On 3/25/06, Dinis Cruz <[EMAIL PROTECTED]> wrote: > 4) Finally, isn't the solution for the creation of secure and > trustworthy Internet Browsing environments the development of browsers > written in 100% managed and verifiable code, which execute on a secure > and very restricted Partially Trusted Environments? (under .Net, Mono or > Java). This way, the risk of buffer overflows will be very limited, and > when logic or authorization vulnerabilities are discovered in this > 'Partially Trusted IE' the 'Secure Partially Trusted environment' will > limit what the malicious code (i.e. the exploit) can do.
I am less than enthusiastic about most of the desktop java applications I use. They are, for the most part, sluggish, memory gobbling beasts, prone to disintegration if I look at them cross-eyed or click the mouse too frequently. Usability problems with java applications are not necessarily due to managed code, of course, but the idea of creating a full-featured browser, from scratch, with usability as good as IE and Firefox strikes me as a fairly tricky project. What about using the facilities already provided by the OS to enforce the sandbox? Rather than scrapping the existing codebases, start running them with restricted rights. Use mandatory access control systems to make sure the browser doesn't overstep its bounds. Regards, Brian _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
