Tag Info

New answers tagged

13

That the code "runs as root" is mostly irrelevant. Root or non-root is a distinction that makes sense only locally to a machine, and only if you want to contain some potentially hostile code (e.g. hijacked server code) without bringing down the whole machine. This is the mainframe model from a few decades ago. At that time, it was believed that you could ...


3

You might try demonstrating server problems that occurred in well-tested servers and make the claim "If after all of the testing and examination they were insecure, how can we expect to do better?" The first example that pops into my head is the Shellshock bug. When combined with CGI from the Apache Web server, it allowed remote execution. This was not due ...


7

Frankly, the relevant words are "custom code running as root and exposed to the Public." To justify the coding effort and delays, you will have to do some quick calculations on the impact of the code being exploited and a malicious actor gaining root access to the server it is running on. If the cost of a breach is more than the cost of the coding effort ...


0

iOS has a relatively simple permissions system for applications. Applications have no access to the mail application, but they can access data from the native calendar and contact applications, though only if this permission is enabled in-app, and can be disabled from the start menu: So basically, they can access location, contacts, calendars, reminders, ...



Top 50 recent answers are included