Re: eww

[Lars Magne Ingebrigtsen]

Stefan Monnier <address@hidden> writes:

> Sounds highly hypothetical.  If/when eww can be used to access such
> sites, maybe we can start worrying, but then even if you don't keep it
> in live data, the sensitive data may linger around in
> "garbage/free" memory.  If you need to worry about that, you need to
> worry about a lot more than that.

It's a matter of how big the attack surface is.  Leaving the data in
easily accessible structures indefinitely is a larger attack surface
than killing off the buffer where the offending data is.

-- 
(domestic pets only, the antidote for overdose, milk.)
  bloggy blog http://lars.ingebrigtsen.no/