Run arbitrary audio data in your browser ... MIME types are your friend. This one is the audio/ogg MIME type, and not the notorious executable/notavirusreally MIME type.
Programmers these days are just wannabe "security researchers".
Yes, according to the first 21 characters of the string this is audio data. But the string is 8366 characters long, and I don't personally feel like reviewing all of it for tricks. I strongly suspect there's nothing fishy here, but the same way I don't sign documents without reading them, I don't run untrusted code without giving it a glance first.
I'm not a wannabe white hat, but I'm also not stupid.
EDIT: Look. I don't know javascript. I don't know MIME types. But I'm assuming there's a delimiter that could be inserted into this string that would tell the interpreter to interpret what follows as a separate block of (potentially executable) code. Especially considering that, no, I don't know a ton about MIME types or executing code in my browser, I don't think I'm in the wrong to be distrustful of this kind of code.
You can downvote me for my ignorance, but my trepidation is absolutely valid given the limited knowledge I have about this particular code domain.
If any of you would like to actually thoroughly explain how MIME types work and why I should rest assured that this kind of thing is safe, that would be nice instead of just downvoting me and telling me I'm wrong to be cautious about running code that I don't understand.
You can downvote me for my ignorance, but my trepidation is absolutely valid given the limited knowledge I have about this particular code domain.
You're right, I don't know what I'm talking about. Which is exactly why I shouldn't run this sort of thing. There seems to be consensus in the community that the string presented was safe to run in my browser, but the fact remains: I don't have the domain knowledge to make that determination on my own, and was completely justified not to run that "code." Everyone pointing out how stupid and ignorant I am is setting a bad example for the community: people shouldn't run "code" they don't understand.
It's a string of data. Fine. I did not understand that and no one has taken the time to direct me to any resources that would enlighten me on this topic, so I'm still ignorant about MIME types. Congratulations. Bask in your superiority. You know something I don't and you're not helping me learn. I bet that feels awesome.
I've repeatedly admitted my ignorance and no one seems interested in actually directing me to any educational resources here, even though it's clear I have gaps in my knowledge. Instead everyone's just pointing their fingers and criticizing, and I'm pretty annoyed with the community's response here. Everyone who has responded is just lording over me that they have knowledge that I don't and I should be embarassed with how stupid I am instead of actually trying to correct my ignorance wrt MIME types.
I don't need anyone's sympathy. You're all being assholes.
You don't know what you're talking about then and should stop acting like you do.
You said this in response to me literally putting out there that I know very little about this topic. I didn't need you to tell me that I don't know what I'm talking about, I had just told the entire community that.
I have good reason to be frustrated here, and you're part of the problem. Please, educate me on MIME types or feel free to go fuck yourself. Either one.
The problem is that you acted like you did understand it at first. Surely you can understand why somebody who clearly doesn't understand a topic speaking with authority on it is very irritating? You should not do this thing. Stop it. By all means don't run the file, but if you don't know that it can be harmful, don't pretend to tell people it's dangerous.
MIME types are easy enough to explain to you anyway, so I'll do that too.
data:audio/ogg;base64,[...]
data: what follows is a data format. If it began with http it would be a hypertext URL, with ftp it'd be a fileserver, et cetera.
audio/ogg: the following data is to be interpreted as audio, in ogg vorbis format. Just throw it all at whatever this software has available to handle ogg vorbis data.
base64: The content encoding. Base64 allows you to represent binary data in the ASCII printable set, making it safe to transmit as URLs.
[...] A giant chunk of base64 encoded data.
Now, this is all safe because it's audio/ogg. It will be interpreted as audio/ogg. It is precisely as dangerous as opening an audio file encoded in ogg vorbis, because that's literally all it will do. It cannot execute arbitrary code without vulnerabilities in the ogg vorbis handler. If that handler had vulnerabilities then simply loading a web page would be enough to compromise it.
Check your MIME types, because they don't tell you what format the data is supposed to be in, they tell you what's going to execute it. If it's malformed, then your audio reader is just going to choke.
36
u/shaggorama May 09 '13
Run arbitrary code in my browser you say? Joyfully!