| ActiveMac | Anonymous | Create a User | Reviews | News | Forums | Advertise |
|
|
|
User Controls |
|
New User |
|
Login |
|
Edit/View My Profile |
|
|
|
|
|
|
|
ActiveMac |
|
Articles |
|
Forums |
|
Links |
|
News |
|
News Search |
|
Reviews |
|
|
|
|
|
|
|
News Centers |
|
Windows/Microsoft |
|
DVD |
|
ActiveHardware |
|
Xbox |
|
MaINTosh |
|
News Search |
|
|
|
|
|
|
|
ANet Chats |
|
The Lobby |
|
Special Events Room |
|
Developer's Lounge |
|
XBox Chat |
|
|
|
|
|
|
|
FAQ's |
|
Windows 98/98 SE |
|
Windows 2000 |
|
Windows Me |
|
Windows "Whistler" XP |
|
Windows CE |
|
Internet Explorer 6 |
|
Internet Explorer 5 |
|
Xbox |
|
DirectX |
|
DVD's |
|
|
|
|
|
|
|
TopTechTips |
|
Registry Tips |
|
Windows 95/98 |
|
Windows 2000 |
|
Internet Explorer 4 |
|
Internet Explorer 5 |
|
Windows NT Tips |
|
Program Tips |
|
Easter Eggs |
|
Hardware |
|
DVD |
|
|
|
|
|
|
|
Latest Reviews |
|
Applications |
|
Microsoft Windows XP Professional |
|
Norton SystemWorks 2002 |
|
|
|
Hardware |
|
Intel Personal Audio Player 3000 |
|
Microsoft Wireless IntelliMouse Explorer |
|
|
|
|
|
|
|
Site News/Info |
|
About This Site |
|
Affiliates |
|
ANet Forums |
|
Contact Us |
|
Default Home Page |
|
Link To Us |
|
Links |
|
Member Pages |
|
Site Search |
|
Awards |
|
|
|
|
|
|
|
Credits |
 |
IE7/Firefox URI Handling Bug Caused by Windows After All | |
|
||
| Time: 00:32 EST/05:32 GMT | News Source: BetaNews | Posted By: Kenneth van Surksum | ||
|
An exploitable bug discovered earlier this month that was first believed to have been caused by Internet Explorer 7.0, before Mozilla was forced to admit that it afflicted Firefox as well, has apparently been traced back to a Windows API function. The discovery may have been first revealed through the US-CERT Web site of the Dept. of Homeland Security, which now classifies it as a "Microsoft Windows URI protocol handling vulnerability." The function in question is an old favorite of malware writers: ShellExecute(), which was the subject of a notorious Windows 2000 exploit four years ago. | ||
|
Write Comment
Return to News |
Displaying 26 through 50 of 556 Prev | Last | Next |
The time now is
4:11:28 PM
ET.
Any comment problems? E-mail us |
| #26 By 13030 (198.22.121.110) at 8/1/2007 9:38:58 AM |
|
#23: I refer you to the admission that yes, there is a bug in Firefox's handling or URL's.
Item 4 mentioned comment #30 (from the linked story site) is not addressing the issue at hand. What they are referring to would bullet-proof against some other unforeseen problem which may or may not even be possible. Your other link throws an error, so I can't address that. Read what lketchum has said and you will realize that you are defending, at the minimum, a precarious position. #24: ...which is kind of cool and suggests that you're a lot smarter that even your smart posts suggest Well, thank you (I think). Actually, I use the old journalism maxim of writing to a 5th grade audience for the benefit of the other gentle ActiveWin readers. <duck for cover> Personally, I like Latch's approach and the way he always elicits commentary. It keeps the zealots on their toes--something that zealots generally don't like to do. This post was edited by ch on Wednesday, August 01, 2007 at 09:39. |
| #27 By 23275 (24.179.4.158) at 8/1/2007 10:12:41 AM |
|
#26, it was meant as a sincere compliment, so, you're welcome.
Defending/attacking from either side of this issue is precarious and more than a little pointless. The better approach is what I think is actually happening and that each side's devs are taking full responsibility for their own code and working "with" one another to affect solutions [I have to believe that, because that is the only approach that serves shared customers' interests and if that is not happening, well... the SW industry needs to grow up a bit <more>]. That said... In forums, as in personal letters, I write as though the person is sitting across from me - hence all my "dashes" - conveying natural pauses in one's spoken patterns of speech and not unlike "BT" or "STOP" for guys that used to or still hit a Morse key and amateur radio. e.g., the thoughts are what matter. Any case... what I want to offer regarding this is that devs [big and small] have to forgive themselves and one another just a little bit. A lot has changed in the past five or six years and a lot more quickly than dev tools and practices have. We have to accept that and stop pretending that all the change we have seen - as exploitation of code and people has evolved as a business [albeit a criminal one]. We have to think about the API's we have all used, or been exposed to indirectly and how they have evolved opposite the onslaught of specific and blended threats. We have to be adult about our understanding of IE in the context of intergration.... on one hand it is not nearly as tightly integrated to Windows as people assess "technically" - and also embrace that at one time and in the context of Windows as a "Product" that it was integrated more meaningfully. So it is both and both are valid. That still is not the issue here nor will it be in the future. The future is in treating apps components as secured objects independent of user name space - that much is certain - components facing networks [any network] have to be isolated and further, the means to escalate any process has to be subject to a brokering process that controls it. Fortunately, that future already exists - it is just not being embraced and if there is a scrub with MOZ/FF it is in this area and how stubborn they seem to be about it - I say seem to be, as there is no way for me to know for sure. Again, we have to be willing to accept that so much has changed; that we are all in this game together and that securing at the object level is where we need to go - I'm just not sure that even Microsoft can get its partners out of the corner we are all painted into quickly - so expect a longer and bumpier ride. As we travel that road, try to have as much fun as possible and try and forgive the guy next to you - we all did this, and no one saw it all coming as fast as it did. If we want to blame someone, let's blame the bad guys - the criminals that don't give a crap about what browser we use, or who did what - they'll TAKE whatever they can get from all of us. |
| #28 By 23275 (24.179.4.158) at 8/1/2007 10:39:56 AM |
|
#26, Oh, curious.... I always wondered why people concluded that working to get the most out of platforms that are so common that they present themselves as the standards and therefore the realities that we face, is regarded as "zealotry?"
It isn't. It is that things that are real, just are - just are that, "real" In the right hands, with a tiny bit of planning, Windows Vista is a great operating system and certainly well ahead of Windows XP in so many ways, that going back to an XP box is just, well... painful - like driving a really old, dated care without AC and or power steering is more painful - yeah, you can get down the road, but drive around town in August? No thanks. So, may as well focus on how to get the most out of the new ride... right? See my point? Latch elicits a "response" but he is not a gate keeper and there is an important difference - one leads to discourse, the other a brawl. So it depends upon what you're in the mood for. Some days it is fun, but it is more fun to embrace the reality we share and then see what we can build on, or with it and how what is built might be used. Did you all ever toy with the idea of shaping the likes of Microsoft from the outside - how our collective influence can modify what they do? I for one am with Fritzly - I want them to track a much more modern OS for the non-enterprise market and let us use something different - I want them to make some bold moves and really open up what is possible. I sincerely believe that the problem with Windows Vista and the same problem OS X and XP have - in reality, they do not inspire us at all - the aged desktop metaphor is inappropriate, boring and as common as our grand daddy's Buick. We're tired of it and down deep we wanted something that was so much more - instead, we suck on a pro/con-sumer version of a stodgy enterprise desktop that is as bland as a bankers antique desk. In our small little way of saying, "hey, this is what we meant, we're building a canvas for all of you and Awin and appointing all of you the artists - hopefully driving a big fat stake through the heart of the old metaphors and desktop in the process." |
| #29 By 32132 (142.32.208.232) at 8/1/2007 10:48:35 AM |
|
"Read what lketchum has said and you will realize that you are defending, at the minimum, a precarious position."
If you read the link I posted, there are many, many others defending the same position. There are numerous examples of how Firefox should have dealt with the URI's. They chose the wrong method. And Mozilla patched Firefox admitting to a serious flaw in their handling of URI's. |
| #30 By 135 (209.180.28.6) at 8/1/2007 10:51:59 AM |
|
lketchum/NotParker - Who cares?
You're not helping anyone here with angry rants against firefox. |
| #31 By 32132 (142.32.208.232) at 8/1/2007 1:12:22 PM |
|
#30 Angry rant?
Please quote anything from this discussion (that I posted) that is an "angry rant against Firefox"? Why is criticism of Firefox an "angry rant"? |
| #32 By 32132 (142.32.208.232) at 8/2/2007 11:03:08 AM |
| #30 .... hello .... anyone there? |
| #33 By 221927 (60.190.240.68) at 5/19/2009 9:57:49 AM |
|
I have a trumpet, was a good friend of mine said that the names of super-sick - I do million [url=http://www.wowgold-shopping.com]wow gold[/url]. would like to do business with this issue, then did a little good feeling, so the hedge on the number (do not understand please refer to my articles, analysis of two-way hedge) wow gold This is almost not on-line, who have brought more than 4000 wow gold coins, together with several of my large body of wow gold, almost the more than 7000 wow gold.
I color the Crusaders in four districts servers, large crusade has the legend of 60 hunters is a lady (a friend gave me the 22 thieves, and now 52) zt45 holy priest and a less than 40 fighters. Ago when hunters used to use the auction house made a lot of money, almost like gold coins in 2000 wow gold, and later was introduced to see double-take to make money fast, so the thieves used to verify a bit and found that was not general, since then I have re - others did not have coin donation (to the trade union before, and friends to send more than 1,000 wow gold coins), and now is occasionally a few good close friends and equipment. Source: http://www.wowgold-shopping.com |
| #34 By 221927 (60.190.240.68) at 5/20/2009 3:51:52 AM |
|
I have a trumpet, was a good friend of mine said that the names of super-sick - I do million [url=http://www.wowgold-shopping.com]wow gold[/url]. would like to do business with this issue, then did a little good feeling, so the hedge on the number (do not understand please refer to my articles, analysis of two-way hedge) wow gold This is almost not on-line, who have brought more than 4000 wow gold coins, together with several of my large body of wow gold, almost the more than 7000 wow gold.
I color the Crusaders in four districts servers, large crusade has the legend of 60 hunters is a lady (a friend gave me the 22 thieves, and now 52) zt45 holy priest and a less than 40 fighters. Ago when hunters used to use the auction house made a lot of money, almost like gold coins in 2000 wow gold, and later was introduced to see double-take to make money fast, so the thieves used to verify a bit and found that was not general, since then I have re - others did not have coin donation (to the trade union before, and friends to send more than 1,000 wow gold coins), and now is occasionally a few good close friends and equipment. Source: http://www.wowgold-shopping.com |
|
Write Comment
Return to News |
Displaying 26 through 50 of 556 Prev | Last | Next |
The time now is
4:11:28 PM
ET.
Any comment problems? E-mail us |
