Hacker News Reader

To eliminate further attack vectors, uninstall both the browser and the OS ; ).

I just want to point out that's there's a big difference between having an interpreter on your machine like python, ruby, or java, and having a browser plugin that executes remote code by default.

There's nothing wrong with the former, there's everything wrong with the latter.

View on HN

Do you mean Java in the browser? If so, what do you think is happening when your JavaScript code hits your server's REST code returning JSON?

The primary difference is that JSON isn't considered executable-- at least not by any Java JSON libraries that I've seen; it's just data.

(Yes, non-executable data can still deliver a malicious payload, e.g. http://technet.microsoft.com/en-us/security/bulletin/ms04-02.... It's just much less common-- presumably because it's a much smaller attack surface.)

you forget the time when json was usually called with exec...

But mostly it is buffer overflow bugs that get you now.

what do you think is happening? Browsers don't use Java to parse/encode JSON... JSON is a Javascript facility.

Reply on news.ycombinator.com