QUOTE(Chugworth @ Sep 9 2008, 20:19)

QUOTE(Phonics Monkey @ Sep 9 2008, 06:38)

You do realize that once the file is on the local hard drive executing it is almost trivial, right?
Yes, by the user though. It's not very much different from a virus coming in as an email attachment.
Except for the simple fact that most (proper) Email clients are heavily sand-boxed which prevents any scripts from getting to the system ... this is why most of the current batch of exploits in the wild require the user open the attachment. Not to mention it actually required little to no action from the user to fire the DL'ed file.
Email clients are heavily guarded
Browsers are watched carefully
A file on the desktop isn't checked at all.
Oops...!
QUOTE
I have seen quite a few of those lately at work, and most of the time the anti-virus software deletes it.
Key phrase there is "Most of the Time". This is compounded by the rampant rash of FP caused by over zealous AV companies using a shoot first definition update strategy ... Which only inspires "End Users" to turn off or ignore the AV software in an attempt to see their "Prize"...
QUOTE
These are the various layers protecting you from this issue in Chrome:
1. Common sense
2. Anti-Virus software
3. UAC
4. "Ask where to save each file before downloading"
You are Kidding Right?!?
1. Doesn't even exist in the "average End User's" world.
2. may or may not be aware of the issue in time.
3. is kinda my point as they're playing it fast-and-loose assuming that UAC (which is already being faked/exploited) will clean up the mess ... Leaving XP users hanging.
4. isn't (or wasn't the default) and completely left .jar file handling up to fate.
QUOTE
QUOTE(Phonics Monkey @ Sep 9 2008, 06:38)

The severity of the flaw isn't the issue, the fact that it preexisted the project & still wasn't addressed however bothers me. Also the commentary of some of the Google spokes people is troubling regarding a "Don't worry Vista will stop anything the browser misses" Attitude.
Hay man, I have never been in the Tin-Foil hat club ... but this thing really shaves all the hair of my warm fuzzy feeling. It being handed to the general public with great fanfair (in an Apple-ish fashion) and it's no where near secure, it's not even trying to be. ...I just gota a hunch it's going to make a huge mess at some point.
Really now, over the years we have seen plenty of instances where Microsoft has been slow at patching a security hole. And that has bitten them a few times also. I really don't have much reason to believe that Google would be generally slower at it. And Chrome, being open-source, is subject to peer-review also. I'm not worried about the browser itself. Where I become paranoid is with plug-ins.
Ah! So if it's Monkey see Monkey do it makes it all Okay?!? Let's try to remember that it's the marketing companies that got us into most of this mess in the first place. ...And Google is one huge market giant hell bent on taking over the web/desktop with their Cloud Computing concept. The suits lean on the coders and the shiny stuff flies out the door regardless of how many holes are in it.
Yes MS has been slow at times, but they're also the BIGGEST target, so they have to be damn sure that their updates work without breaking something else. Google on the other hand is just making a wild grab at the "Brass Ring" and is exhibiting no concern for "Collateral Damage".