integrity Control as it relates to Windows 7+)
 
@Bob Usually the vulnerabilitys were from exploiting the browser directly.
 
It is up to the plugin to sandbox itself
 
Ash
@Psycogeek remember the last time i asked you about shorting out connections in 24 pin connector to see if the PSU was working ?well , its here superuser.com/q/23788/241659
 
@JimmyHoffa No, they aren't.
 
3:37 PM
because they were inside of the browser, thus why chrome and FF must have moved to loading them outside of the main browser process
 
They are usually be exploiting the plugin's sandbox
 
Bob
@JimmyHoffa what kind of vulnerability are you talking about?
generally, the problem is that a browser will automatically load external code (plugin code) when any random site requests it
 
@JimmyHoffa you can still, in theory, compromise a plugin's sandbox, but once you do that, you have to set up your shell code etc inside the plugin process, which doesn't have any of the actual browser state inside of it, and runs with a trust level less than the user's, when the OS makes that possible
 
Bob
the plugins can then be exploited by the site
many plugins have security vulnerabilities beyond any of the browser itself
 
the ultimate goal is to reduce the plugin's trust even further, to the point that it doesn't have FS write access, or if it does, only in very restricted ways, which are governed by the kernel, rather than code in the plugin process
 
3:38 PM
@Bob Ones where browser plugins are loaded by the browser, those plugins exploit the browsers vulnerabilitys and then gain access to the browser at which point they can execute arbitrary system code as part of the browser, as well as the more common approach of just tearing all your users and passwords and cookies out of the browser and sending those to home base etc which is more valuable than your system resources anyways
 
Bob
@JimmyHoffa what?
that's got nothing to do with plugins
 
with Mandatory Integrity Control, you could grant the plugin process rights to write to HTML5 storage (for example) in a pre-determined directory, but not to install a startup .exe
 
Bob
I'm talking about using plugins as an entry point web => browser => plugin => system
 
@Bob A plugin couldn't exploit a vulnerability in it's hosting code (the browser process) ?
 
Bob
you're talking about the reverse of this process
which is, quite frankly, stupid
if anything is already on the system, it doesn't need to fuck around with hooking into a browser process
 
3:40 PM
@JimmyHoffa ... It doesn't have to.
 
Bob
it can directly access files on the system
 
@Bob it's already in the confines of the browser process
it has to exploit that to get out
 
@JimmyHoffa No it doesn't
 
Bob
browsers don't host plugins
 
the hosting process isn't simply going to be like "yeah just run some arbitrary system code, I don't care"
 
Bob
3:40 PM
they are literally calling third-party executable code
 
the plugin *.dlls are not confined to the browser process
 
@Bob What are they, windows services?
 
they can do pretty much whatever they want
 
Bob
@JimmyHoffa the browser has no control over what plugins can execute
they run on the raw system
 
@JimmyHoffa no, they aren't windows services. plugins are native DLLs
 
3:41 PM
@Bob That sounds like horrible security from the browser side, I don't expect that to be accurate.
 
Bob
...
 
Bob
that's what a plugin is
 
I could write a browser plugin right now simply by implementing a well-defined open standard interface; for example, for Firefox, it's called NPAPI... all I have to do is open up Visual Studio and export a few symbols and compile a DLL
 
@allquixotic I know, and the process they run in is a browser process maybe not the main UI browser, perhaps a separate child process, but a browser process a "chrome.exe" or "firefox.exe" or maybe a "firefoxPluginHost.exe" etc
 
3:41 PM
I could then make any one of those NPAPI functions open a port in the firewall, or shutdown the system, or whatever
 
Bob
a browser extension or addon can be internal to the browser
 
so if plugins are just native(to windows) DLLS.. what limits their power?
 
@JimmyHoffa right
 
Bob
but a plugin is always external by definition
 
but it isn't the plugin host that inherently provides the sandboxing/security; it can't, because it doesn't know what the plugin does
 
3:42 PM
@JimmyHoffa To perhaps clear a few things: The code is technically loaded into a process that the browser started. The problem is the browser has no control over the code, though it could in theory filter the system calls. The problem is the browser doesn't know if the calls are legitimate or illegitimate, so for the plugin to be useful, it must blanket-allow the calls.
 
the plugin itself is responsible for providing any necessary sandboxing/security to make sure that any instructions the plugin receives from websites do not end up compromising the system
 
@allquixotic I find this unlikely.
 
what if the plugin is malicious though, what limits it?
 
Bob
@barlop nothing
 
supposing it doesn't exploit anything and is just malicious
 
3:43 PM
@barlop nothing.
 
Chrome and FireFox have both done a lot of development in regards to sandboxing software
 
Bob
for a malicious plugin to be installed, someone already has access to your system
 
I'd be surprised if they don't apply some sandboxing to the plugin
 
@JimmyHoffa no, it's reality -- take for example, I could implement an NPAPI function in the following way: I could load x86 machine code from an HTTP URL and attempt to execute it
what could the browser plugin do to stop me from doing that in my plugin DLL?
 
@JimmyHoffa What sandboxing would they apply?
 
3:43 PM
how would it know that I'm doing that without disassembling the DLL?
 
Bob
plugins are, quite simply put, black boxes that expose a few functions to interact with the browser
 
interesting, and I didn't know plugins and extensions were different.. the latter internal. the former not so.
 
Bob
the browser is calling these functions knowing that they are external code but unable to do anything about them
 
@barlop Indeed, that is the primary difference.
 
Bob
@barlop some slight differences in terminology
 
3:44 PM
At least for chrome.
 
Bob
Firefox "addons" include both the internal "extensions" and external "plugins"
 
> It is also possible to run the plugin processes inside a sandbox target, using the --safe-plugins command line. The target process hosts all the code that is going to run inside the sandbox, plus the sandbox infrastructure client side:
 
Bob
I believe Chrome uses a different definition for "extension"
 
@Bob barlop's definition is correct for chrome
 
oh ok
does FF have a term for jst internal?
 
3:45 PM
extensions are the js-based browser addons, and plugins are the native 3rd-party code
 
Bob
My bad. I think I mixed up my terms.
 
@JimmyHoffa the plugin "sandbox" isn't a sandbox in the JavaScript sense; it might run with reduced privileges compared to the browser process, but it still has a lot of leeway, because the plugin is still a DLL, and it can still at least attempt FS access, etc.
 
ok so how does FF terminology differ from Chromes, with respect to addons and extensions and plugins?
 
that's not to say that you can't set up Mandatory Integrity Control to deny it permission to things that might be dangerous
but the plugin is at least partly responsible for attempting to prevent incoming arbitrary code from doing bad things
 
@allquixotic I would say "primarily", not "partly"
 
3:47 PM
Adobe Flash, Java Applets, Silverlight, and anything else that downloads some sort of "code-ish" stuff from the Internet and executes it, is responsible for vetting that code and preventing it from busting out of the sandbox and executing native code -- if an attacker is running native code, there's only so much that a hosting process can do to protect the user
 
Bob
@allquixotic Based on @JimmyHoffa's link, they are attempting to intercept Win32 API calls.
 
@allquixotic That's my point, A) it's in the browser process, B) the browser process has it sandboxed to hopefully stop some portion of it's access, so in the event it's unable to do arbitrary code execution due to sandboxing, you would then focus on exploiting the sandbox which tends to be what exploits often do (either by exploiting the sandbox directly or one of the browser facilities the sandbox does not restrict)
 
Bob
Most likely buggy, which is why it's not enabled by default.
It's very difficult to do it correctly.
 
@JimmyHoffa well, it's layers of security
layer "1" (the most direct layer) is the plugin's runtime environment itself, say, ActionScript for Flash, or Java for an applet
 
@allquixotic Yes, and the initial layer most exploits aim at is - DUN DUN DUN - their hosting process. It's the immediate first thing they have access to.
 
3:48 PM
you would have to bust through that layer first to inject native code into the plugin DLL's process space and run it
once you inject native code into the process space, then the operating system, essentially, is responsible for knowing that that process is potentially compromised and preventing things like running EXEs with user trust (or worse, admin rights)
 
@JimmyHoffa Yes, but problem lies in determining whether a plugin's call to the system is legitimate or not, which is why that kind of sandboxing, while good in theory, is not effective currently (or at least not nearly as effective as you think it is.)
 
Just don't call me crazy for saying exploits start by exploiting their hosting process runtime, you all were argueing I'm crazy for saying that but it's totally common :P
 
Bob
@JimmyHoffa @allquixotic And that again opens up a host of problems with plugins that are designed to do that.
 
@JimmyHoffa The thing is you don't have to do that currently.
 
Bob
Usually with some enterprise software, but they do exist. Often as ActiveX controls.
 
3:50 PM
@Aibobot Welcome to Root Access chat for Super Users! I am this channel's helpful chat bot. Please don't ask if you can ask or if anyone's around; just ask your question, and if anyone's free and interested they'll help. For bot commands, type !!listcommands
 
If I want to exploit a system with java, all I need to do is find a way to replace the java security manager
 
are there many java plugins(for running applets), or just Oracle's?
 
Bob
Chrome doesn't sandbox plugins by default - your own link says that.
 
and is the applet ever called a plugin?
 
@DarthAndroid You don't know that for certain. I'd be surprised if arbitrary code execution is so simple as you say. You have to likely do something to work around the sandbox to do arbitrary code execution, which is "exploiting the sandbox" as i said
 
Bob
3:51 PM
Not for NPAPI, anyway - it does for PPAPI, but I don't think there's PPAPI Java yet
 
I can then spawn processes and delete files and download viruses with full privileges as the user that opened the browser.
Because java can already do all that, and is allowed to do all that
 
I think there's a distinction between oldschool addons and the new no restart ones
 
Bob
@JimmyHoffa We're saying that the browser has no say in this.
 
maybe it's not hard to work around the sandbox, but I doubt you can just do arbitrary code execution at a permissible level to cause problems without doing something to work around the sandbox
 
oops, was scolled up
 
3:52 PM
@Bob a lot of plugin authors aren't doing PPAPI because it only gets them Chrome support, not FF or other NPAPI browsers
 
Bob
The browser cannot sandbox all plugins because many plugins legitimately require more access.
 
@JimmyHoffa There's a sandbox, but it's not the browser sandbox. I have to work around java's sandbox
 
@JimmyHoffa that's a fairly special feature of Chrome (only) at this time, though
 
@Bob for the last time the browser provides the hosting runtime environment that the plugin executes within, it is that which gives facilities to the plugin to execute
 
@JimmyHoffa do you have a source for that?
 
3:52 PM
@allquixotic FireFox doesn't have it? You're certain?
 
@JimmyHoffa Yes, but it gives the plugin full access
 
@Bob yeah, and DRM is extremely deep-rooted; it goes all the way to the kernel... imagine abusing a vulnerability in the DRM system (plugin -> sandbox -> kernel) to run code in the Windows Executive :D that'd be epic
 
Bob
@JimmyHoffa For the last time plugins require more access, which is why you cannot just "sandbox" everything. And that's also why they currently do not do so.
Your own link says this.
> It is also possible to run the plugin processes inside a sandbox target, using the --safe-plugins command line.
> It is the expectation that in the future most plugins will run inside a target process.
 
--safe-plugins almost certainly breaks Flash and Java
 
Bob
3:54 PM
=> that's making a lot of assumptions, too
@allquixotic exactly - you can't just throw a "sandbox" around something and restrict its privileges, and expect it to work perfectly
not unless you're absolutely certain it does not need those privileges
Flash on PPAPI can be and is sandboxed, because it was designed with this in mind.
 
Does "Click to play"(regarding the java plugin) mean click to enable the plugin and thus play the applet. Or is the plugin already enabled and clicking it just runs the applet?
 
@Bob This I'll admit. Though that's likely in part due to the individual developer of the java and flash code, and by individual developer I mean almost all developers who write java or flash heh
 
@JimmyHoffa well, if you look down the road to 2020, the amount of security browsers provide built up around browser plugins will be so great that what you're saying now will be basically true, but the state of the art in 2013 is that the browser plugin DLLs themselves (not necessarily code that runs inside them, unless they bust out of the plugin's own sandbox) have user trust, meaning they can do whatever they logged in user can do
 
@allquixotic If that's the case, that's a scary thought heh
 
Bob
@barlop The applet is not run until you click. Typically, FF doesn't load the plugin until the first applet tries to use it.
 
3:57 PM
@JimmyHoffa so the only thing protecting you from running arbitrary, malicious, native code with user trust, with no warnings/prompts after visiting a HTTP URL, is either (1) Click-to-Play and only clicking on trusted things, or (2) the security sandbox provided by the plugin author, i.e. Oracle, Adobe, etc
 
Bob
> Flash Player will establish a low integrity, highly restricted process that must communicate through a broker to limit its privileged activities
That's implemented by Adobe themselves
(and has been broken several times)
 
@JimmyHoffa in 2020, that will no longer be true; there will be three "layers" of sandbox: one provided by the plugin author; one provided by the browser vendor; and one provided by the operating system
 
Bob
(I'll also note that it was rather buggy at time of release - I still have "Protected Mode" disabled because it was so buggy.)
 
layer 1 is "ActionScript doesn't let you get user filesystem access!"; layer 2 is "Chrome doesn't let safe plugins get filesystem access!"; layer 3 is "Windows Mandatory Integrity Control doesn't let the untrusted plugin process have unrestricted filesystem access with user trust!"
(I'm oversimplifying; obviously, things other than FS access will be sandboxed, but you get the idea)
 
Bob
@allquixotic Maybe. There's only so much sandboxing the browser can do (practically none) without restricting plugins too much.
An opt-in kind of sandboxing would be better. Or at least something that has opt-out available.
 

« first day (1169 days earlier)      last day (3867 days later) »