Arbitrary code execution through unsanitized browser UI • Hacker News Board

Re: Arbitrary code execution through unsanitized browser UI

#31

Post by Khoth » Thu, Feb 01, 2018, 10:05 AM UTC

blacksmith_tb wrote: post #13

danjoc wrote: post #10

Earlier quoted context omitted.

>Immediately stop using 56, downgrade to the LTS or upgrade to 57 58 is the fixed version. >I get the feeling a fair few HN readers don't keep their browsers up to date for whatever reason. That's because 57 was a complete dumpster fire. It broke all the add ons. Little wonder people would not update. I was a happy FF user for years. My solution was to dump FF and move on, but I know there are still a lot of people c…

It broke add-ons that weren't being maintained, primarily. It's true that for some users, this would be very unpleasant, but I have five extensions working fine here in 59.0b5 (including important security/usability ones like uBlock Origin and Stylus).

That's not my experience. The addons I use that it broke were all being maintained, but FF57 didn't provide any API to replace what they were using before, so their authors reluctantly abandoned them or provided limited, crippled versions that don't work properly.

Re: Arbitrary code execution through unsanitized browser UI

#32

Post by quotheth » Thu, Feb 01, 2018, 5:10 PM UTC

WalterGR wrote: post #22

quotheth wrote: post #18

Earlier quoted context omitted.

There is no universal metric for security. What I will say is that Edge and Firefox are doing an excellent job - I'm really impressed. Chrome is still the safest browser today, in my opinion. Site isolation, which was released recently, is a really great example of how far ahead they are - site isolation is at least 3, maybe 4 years in the making. That's serious work. They have had an excellent bounty program. They h…

There is no universal metric for security. What about slashdot-style raw counts of vulnerabilities? As Microsoft got their security more together, it seems like that measure has fallen out of favor. I am frequently astounded by how many vulnerabilities Firefox point releases address, but I don't know the stats.

Vulnerability counting is never a metric for security when comparing counts across products.

It's very helpful for counting within a product.

One simple example - A and B are browsers. A has a bounty program that they invest millions into, B does not.

A gets 100 vulnerability reports a month, B gets 5.

Is B safer?

No.

However, let's say we just look at A. It gets 100 a month, and then a new feature is added - suddenly it's 200 a month, and the vulns tend to be in the new codebase. That's interesting information for A - it has nothing to do with B.

Re: Arbitrary code execution through unsanitized browser UI

#33

Post by quotheth » Thu, Feb 01, 2018, 5:11 PM UTC

pcwalton wrote: post #20

quotheth wrote: post #18

Earlier quoted context omitted.

There is no universal metric for security. What I will say is that Edge and Firefox are doing an excellent job - I'm really impressed. Chrome is still the safest browser today, in my opinion. Site isolation, which was released recently, is a really great example of how far ahead they are - site isolation is at least 3, maybe 4 years in the making. That's serious work. They have had an excellent bounty program. They h…

Note that Site Isolation isn't on by default, and I still don't know what they're going to do about sites that contain hundreds of cross-domain iframes.

My point with site isolation was more their continued effort to push interesting, compelling security improvements. Currently, from a corp perspective, enabling site isolation for internal high security websites (SSO pages etc) is possible with GPO and a big win imo.

Please don't take it the wrong way, I think Firefox is awesome too :)

Re: Arbitrary code execution through unsanitized browser UI

#34

Post by quotheth » Thu, Feb 01, 2018, 5:14 PM UTC

eridius wrote: post #26

quotheth wrote: post #18

Earlier quoted context omitted.

There is no universal metric for security. What I will say is that Edge and Firefox are doing an excellent job - I'm really impressed. Chrome is still the safest browser today, in my opinion. Site isolation, which was released recently, is a really great example of how far ahead they are - site isolation is at least 3, maybe 4 years in the making. That's serious work. They have had an excellent bounty program. They h…

> Site isolation, which was released recently, is a really great example of how far ahead they are - site isolation is at least 3, maybe 4 years in the making. That's serious work. I just searched for chrome site isolation and found https://chromeunboxed.com/news/chrome-63-site-isolation-exte... . And from this description the only particularly interesting thing is multiple domains within a single tab get multiple pr…

Yep, it's disabled by default. It is a great indicator of the forward thinking work they do, though. And from a corp perspective we can push out policies to enable site isolation for high risk websites (SSO).

"The only interesting thing" is a bit disparaging haha that's kind of a big deal. It means that third party iframes, as one example, run in a separate process. It breaks the case where I am evil.com, and you are okta.com, and there is a way for me to leak data within a process (or exploit the process), I can read okta.com's data.

With site isolation is this made considerably more difficult.