Full Disclosure mailing list archives
Re: shell:windows command question
From: Barry Fitzgerald <bkfsec () sdf lonestar org>
Date: Thu, 08 Jul 2004 10:28:22 -0400
Darren Reed wrote:
A simple solution would be to add the shell protocol to this list. Personally I think a secure blacklist is hard to maintain as new dangerous external protocols could be invented by third-parties leaving Mozilla vulnerable again.Completely agreed. There should be a whitelist, not a blacklist... a safe protocols list.And what would happen? Nobody would configure anything but those. And what would happen next? People would find ways to put their "new stuff" inside the "safe ones". Kind of like how "http" is declared safe (but is it really??) and so every man and their dog tunnels their proprietary stuff through that because it'll go through firewalls.
And you're suggesting that allowing local protocols to run local code per the background call of a website is better?
-Barry _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- shell:windows command question Perrymon, Josh L. (Jul 07)
- Re: shell:windows command question Andreas Sandblad (Jul 07)
- Re: shell:windows command question Barry Fitzgerald (Jul 07)
- Re: shell:windows command question Komrade (Jul 07)
- Re: shell:windows command question Eric Paynter (Jul 07)
- Re: shell:windows command question Xavier Beaudouin (Jul 08)
- Re: shell:windows command question Barry Fitzgerald (Jul 07)
- Re: shell:windows command question Andreas Sandblad (Jul 08)
- Re: shell:windows command question Andreas Sandblad (Jul 08)
- Re: shell:windows command question Barry Fitzgerald (Jul 08)
- Re: shell:windows command question Darren Reed (Jul 08)
- Re: shell:windows command question Barry Fitzgerald (Jul 08)
- Re: shell:windows command question Darren Reed (Jul 08)
- Re: shell:windows command question Andreas Sandblad (Jul 07)
- <Possible follow-ups>
- RE: shell:windows command question Perrymon, Josh L. (Jul 08)
- Re: shell:windows command question Andrew Poodle (Jul 08)
- RE: shell:windows command question Clairmont, Jan M (Jul 08)
- RE: shell:windows command question Perrymon, Josh L. (Jul 08)
- Re: shell:windows command question Keith and Kelley (Jul 08)
- Re: shell:windows command question Keith (Jul 08)