Internet Explorer Bug Leaks Whatever You Type In the Address Bar (arstechnica.com) 99
The latest version of Internet Explorer has a bug that leaks the addresses, search terms, or any other text typed into the address bar. The flaw was disclosed Tuesday by security researcher Manual Caballero. Ars Technica reports: The bug allows any currently visited website to view any text entered into the address bar as soon as the user hits enter. The technique can expose sensitive information a user didn't intend to be viewed by remote websites, including the Web address the user is about to visit. The hack can also expose search queries, since IE allows them to be typed into the address bar and then retrieved from Bing or other search services. The proof-of-concept makes it transparent that the attacking website is viewing the entered text. The hack, however can easily be modified to make the information theft completely stealthy. A proof-of-concept site shows the exploit in action.
Internet Explorer? (Score:2)
Haven't Microsoft users switched to Edge by now?
Re: (Score:3)
There's still a lot of shit that works in IE but not in Edge...
Re: (Score:2)
Plus, in my opinion, Edge makes for horrible user-experience.
Irrelevancies aside, SW non-freedom is the issue (Score:3)
Is this some question rooted in making sure future privacy leaks happen faster, in a more standards-compliant way, with a different web rendering engine, or some other technocratic detail that tries to obscure the underlying non-freedom problem?
Since when would the non-free Edge browser be more trustworthy than the non-free Internet Explorer browser?
The problem is the lack of software freedom; even users skilled and willing to help themselves and others fix the problem are not given permission to know what
Re: Irrelevancies aside, SW non-freedom is the is (Score:2)
You can look at the source fuckwit thatâ(TM)s how.
Re: (Score:1)
And you then submit your patches where??
Re: (Score:3)
It's been over 25 years and FOSS hasn't solved the issue of computer security either; Open source browsers and OSs also require regular security patches.
Re: Irrelevancies aside, SW non-freedom is the iss (Score:1)
"Many eyes make all bugs shallow" was pretty much debunked when OpenSSH was breached a few years ago. The code was open but only 4 eyes were looking at it.
For as large as the OSS crowd might be the OSS code base is many times larger and most people are drawn to the latest hotness like so many moths. The reason OSS security gets broken is because the devs are busy building automatic Jenga-robots or self driving boondoggles with GPUs. And why shouldn't they? They're not paid staff, that's the whole point.
Re: Irrelevancies aside, SW non-freedom is the iss (Score:5, Insightful)
The argument was never, "If you build it, they will all turn their eyes towards it checking for bugs."
The idea is that if you know you have a bug, because you use the software, and there is only the programmer at some company that is even allowed to look at the code, then they might not fix it, and they might not even have time or interest to try. Hard problems are often going to receive (if you're lucky) a work-around unless you're paying extra to get it fixed. The same situation with free software, the worse the problem is the more people are looking at it, and the easier it is to solve.
There was never anything about fixing bugs before you know about them because free software is magic. That part you made up yourself.
OSS security isn't broken, it is powering most of the infrastructure. But that isn't in the news, because "trains ran on time, 700 days uptime" isn't news.
Re: Irrelevancies aside, SW non-freedom is the is (Score:2)
Like Heartbleed?
Re: (Score:2)
Exactly. Fixed almost instantly. As soon as the bug was in the news, there was also an open solution in the news. When the eyes turned to the bug, it became shallow. And not before that, of course.
Re: Irrelevancies aside, SW non-freedom is the is (Score:2)
In existence for how many years though?
Re: (Score:2)
That's not on topic, you're just burbling words and hoping somehow it might add up to a point.
Do try to comprehend words before replying to them.
Re: (Score:2)
https://en.wikipedia.org/wiki/... [wikipedia.org]. Now off you fuck, there's a good boy.
Re: (Score:2)
Sorry little boy, you were born yesterday and you didn't play nice so you were stupid and ignored too. When you've been here as long as I have, you don't care what idiot new users blather about.
Re: Irrelevancies aside, SW non-freedom is the is (Score:1)
Re: Irrelevancies aside, SW non-freedom is the is (Score:1)
Re: (Score:2)
It any maxim this pithy, language is being used in a special register where the "modulo" term is user supplied—if the user has the wits and can ass himself to do so.
There are so many things you got wrong here, do I need to strip gold stars off your chest on both sides of this equation?
First off, the OpenSSH bug was shallow, right from the get go, to any competent pair of eyes.
Second, cryptographic soft
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
You don't have to. IE could have been used as I did for my dad when he got his W10 system and I installed FF.
Not everything is about Edge. Where there's a will, there's a way.
Re: (Score:1)
Re: (Score:2)
So far there are approximately 6 people in the world who use Edge.
Re: (Score:2)
That's not true at all. Granted, the only reason it's not true is that there are more than 6 people in the world with Windows 10 who can't figure out how to either:
1) Click the start button and type the letters "i" and then "e".
2) Type "Chrome" or "Firefox" into Edge's search bar.
Re: (Score:2)
Correction: You really only need to type the letter "i" to have Internet Explorer show up at the top of the list (unless you've installed a bunch of other stuff that starts with an "i").
Re: Internet Explorer? (Score:2)
they moved to chrome, which happily send that information to Google only. much secure.
even localhost urls are sent to make sure the site is "safe" . much secure.
Re: (Score:2)
Yeah, what does "latest version" even mean? I thought they had finally stopped development on that garbage fire. Is that not the case? Or did they introduce this bug in a security fix? (Sadly wouldn't surprise me!)
And worse, if you type a local hostname... (Score:1)
like we have like "jenkins" for our CI server, but instead of doing a DNS lookup for that that returns an IP address since we have a properly setup search domain, it redirects us to a Bing search for jenkins. Microsoft really still doesn't grok DNS.
Re: (Score:2)
All browsers are like that. Chrome is particularly annoying since they insist on hiding the protocol, it won't even figure out it's an ip address and will search instead.
Re: (Score:2)
You can turn that off obviously.
How?
Re: And worse, if you type a local hostname... (Score:2)
I love you
Re: And worse, if you type a local hostname... (Score:1)
Chrome can be taught. If you type something to the top bar which can be a url as well, chrome will suggest the exact typing twice, but with different icons in front. A magnifying icon will do a search. A paper icon will try to open the url directly. If you choose the url, the next time you do that, the default action will be the url again. If you want a search instead, you can select the magnifying icon from suggestions (this generally works: if you want to search for a url, instead of opening it).
Re: (Score:2)
Try it with a dot on the end.
And remember, a domain name and a URI are different things.
Re:All browsers (Score:5, Informative)
And so does whatever web site you were already on when you pressed enter. That's the difference. For some reason, they update the JavaScript location object before actually navigating.
Re: (Score:2)
More of the same (Score:3)
Yet another feature of a major browser that doesn't work on Firefox. I hope this will get resolved when they release that unified search/address bar.
Re: (Score:2)
I dunno, I already have an integrated search/address bar. You can configure it that way in about:config.
If you really want to be bug-compatible with IE on this one, surely there is an extension out by now for it? We can have whatever features we want, they don't have to all be good ones.
That's fine (Score:2)
Re: (Score:2)
Headline reads like something from The Onion (Score:2)
"New spoon has throws soup back into your face"
"Cat sues owner for pooping in its litter box"
"Internet Explorer leaks your address bar"
Re: (Score:2)
Let's address the elephant in the room (Score:5, Informative)
More than two days of static Slashdot. Can't we have a headline about that shit?
Are we no longer a community? (Score:4)
Re:Are we no longer a community? (Score:5, Informative)
As a longtime reader, I also would love to see a story explaining the downtime.
There is an article describing the issues at:
https://www.theregister.co.uk/... [theregister.co.uk]
I don't know why they didn't bother putting out an article describing the issues. I was getting VERY tired of 503s...
Re: (Score:2)
SourceForge was acquired alongside its nerd news discussion board Slashdot by finance, business and technology service BizX in 2016. The duo of websites have suffered outages in the past: in 2015, "filesystem corruption" on the Slashdot Media storage platform took out SourceForge for days.
"We recognize there have always been issues with SourceForge and Slashdot, both with our current provider and within the infrastructure," Abbott told us.
"As a result we had already decided to fund a complete rebuild of hardware and infrastructure with a new provider. We have the hardware on hand and are at the final stages of negotiations with the new provider."
Re:Are we no longer a community? (Score:4, Interesting)
Re: (Score:1)
Why always blame Republicans?
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:3)
Re: (Score:2)
Yes. We're seasoned nerds who matter.
We are capable of understanding an explanation.
Re: (Score:2)
Yes. We're seasoned nerds who matter. We are capable of understanding an explanation.
Hell, I bet half of us could have fixed the problem, too.
Re: (Score:2)
I think you're right.
My motivation for being here is to read the comments by people who are much closer to an issue and much more informed than I am. /. should maybe tap into that.
Oh, this ain't good... (Score:2)
Re: (Score:1)
Address bars are for addresses. (Score:3)
Awesome (Score:1)
This is way better than the bugs IE6 used to have, 'back in the day.'
What??? (Score:1)