[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: gcj and etch freeze

On Sat, Aug 19, 2006 at 02:59:28AM -0700, Steve Langasek wrote:
> On Sat, Aug 19, 2006 at 11:42:03AM +0200, Robert Millan wrote:
> > > Last I knew, it still had
> > > serious security problems.
> > Which ones?  I can't see anything in the BTS.
> I wouldn't know them by bug number; previously though, the problem was that
> gcjwebplugin didn't have appropriate sandboxing.

#267040: remote code execution hole due to lack of Java security manager

This is 'fixed' by:
- Shows warning before loading an applet (Closes: #267040, #301134)

Which, IMHO, doesn't make this usable except in fully trusted
environments where the browser is exclusively used to browse a fully
trusted intranet where nobody can change web content that doens't
already have root on your machine.

Which is, basicly nowhere (IMHO, and barring myself misunderstanding

The warning is talked about here:
(thanks Michael Koch for the link)

I personally do not think we should offer this option to users, because
users tend to trust sites easily (and they are too often asked about
'trusting' too, w.r.t. https websites, for example), even though the
wording used is strong, and the consequence is arbitrary remote code

Anyway, I will followup to the bug in question for discussion about this


Jeroen van Wolffelaar
Jeroen@wolffelaar.nl (also for Jabber & MSN; ICQ: 33944357)

Reply to: