Hacker News Reader

Comment by jeremyjh | Hacker News Reader

I've been using the web for over twenty years and it has never harmed my computer or invaded my system in any way. I do think I've seen adware and scumware that may have originated on the web on friends computers but I'm pretty sure they did something like allow a toolbar to be installed. Can you give an example of an exploit that did not require user permission,did not use a plugin, and that allowed arbitrary code execution from the internet ?

View on HN

> I've been using the web for over twenty years and it has never harmed my computer or invaded my system in any way

How do you know? Basically every browser has a RCE vulnerability a month and has for 20 years. From ancient JPEG vulnerabilities to modern video codecs and DOM manipulation vulnerabilities.

Anecdotally, I've never experienced remote code execution through a browser either. However, the most widely used browser for many years did have plenty of remote execution vulnerabilities that did not rely on plugins or toolbars [0].

[0] https://www.cvedetails.com/vulnerability-list.php?vendor_id=...

Exploiting remote execution vulnerabilities is doable, but why do that when one has the easy route of exploiting gullible users instead?

Would the recent Spectre vulnerability be an acceptable example for you?

There are a gazillion others, but this one is nice and sweet and exposes the whole web app strategy as completely bankrupt from a security perspective.

Yes. The web itself is harmless; it's the stuff you download and run that harms you.

Guns aren't dangerous! It's the bullets that will get you!

This is not an appropriate analogy. Guns and bullets are designed to kill, but browsers and the download capability are not designed to infect your computer. Rather, they are designed with an opposite goal.

An "infection" in this case would be the execution of some other person's code on my computer. Browsers have been designed specifically to do this since Javascript was invented.

The only difference between malware and "regular-ware" is whether the code meets certain user expectations about what it will and will not do.

Yes, exactly. What's your point though?

Reply on news.ycombinator.com