I suspect that there are far more flaws in Netscape. String buffer overflows are another good guess here -- they are probably rampant through the code both for the browser and the commerce server they sell. I can't prove it myself, of course, given that I don't have the time to rip the thing apart, but the same folks never seemed to learn their lesson in release after release when they worked at NCSA, and the only thing thats probably keeping their dignity here is the lack of distributed source code.
I doubt this in the case of the browser. Atleast as far as the parsing is concerned. There may be a buffer overflow for example, when you input the url in the "open" window, but that has to be done manually by the user and isn't a threat, like a "rogue homepage" would be. The reason I doubt string buffer overflows in the case of the browser is that it seems to be written in some object oriented language, perhaps C++ (or maybe just oo-C like BSAFE). Once you have a general robust String class, you can prove it's non-overflowable, and therefore no composition of operations from the browser code will overflow it (unless of course, you break language safety by using casts and pointer manipulation) Secondly, Netscape has been very robust in my own testing against these common bugs. One of the things I've done lately is "tiger team" attacks against servers and browsers. (of course, sendmail is a brilliant counter example) (if you can find a call to gets() in Netscape, I will instantly retreat ;-) ) Netscape's security maybe bad, but the rest of their browser, or atleast their development process, is good engineering. They've built a very complex application, fairly quickly, that runs with very few bugs, across a wide variety of operating systems and GUI's, while maintaining a consistent user interface and feature set. Netscape 2.0 incorporated Java, LiveObjects, and more HTML3.0 in almost record time. (I wasn't expecting a Java capable Netscape until atleast December). I'd like to see Microsoft develop a piece of code that quickly that runs on umteen different flabors of Unix, MacOS, and Win3.1/95/NT. Hell, they can't even write code that runs smoothly across all three flavors of their operating system. -Ray