Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I discovered a browser bug

jakearchibald.com

Post reply on HN
Print view View original

41–50 of 137 posts

Re: I discovered a browser bug

#41

Post by paulddraper »

jaffathecake wrote: post #30
MatthewPhillips wrote: post #28

I can echo his experience reporting browser bugs and provide my own reviews: Firefox - By far the best. Quick response, usually from engineers. If it's important the fix will be quick. Edge - No reply for months / years. When I've gotten replies back it's been to ask me to try with the current version. When I do and the bug still exists it goes back at the bottom of the queue it seems. Chrome - Somewhat of a mixed ba…

Yeah that Chrome experience doesn't sound great. Fwiw I tend to put my test cases on jsbin or Glitch, but yeah, a Chrome engineer should know to put the page on a basic web server. If anyone runs into problems like this, feel free to bug one of the Chrome dev rel folks, such as me.

I have an S3 bucket for mine.

E.g. a js closure memory leak:

https://bugs.chromium.org/p/chromium/issues/detail?id=315190

https://s3.amazonaws.com/chromebugs/memory.html

Re: I discovered a browser bug

#42

Post by robotmlg »

MatthewPhillips wrote: post #28

I can echo his experience reporting browser bugs and provide my own reviews: Firefox - By far the best. Quick response, usually from engineers. If it's important the fix will be quick. Edge - No reply for months / years. When I've gotten replies back it's been to ask me to try with the current version. When I do and the bug still exists it goes back at the bottom of the queue it seems. Chrome - Somewhat of a mixed ba…

Did you report the Safari bug to Apple or to WebKit.org? I've had good luck getting responses and fixes from the webkit guys

Re: I discovered a browser bug

#43

Post by kevin_thibedeau »

tzahola wrote: post #5
obl wrote: post #2

It's quite incredible how the web managed to get along with such a janky sandbox model. It's a very important thing that users trust their browser and won't hesitate a second to enter an unknown URL. They see "going to a webpage" as the equivalent to looking at a poster in the street, not eating candy provided by a random stranger. Eroding this trust would ruin it for everyone, even well behaved static websites witho…

Sorry, but we need a Turing-complete language for ads and tracking. Preferably with JITting, and unfettered access to the GPU and other misc. peripherals like GPS, webcam, etc. In return you get free cat videos. You’re welcome.

No. The server just needs to send over an image and log the IP of the requestor for reconciliation at the end of the month.

Re: I discovered a browser bug

#45

Post by notveryrational »

This is really nice research! Simple, effective, and brutal.

This reminds me of the research that went into finding issues in the media plugin models. Essentially, once the security community discovered that Java and Flash, etc, plugins didn't follow the same rules as the browser at all times - it became a free bug hunting exercise until the media plugin model just died.

I expect there are some "side channel" type ways to create high resolution timers in browsers which have removed built in support for them, for instance: WebAssembly? WebGL subroutines?

Anyway, congratulations.

Re: I discovered a browser bug

#46

Post by pbhjpbhj »

munin wrote: post #10
acdha wrote: post #7

The Microsoft experience reminded me of the time when security@apple.com went to the building security office, who just quietly deleted bug reports. Poor processes amd communication is one of the worst classes of security problem.

Microsoft used to have a group, Trustworthy Computing (TWC), that was where all the security expertise lived. TWC was destroyed in 2014. From the outside, it seemed like that was the point where the reporter/outside security engagement story stopped, because the people that held responsibility for it Microsoft wide were either fired or re-orged into a role where they didn't have broad authority any more. Now, you get…

One can see a rationale in not having a security group - every team should have security focus (eg by having expertise & champions within each group). You can't tack on security, you have to build it in.

Re: I discovered a browser bug

#47

Post by Retric »

krapp wrote: post #37
Retric wrote: post #29

Earlier quoted context omitted.

Client side code including third party media players etc. IMO it's a simple question 'can you do the same thing with a sheet of printed paper.' I can fill out paper forms and hand them to someone just fine. Don't forget a Check is really just a piece of paper with a form on it.

So a spreadsheet running in the client with javascript or WASM would be an application, but a spreadsheet running on the backend wouldn't? I'm not trying to be overly pedantic or combative here but making a distinction between client-side and server-side code seems arbitrary. I understand it in terms of managing privilege - you can't control what someone does on a remote server, and that code isn't running on your ma…

The entire point is managing privileges.

Just because I type in yourdomain.com does not mean I want you to be able to start playing death metal from my speakers. What about typing yourdomain.com means I want you to break my back button? Show a popup rather than close the browser? Churn CPU cycles crypto mining or do just about anything beyond hand me a document? Display a flashing GIF?

The current model is basically handing complete control over my machine to a third party that may be compromised by anyone any time I click a random link.

The single greatest web innovation in the last 30 years was readability mode.

Re: I discovered a browser bug

#48

Post by acdha »

philipodonnell wrote: post #40
acdha wrote: post #32

Earlier quoted context omitted.

Yes – I even got a nice email from someone apologizing about that and explaining that they were trying to get the security@apple.com people to at least forward messages when I did a full disclosure release after not receiving a response.

> they were trying to get the security@apple.com people to at least forward messages when I did a full disclosure release after not receiving a response That sounds a bit dysfunctional on Apple's part that they can't exert that kind of control over their own employees for an issue with potentially enormously negative consequences.

This was awhile back in the unverified TLS certificate era so I'm assuming they got more serious about it.

Re: I discovered a browser bug

#49

Post by simion314 »

felix_nagaand wrote: post #14
simion314 wrote: post #4

Earlier quoted context omitted.

I use a private window for banking/paypal , I don't trust the extensions or the other tabs so for this cases I get more security.

That hardly helps. For true security devote a device purely to banking. Preferably a diskless device running an updated live CD on a security oriented distro with no rewritable storage attached connecting out over a VPN through an equally dedicated firewalled router. Then you're just left to worry about your bioses getting infected off an unpatched or 0d exploit.

If there were a big target on my back I would do that, but since I am running Linux, I am not a rich person or have an important job I assume that I will be attacked by regular malware and not skilled hackers.
Post reply on HN