It’s not about Webkit, silly. It’s about evolution.

« Webkit is a rust bucket. We can’t move away from it, because our users rely on its bugs as much as on its features, but it’s based on deprecated technologies, concepts that don’t scale anymore, and it just won’t match today’s needs or hardware. If we had any choice, we would dump the whole thing and restart from scratch. »

JavaScript Security Extensions for Firefox

This entry is a brief presentation of an on-going work in progress by my second group of students in ENSI de Bourges, Benjamin Meslin and Jeremy Colombet.

The problem

As I detailed in a previous entry, Firefox Extensions — just like their counterparts in Internet Explorer, Safari or Air — are essentially unsafe: once an extension is installed, nothing prevents it from reading, writing or removing files on the user’s hard drive or running arbitrary programs or downloading further instructions from a malicious web site. More subtle problems may also arise, as a malicious extension may read or alter the data of Firefox or of another extension during its execution, so as to, say, steal passwords or reroute transparently from a legitimate website to an identical but forged website.

Now, most recent operating systems have a form of Mandatory Access Control layer (sometimes marketed as “sandboxes”), designed to permit refined security checks of what a program should be able to do when used by a given person and in a given role. Unfortunately, in the current state of things, these layers are completely unadapted to universal clients such as web browsers (or virtual machines, by the way), which act as smaller operating systems themselves, without a clear separation of roles or uses.

That doesn’t mean that MAC can’t be made to work for Firefox, of course. Just that it needs work.

Trusting your desktop to the web: Safety in Air, Silverlight and Prism

A few weeks ago, I wrote about the safety of extensions to Web browsers. In the meantime, the landscape of web browsing has changed a lot, at least for developers. Why ? Because of Adobe Air, Microsoft Silverlight and Mozilla Prism, three tools used to put the web on your desktop.

While none of these products is actually new — they are all renamed versions of things that have been hanging out in the air for some time — and none of these products is branded as web browsers, well, that’s exactly what they are. Of course, whenever new browser or browser-like products appear, one of the main questions should be: how safe are they ?

Let’s take a somewhat deeper look.