dpark
Joined 19 years ago
Joined 19 years ago
If merely GET on the link was sufficient to trigger the behaviors, the adversary generating the link would just GET it themselves.
I have not experienced that at all. I see people touch their touch-capable laptop screens all the time.
I don’t understand how people legitimately hold this belief that no one could or would use a laptop touchscreen. This is exactly how millions of people use their tablets every day. You hold it in your lap and you poke the screen. Or you use the stand to prop it up on a table and you poke at the screen. And shockingly, your arm doesn’t fall off.
I think this is the wrong device to start with, though. The demand for touchscreens is probably highest in the cheapest lines. But presumably this will trickle down over the next few years.
If nothing else, the more complex hinges create significantly higher failure risk.
I have no idea how this keeps getting repeated. No one with a touchscreen laptop is just hovering their arms in front of the screen like a zombie for hours.
It’s another input. You use it when it makes sense. For some, that’s pretty frequent. For others like you, maybe never.
Scrolling through long docs is also comfortable with touch if it’s on your lap or a flat surface directly in front of you. You scroll with the thumb while your hand/arm rests comfortably.
This is absolutely not security engineering. This is nit picking a specific attack factor and trying to argue that it’s impractical. I suspect you are wrong, but it doesn’t matter, because you are ignoring the broader class of attacks and focusing on one specific example. The class issue is that on a Mac, you cannot trust any terminal-based application to honor the CRL. This means that any site accessed from a terminal based application cannot be trusted. There are a billion ways to exploit that.
This is not good security engineering from Apple. There is no way to justify this. Humans make mistakes, and that’s just life, but we shouldn’t pretend that this is an acceptable state or an acceptable response.
The claim is that archive.today is injecting malware into archived pages. Given some of the past behavior, this is not hard to believe.
It cannot be this clean cut or Google v Oracle would have been trivial to decide.
A telephone directory can be copyright protected, too. The facts within it cannot. Exactly like recipes. A particular presentation of a recipe is absolutely copyright protected. But this doesn’t mean no one can publish the same recipe in their own presentation