Blog feeds may carry security risk

TalkBack 5 of 9:

Next »

« Previous

• Thread View
• Flat View

Buried in the article... it's IE again...

I was kind of skeptical that javascript in blog feeds would be any more of a security issue than Javascript in web pages, though I had this sneaking suspicion that I knew what was up. And, lo and behold: "Additionally, some reader software on Windows systems uses Internet Explorer to display feed content, but doesn't use basic security settings that isolate the content. Instead, the JavaScript is downloaded to the PC and has full access, which can fully expose a person's PC, Auger said."

By "IE" he means "The Microsoft HTML control". IE is just a shell around the HTML control, which is used by many system components including the desktop Windows Explorer. To allow components like Windows Update and control panel applets that use the HTML control to run, the control grants rights to a document its rendering based on the security zone it's in.

I'm still flabbergasted that anyone thought this was a good idea. I'm doubly flabbergasted that - after it was so amply demonstrated to be a bad idea by the flood of email worms that took advantage of it - Microsoft not only didn't back it out and try a different approach but took the company to the brink of being broken up by the Department of Justice to keep it in. And now, ten years later, it's still in there.

Software authors: I don't care how attractive the idea is, don't use the HTML control unless you LIKE having your product headlining in ZDNet's latest security release.

Everyone else: Don't use IE. No matter how many layers of duct tape Microsoft wraps around it. Don't use any other application that uses the HTML control either. It's inherently insecure, and it can not be fixed without breaking every application that currently uses it... because the design flaw is built in to the API.

Posted by: Resuna   Posted on: 08/04/06 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Live Webcast: Activate Today! Realize ROI with Intel(r) vPro? Technology and LANDesk Intel Join the team from the Intel vPro Expert Center for an informative Webcast ... Download Now
• The True Costs of Virtual Server Solutions VMware In an economic environment that is repeatedly heralding the message "do ... Download Now
• The Impact of Virtualization Software on Operating Environments VMware Today's use of virtualization technology allows IT professionals to ... Download Now