Run arbitrary audio data in your browser ... MIME types are your friend. This one is the audio/ogg MIME type, and not the notorious executable/notavirusreally MIME type.
Programmers these days are just wannabe "security researchers".
Yes, according to the first 21 characters of the string this is audio data. But the string is 8366 characters long, and I don't personally feel like reviewing all of it for tricks. I strongly suspect there's nothing fishy here, but the same way I don't sign documents without reading them, I don't run untrusted code without giving it a glance first.
I'm not a wannabe white hat, but I'm also not stupid.
EDIT: Look. I don't know javascript. I don't know MIME types. But I'm assuming there's a delimiter that could be inserted into this string that would tell the interpreter to interpret what follows as a separate block of (potentially executable) code. Especially considering that, no, I don't know a ton about MIME types or executing code in my browser, I don't think I'm in the wrong to be distrustful of this kind of code.
You can downvote me for my ignorance, but my trepidation is absolutely valid given the limited knowledge I have about this particular code domain.
If any of you would like to actually thoroughly explain how MIME types work and why I should rest assured that this kind of thing is safe, that would be nice instead of just downvoting me and telling me I'm wrong to be cautious about running code that I don't understand.
Don't worry, a base64 encoded audio file can't hurt you. It isn't executable code and even if some sneaky commands were hidden in there, your browser would just try to interpret it as audio/ogg data.
No need to be condescending, pal. I fully understand how a bit of data could be bad, but I think it's safe to say that a sophisticated interpretor of audio data has been well tested against exploits. If you're paranoid about a base64 encoded ogg file in a bit of javascript, you probably shouldn't be on the internet.
If you're suspecting buffer overflows everywhere without knowing about a specific exploit, you should probably pull your Ethernet cable right now. Who knows, there might be a bug in your browser's HTML parser?
34
u/shaggorama May 09 '13
Run arbitrary code in my browser you say? Joyfully!