,
5 tweets,
2 min read
Read on Twitter
A more serious take on this: What makes me sad is (once again) undermining end-user security to the benefit of corporate dinosaurs who can't be bothered to adapt. The IE Compat View certainly has a long history of abuse, but let's also take a look at some other examples: (1/4)
In 2017 MS disabled VBScript in IE, but left it running in Intranet and Trusted Sites zones for the benefit of said dinosaurs still using it. Guess what? By leaving it in, it could be abused from Internet zone as well: bugs.chromium.org/p/project-zero… and bugs.chromium.org/p/project-zero… (2/4)
Last year, MS disabled Flash in Edge by default, but left a whitelist of "trusted" sites. Guess what? bugs.chromium.org/p/project-zero… (3/4)
But surely, this time it is going to be different. This time it is going to be done right and there will be no way to abuse the whitelists or escape the Intranet zone. Surely. (4/4)
And one more: Empirical evidence suggests that attack surface reduction is one of the most impactful (if not *the* most impatful) things that can be done for product security. Going the opposite way is... disappointing.
