8

When browsing I am ocassionally given warnings about pages that host malware "that could damage my computer". I am seriously perplexed as to why, in 2010, browsers still have possible exploits and can be cracked.

My question is "Why?". I'm assuming it's because of the quick development that occured in the browser wars which were unsufficiently tested, but I'm unsure. Surely WebKit would have patched all the issues in KHTML, or Gecko sorted out the flaws in Netscape's engine, and the IE coders sorted through their codebase to eliminate possible flaws?

(Somewhat related: Which browser is the most secure? (research and practically based).)

Improve this question
2
  • 8
    It is because building a safe method to allow 3rd parties to run software on your computer without your explicit permission or consent is very hard.
    – Zoredache
    Mar 14, 2010 at 22:40
  • They have a lot of bugs, exploiting those is a lot thougher
    – Ivo Flipse
    Mar 15, 2010 at 23:10

8 Answers 8

Reset to default
10

Complexity, complexity, complexity.

A modern browser supports

  • Retrieving data over multiple protocols (http, https, ftp, ...)
  • Rendering multiple different markup languages (plain html (in several versions), xhtml, html with css ...)
  • Storing data and retrieving data at the request of remote users (cookies)
  • Two (or more!) Turing complete programing environments to run code supplied from the outside (javascript, java, maybe flash ...)
  • Some kind of internal options database
  • (stolen from broam's insightful answer, so go vote for it) support a plug-in architecture that allows third party code access to the browser internals

and is expected to be fast, have clever caching to make it faster, and to have an expressive and powerful interface.

There is a heck of lot going there, and they are big, complex pieces of software.

Improve this answer
2
  • Which is why, when I absolutely want safety over anything else, I use Lynx. There's very little attack surface on a text-only browser. There's also a whole lot of stuff that it can't do.
    – David Thornley
    Mar 15, 2010 at 18:59
  • 1
    @David: I'd say that Lynx is probably just as unsafe. It's security is less tested and many attack vectors are buffer overflows and similar holes.
    – Georg Schölly
    Mar 15, 2010 at 20:26
8

One vector that people haven't mentioned: plugins. The browser may be secure, but the plugin might have wide holes in it...and with ubiquitous plugins like Flash...exploits ahoy matey.

Improve this answer
3
  • I possibly should have refined my question; I was referring to the core elements of the browser (layout, javascript, et caetera).
    – Humphrey Bogart
    Mar 15, 2010 at 21:05
  • 2
    You could--but I would have brought this up anyway. I'm known as the "technology luddite" in my circles of friends because I do not have Flash installed. The fact that IMO it stinks on ice in Linux is only part of it.
    – Broam
    Mar 15, 2010 at 21:21
  • @Broam in 2022, we are all luddites.
    – user253751
    May 18, 2022 at 11:11
4

Many answers here, all touching on different reasons, but the fundamental answer is "because that's where the money's at."

Lots of other software probably has similar or more numbers of bugs, but they're not usually exploitable since you need to convince a user to expose them to the wild internet.

Improve this answer
3

Partially it is the fact that some updates are rolled out faster then they should be. But one prevailing fact is a blog post Jeff posted awhile back here when ran as admin anything can happen. Also since each computer is different running different things it isn't always the browser itself that has an exploit. Sometimes it is a third party plugin like Flash.

Improve this answer
2
  • Nice link. I knew someone like Jeff Atwood would have a post on it.
    – Humphrey Bogart
    Mar 14, 2010 at 22:53
  • Related to "rolled out faster than they should be" is that browser vendors are rushing to have the latest and greatest, sometimes introducing new features faster than they can be sufficiently tested. Perhaps a rare case where too much competition can be a bad thing?
    – Michael Itzoe
    Mar 15, 2010 at 18:06
3

Part of the problem is that the performance of browsers (like word processors and CAD programs) is highly dependent on the data, and as there can be (pretty much) an infinite variety of data there's no way that the developers can test every single combination to see if it gives undesirable results.

Another aspect is that to get the interactivity that users and (more importantly) web site owners want the browsers have to execute code. This is another weak point.

Improve this answer
2

dmckee's answer is right on, but it can all be summed up with one thing: complex interaction with unexpected inputs. Your browser has to run code/markup, plugins, etc., deal with user input, plugins that run code, etc. It's impossible to test for all interactions, because you'd need the entire Internet -- present and future -- in your test suite.

When you test software, you test against a range of normal and abnormal inputs and then you're ... ready for beta. So this is all part of the infinite beta phase :)

Also as chris says, that's where the money's at, meaning that browsers are a very interesting target.

Improve this answer
1

Fact is that every software has its weak points. None is bug free. And by fixing bugs, new ones are introduced.

The other point is that the browser is one of the most used application and you can reach at a lot of people easily. That too makes it interesting for attackers to find the weak points.

Improve this answer
0

You might be right if all the updates to browsers were just bug fixes and tweaks to the original version. However, each new version adds more features which introduce more potential for bugs and security holes.

Also, security and usability are often at opposite ends of a trade-off, and features sell more software than the lack of security issues.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .