Slashdot Mirror
Microsoft Research Builds 'BrowserShield'
SteelyBen writes "Researchers at Microsoft have completed work on a prototype framework called BrowserShield that promises to intercept and remove, on the fly, malicious code hidden on Web pages, instead showing users safe equivalents of those pages. The BrowserShield project, an outgrowth of the company's 'Shield' initiative, could one day even become Microsoft's answer to zero-day browser exploits such as the WMF (Windows Metafile) attack that spread like wildfire in December 2005."
... Will just get a new name: zero-day browser-sheild exploits.
Sigs are for the weak.
Unfortunately, I wrote it directly into my program without giving it another name, since I didn't realize I could sell the security separate from the program.
Innovation at its finest I suppose.
How will this even help? Will the browser shield require signatures and/or heuristics like virus scanners, and thus get outdated? If manpower needs to be invested in this technology, wouldn't the same manpower be better invested in solving the problem, rather than patching it?
Visit http://ringbreak.dnd.utwente.nl/~mrjb/growingbettersoftware to download your free copy of the book
... so their answer to poorly written software that is security-hole ridden is to layer more software written by the same people on top of it? Wouldn't it be easier to just write good software in the first place then actually fix, in a timely manner, anything that crops up? I'm failing to see how more bloat is going to help.
Jeremy Logan's Website.
DRM has nothing to do with controlling the message of content. It controls access to content.
And quite frankly, there are far easier ways of implementing such a sinister plot in a much more comprehensive fashion.
Reduce, reuse, cycle
There goes MS again. Let me guess: it will show a big ass shiny shield with a really cool animated graphic and ask "Are you sure you want to execute this malicious code?" and when the user clicks the Ok button it will ask once more just to be sure.
Personally I'm very affraid about MS sniffing my code. Experience shows that it will let tons of lines of malicious code pass, while locking down many good codes out there.
When those people will learn to stop trying to do magic tricks and be serious? A solution to browser flaws already exists and it's not magical at all, but technical: it's called "patch".
Er Galvão Abbott - IT Consultant and Developer
WTF? This is the kind of approach that would be used on someone else's propriatary legacy software, or on some piece of hardware to keep it working without altering the thing itself. What are m$ saying? 'Our browser code is such a POS that we don't know how it works anymore'? 'We lost the source code ages ago and we cannot be bothered doing the job right'? 'We have so much market share that we really don't give a crap anymore, pass the crack pipe and the stock options'?
They whose government reduces their essential liberties for temporary security, receive neither liberty nor security.
1. create product with security leaks
2. receive complaints
3. do not solve security leaks but instead, build a wall around them
4. go to sleep and forget about 1.
*sigh* So they are STILL trying to put bandaids on their old, insecure, highly-patched (and therefore low quality) software rather than ditching insecure communications protocols and writing a simpler browser that is secure from the gound up.
Yep - Microsoft is all in favor of security - so long as it maintains backward compatibility and they don't have to throw anything away.
English -- gotta love it! / The engineers refuse to refuse the rocket until the refuse is removed from the launch pad.
What happens when you mix this with Digital Restrictions Management that goes down to the hardware level?
The answer is: absolutely nothing.
What I'm getting at is, what if it's not malicious code that is being replaced by a "safe equivalent", but perhaps a controversial story on a news website, or an important email between governments?
The technology will not patch plain text content, it'll patch vulnerabilities. Of course this is obvious to most people worth a damn out there, but you get modded up anyways. It's almost as if this is Slashdot.
I know we all love to hate MS but this is a good idea.
First off, I have seen first hand some of MSResearch fairs and they is a lot of great stuff coming out of them. Anything that comes out of those labs is worth at least some thought before you dismiss it.
That aside, stripping nasties using a simple system before they reach a more complex system isn't really a bad idea. All of our mail servers have some sort of filter that does this (granted, more for dumb users). IIS 5 did this using a tool that was later built into IIS 6. Hell, firewalls aren't a much different idea. Most of us already run some sort of proxy software to block popups, scripts, or ads. All MS is proposing here is the equivalent of proximity or similar proxy software.
Do we just hate this idea b/c MS is doing it?
Hmm, so I should trust MS to know what content I want them to "clean"? No thanks. MS has a lot to do to earn back my trust and I would bet the same goes for many other computer users.
What can I say except I'd hate to live in your isolated little made up "omg MS is coming to get me" world.
No matter what the society turns to be, there'll be always people to build inexplicably complex and ridiculous conspiracy theories that all link to the same "ultimate" enemy. Does it make you feel smarter that you saw this intricate plan of Microsoft to ban your blog noone gives a damn about either way?
But it's really not that cool to throw unsubstantiated FUD around as it used to be. We call it trolling, and it's mostly unwelcome.