Re: Dropping permissions and sandboxing a browserplugin.

The sandboxing is new to IE8 and Chrome, so yes other browsers
are vulnerable to this kind of problem.

Guess if the user runs the browser as Admin, you can create a new user with
limited permissions, spawn a new process and use that as your sandbox to
load the bulk of your plugin :)  maybe a case of the cure being worse than
the disease...

On 19 March 2010 16:14, Juan Linietsky <[email protected]> wrote:

> Yeah.. that's what I mean, so the question is what happens when a
> browser won't provide this security model?
>
> So, basically let's say, if a plugin such as Unity has a vulnerability
> in itself or in one of the many libraries it uses (such as mono,
> freetype, image loaders, etc), and the browser is firefox or IE (which
> as far as I know don't provide any sandboxing for plugins) the user is
> completely unsafe when visiting any page that uses the plugin? is it
> really like this?
>
> I mean, i find it difficult to believe that they would be place their
> userbase at risk, so i'm asking how do plugins protect from this
> dangerous scenario..
>
>
>
>
> On Fri, Mar 19, 2010 at 7:12 PM, Mark Watson <[email protected]> wrote:
> > You mean like trying to avoid buffer overflows from network traffic in
> their
> > plugins?   It's kind of up to the browser to provide sand boxing, since
> it
> > controls how your plugin is started and its permissions.
> >
> > On 19 March 2010 13:54, Juan Linietsky <[email protected]> wrote:
> >>
> >> So, basically.. What I don't understand is how plugins such as Unity or
> >> Flash protect their userbase from exploits.. I mean, I'm sure they do
> >> somehow (as I can imagine they want as little hacked users suing them
>  as
> >> possible)  so I was wondering what is the "right" way to do that..
> >> -----Original Message-----
> >> From: Jon Watte <[email protected]>
> >> Date: Fri, 19 Mar 2010 14:11:20
> >> To: <[email protected]>
> >> Subject: Re: [Sweng-Gamedev] Dropping permissions and sandboxing a
> browser
> >>        plugin.
> >>
> >> _______________________________________________
> >> Sweng-Gamedev mailing list
> >> [email protected]
> >>
> >>
> http://lists.midnightryder.com/listinfo.cgi/sweng-gamedev-midnightryder.com
> >>
> >>
> >> _______________________________________________
> >> Sweng-Gamedev mailing list
> >> [email protected]
> >>
> >>
> http://lists.midnightryder.com/listinfo.cgi/sweng-gamedev-midnightryder.com
> >
> >
>

_______________________________________________
Sweng-Gamedev mailing list
[email protected]
http://lists.midnightryder.com/listinfo.cgi/sweng-gamedev-midnightryder.com