Ubisoft "Uplay" fail?

[batto]

Shitty and shifty as Uplay is, it's funny how conspiracy theories are formed over even the stupidest things.

What happened is that the browser plugin was naively coded and a developer at Ubi thought "Yup, Base64, nobody will ever break that!" and nobody noticed it.
No amount of regular QA testing would've caught this, because, the feature it was made for worked as expected. Unless of course they have QA that focuses on security issues like this. What would've probably caught it in a blink of an eye is a peer review of the code written from someone who understands the implications of not filtering any user input.

The stupid thing is that their browser plugin allow execution of local programs from JavaScript (eg. from anywhere). If they are TAHT stupid (as in "why on earth are such people allowed to code?") to think that no one will notice it from base64 (very easy to recognise) argument to option that is named orbit_exe_path, then, well, there'll be probably much more going on in the wild =).

[RangerPL]

Chrome opened the link but didn't open Calculator.

Good on you, Chrome.