RCE Without Native Code: Exploitation of a Write-What-Where in Internet Explorer | Hacker News Reader

RCE Without Native Code: Exploitation of a Write-What-Where in Internet Explorer

thezdi.com

54 pointstwoodfin9 comments

IE is one of the few remaining browsers that still lets you configure settings on a per-"zone" basis by default, with no need to install additional extensions to get this IMHO very useful function:

https://evolpin.files.wordpress.com/2011/11/internet-zone.pn...

That setting has been there since at least IE5, if I remember correctly; and it's also one of the things I always disable after a new install too. I think the fact that Microsoft clearly understood the idea of partitioning sites into different trust levels, with different levels of security for each, was an idea ahead of its time. They did not have the "JS is obligatory and you should trust all sites to run arbitrary code" attitude that unfortunately is prevalent today.

...then MS comes up with Edge and removes the feature completely, possible due to those developers with the aforementioned harmful attitude:

https://answers.microsoft.com/en-us/insider/forum/all/micros...

Edit: did I say something wrong...?

Firefox has some sort of “profiles” thing, does it not? Can you change settings per profile?

Behaviour per profile (loosely speaking, an identity) is different from behaviour per zone (a site or group of sites).

It's actually a quite brilliant idea, but just like NoScript and other similar addons, it's simply too complicated for most users.

Yes, you and I might be able to use it, but my grandmother can't. As the web is mostly built to be as accessible as possible, it won't catch on.

I find “write-what-where” a little clumsy as a term. How about just calling it “POKE”, like when we were kids writing BASIC?

Presumably the qualifiers are there to distinguish it from a more limited write primitive, which can still be quite useful.

But the POKE operation is specifically about writing to a given address. So it does capture what you are talking about. (Whether it is any clearer than "write-what-where" I leave as an exercise to the reader).

The kids these days write JavaScript.

I think a larger portion of the audience will understand "write-what-where"-primitive than "POKE" nowadays.

"Write-what-where" might feel clumsy, it's a lot less ambiguous than a word like POKE, which only means something to the subset of programmers who grew up on BASIC.

Reply on news.ycombinator.com