Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.java.programmer > #28359

Re: Java vs JavaScript

Show all headers | View raw

Joerg Meier wrote:

> If you don't hover, the href link might differ from the text link: <a
> href="http://www.evil.org">www.google.com</a>. Have I now conclusively
> proven that HTML has a giant, gaping security hole ?

Yes.  The exploit you mention was actually used (IIRC) in the early days, and 
it /was/ a security problem for users, which is /why/ the browsers started 
doing the hover-over thing.

Security is about the person using the browser, not the browser itself, nor the 
page that the browser is displaying.  /They/ aren't going to loose money, get 
infected, be advertised at unwantedly, whatever...  The person is -- or may be. 
If the whole settup (Java/Flash/JavaScript/HTML/etc) is such that an actual 
user is mislead, then that is security failure, and then it's just a matter of 
finger-pointing as to which part of the system takes how much blame.

If the problem is more theoretical, "this feature COULD be used to mislead 
users", then that feature has security issues which are anything from trivial 
to severe depending on, for instance, how easy it is to deploy, and how hard it 
is for a user to avoid it.

JavaScript has been used in way that mislead technically minded, 
security-concious users.  To that extent JavaScript has some serious security 
issues.

Java has been used in way that mislead technically minded, security-concious 
users.  To that extent Java has some serious security issues.

Flash has been used in way that mislead technically minded, security-concious 
users.  To that extent Flash has some serious security issues.

I expect I'll be able to make the same claim about HTNL5 soon, if I can't 
already.

And yes, I can make the same claim about old-skool HTML too.

HTML has problems.  JavaScript makes it easier to exploit those problems, and 
adds new ones of its own.  Java, FLash, and any other pluggin can be expected 
to add yet more problems -- it's inherent in the nature of a plugin (by which I 
mean exernal compiled code) that it may open too many doors (NACL aside, 
perhaps).

So there's a security flaw in the design of HTML (not knowing where a link 
would take you). The browser vendors add a hack in attempted mitigation of it. 
And then JavaScript comes along and undoes the mitigation.  It's not clear to 
me what the browser makers could do in respoinse, but it wouldn't be trivial.

    -- chris

Back to comp.lang.java.programmer | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Java vs JavaScript Roedy Green <see_website@mindprod.com.invalid> - 2014-04-23 08:39 -0700
  Re: Java vs JavaScript markspace <markspace@nospam.nospam> - 2014-04-23 09:10 -0700
  Re: Java vs JavaScript Joshua Cranmer 🐧 <Pidgeot18@verizon.invalid> - 2014-04-23 15:48 -0500
  Re: Java vs JavaScript Silvio <silvio@internet.com> - 2014-04-23 23:36 +0200
    Re: Java vs JavaScript "Chris Uppal" <chris.uppal@metagnostic.REMOVE-THIS.org> - 2014-04-27 12:20 +0100
      Re: Java vs JavaScript Richard Maher <maher_rjSPAMLESS@hotmail.com> - 2014-04-27 20:05 +0800
      Re: Java vs JavaScript Joerg Meier <joergmmeier@arcor.de> - 2014-04-27 22:55 +0200
      Re: Java vs JavaScript "Chris Uppal" <chris.uppal@metagnostic.REMOVE-THIS.org> - 2014-05-01 08:52 +0100
        Re: Java vs JavaScript Silvio <silvio@internet.com> - 2014-05-01 10:26 +0200
          Re: Java vs JavaScript Gene Wirchenko <genew@telus.net> - 2014-05-01 14:10 -0700
            Re: Java vs JavaScript Silvio <silvio@internet.com> - 2014-05-02 11:10 +0200
              Re: Java vs JavaScript Gene Wirchenko <genew@telus.net> - 2014-05-02 10:20 -0700
                Re: Java vs JavaScript Joerg Meier <joergmmeier@arcor.de> - 2014-05-02 20:16 +0200
                Re: Java vs JavaScript "Chris Uppal" <chris.uppal@metagnostic.REMOVE-THIS.org> - 2014-05-04 10:38 +0100
                Re: Java vs JavaScript Joshua Cranmer 🐧 <Pidgeot18@verizon.invalid> - 2014-05-05 00:16 -0500
                Re: Java vs JavaScript Tim Slattery <tim@risingdove.com> - 2014-05-06 13:06 -0400
                Re: Java vs JavaScript Joshua Cranmer 🐧 <Pidgeot18@verizon.invalid> - 2014-05-06 12:40 -0500
            Re: Java vs JavaScript Simon Lewis <simonlewis2001@gmail.com> - 2014-05-02 12:53 +0200
          Re: Java vs JavaScript Arne Vajhøj <arne@vajhoej.dk> - 2014-05-01 21:16 -0400
            Re: Java vs JavaScript Silvio <silvio@internet.com> - 2014-05-02 11:17 +0200
  Re: Java vs JavaScript Arne Vajhøj <arne@vajhoej.dk> - 2014-04-23 22:22 -0400
    Re: Java vs JavaScript Richard Maher <maher_rjSPAMLESS@hotmail.com> - 2014-04-24 16:20 +0800
      Re: Java vs JavaScript Arne Vajhøj <arne@vajhoej.dk> - 2014-04-29 21:07 -0400
  Re: Java vs JavaScript Richard Maher <maher_rjSPAMLESS@hotmail.com> - 2014-04-24 16:15 +0800
    Re: Java vs JavaScript lipska the kat <lipskathekat@example.com> - 2014-04-27 09:00 +0100
      Re: Java vs JavaScript Richard Maher <maher_rjSPAMLESS@hotmail.com> - 2014-04-27 20:15 +0800
        Re: Java vs JavaScript lipska the kat <lipskathekat@example.com> - 2014-04-27 16:59 +0100
  Re: Java vs JavaScript Ray Osborne <rko153@gmail.com> - 2014-05-22 05:08 -0700

csiph-web