Slashdot Mirror
Vulnerability in WebKit Crashes and Restarts iPhones and iPads (zdnet.com)
Catalin Cimpanu, writing for ZDNet: A security researcher has discovered a vulnerability in the WebKit rendering engine used by Safari that crashes and restarts the iOS devices -- iPhones and iPads. The vulnerability can be exploited by loading an HTML page that uses specially crafted CSS code. The CSS code isn't very complex and tries to apply a CSS effect known as backdrop-filter to a series of nested page segments (DIVs). Backdrop-filter is a relative new CSS property and works by blurring or color shifting to the area behind an element. This is a heavy processing task, and some software engineers and web developers have speculated that the rendering of this effect takes a toll on iOS' graphics processing library, eventually leading to a crash of the mobile OS altogether.
The entire HTML/CSS rendering concept is flawed from the get-go, with piss poor standardization and failure to maintain boundaries within graphical elements. It's effectively a pinup board with no boundaries and no real rules on rendering. But it's Agile! ;)
The cesspool just got a check and balance.
It's not the developers. It's the designers who f*cking think that their site should look the same on every browser and every computer no matter what. They were the idiots that used to think that because your screen had n pixels in width then their website could be n pixels wide too. I mean, everybody has their browser maximized right?!?!? They also think that everyone has a high-speed connection to download unoptimized graphic files.
It's HTML, it's going to look slightly different on different browsers and different platforms. Live with it. If it really needs to look the same then make a PDF to download.
Just display the text.
1990 called, they want their HTML 1.0 back.
That's all I want in a browser
Use Lynx, and leave the rest of us alone.
It's not *that bad* really. The crash occurs in the gfx library / rendering engine, on a lower level. It's just given a single absolutely massive rendering task it's unable to complete within the watchdog duty cycle. Someone didn't foresee this - normally the library should be done with its job within microseconds, but this specific job was engineered to take a "macroscopic" time slice, and so, the watchdog bites.
There are solutions - but not easy. It would be fairly difficult to design a subsystem that estimates time required to render a specific effect, before deciding "just don't do it", An easier approach would be to abort the rendering job after a preset time, and restore the subsystem to a stable state. This would require a separate dedicated watchdog, and a special subsystem that is capable to abort and unroll an arbitrary job mid-way through. Or they could slice the rendering engine vertically, and make it perform only a specific amount of work per time slice. And this gets quite convoluted because you're replacing simple loops with a finite state machine.
All doable, all difficult and costly... and not contributing to normal web experience, just protecting against malicious attacks. Yeah, they fucked up, but it's a 'the fucking incompetent idiots' fuckup type, it's just 'for fuck's sake, do we really have to protect against THIS too?' one.
45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2