Really? This is an extremely easy bug to write, and given the way Microsoft APIs tend to work, I'd bet the layering of their code made it difficult to spot.
You have a process that needs to work for, in its mindset, "all tabs," which tries to recover them after a browser crash. You have a different flag on these tabs which is supposed to signal that disk-writing and history are not stored. Sounds easy, but the reality is that there are probably dozens of parts of the code that could potentially write recoverable history. Cookies, cache data for images and resources, the normal history writing functions, those are all the obvious ones to check. The anti-crash feature? Yeah, I can see it being missed.
Yes, their security audits should have caught this, but don't call it an amateurish bug simply because it seems obvious in hindsight.
(Though to be entirely fair, this is also why I won't use Microsoft products. If a reporter hadn't called them out on it, would it ever have been fixed?)
>Really? This is an extremely easy bug to write, and given the way Microsoft APIs tend to work, I'd bet the layering of their code made it difficult to spot.
The only way security issues are ever fixed is when reporters call them out on it.
Or do you think Stagefright on Android would have ever been fixed if the exploit wasn't publicly disclosed? The threat of public disclosure is the only thing security researchers have as leverage to get a company to do the right thing.
You have a process that needs to work for, in its mindset, "all tabs," which tries to recover them after a browser crash. You have a different flag on these tabs which is supposed to signal that disk-writing and history are not stored. Sounds easy, but the reality is that there are probably dozens of parts of the code that could potentially write recoverable history. Cookies, cache data for images and resources, the normal history writing functions, those are all the obvious ones to check. The anti-crash feature? Yeah, I can see it being missed.
Yes, their security audits should have caught this, but don't call it an amateurish bug simply because it seems obvious in hindsight.
(Though to be entirely fair, this is also why I won't use Microsoft products. If a reporter hadn't called them out on it, would it ever have been fixed?)