Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I discovered a browser bug

jakearchibald.com

Post reply on HN
Print view View original

51–60 of 137 posts

Re: I discovered a browser bug

#51

Post by etatoby »

obl wrote: post #20
WorkLifeBalance wrote: post #6

Earlier quoted context omitted.

Do you want to reinforce established monopolies? Because I can't think of a better way of doing that than having a technical difference between "trusted" and "untrusted" sites.

Well, I personally would be fine with the fair policy of disabling js everywhere but I'm sure most would not agree, so what's the alternative ? If anything, Spectre class attacks really showed how hard it is to properly sandbox arbitrary programs. Yes, the CPUs are complex, but the attacks happen on a high conceptual level, level at which the CPU is fairly simple. It's not like they rely on an obscure detail or bug.…

I now use Brave browser exclusively, with JavaScript and other things turned off by default.

Turning it on for trusted websites is one click away, once per domain, and it could save me in the future.

Re: I discovered a browser bug

#53

Post by andrewmcwatters »

I, too, discovered a browser bug. Specifically with mutation observers in Safari (but not Chrome, or other WebKit-likes) in a particular DOM event scenario. Fully replicable. Not a word from any team at Apple, no acknowledgement of the bug, no acknowledgment of the issue.

The situation is a common one wrt SPAs, routing, and changing a tree based on history state. I'm sure other frameworks have run into it. My brief experience documenting the issue solidified the position that I will never do it again.

Re: I discovered a browser bug

#54

Post by munin »

pbhjpbhj wrote: post #46
munin wrote: post #10

Earlier quoted context omitted.

Microsoft used to have a group, Trustworthy Computing (TWC), that was where all the security expertise lived. TWC was destroyed in 2014. From the outside, it seemed like that was the point where the reporter/outside security engagement story stopped, because the people that held responsibility for it Microsoft wide were either fired or re-orged into a role where they didn't have broad authority any more. Now, you get…

One can see a rationale in not having a security group - every team should have security focus (eg by having expertise & champions within each group). You can't tack on security, you have to build it in.

I disagree - the motivations of the security group and the product group are different. If the security team is under the product team leadership, the security team is disincentivized to interrupt a product launch due to a security issue, because they're rewarded by shipping a product, not making it secure. Really, you should have both: you should have a security team that sits with the product team and works with them through the lifecycle of the product, and has continuity (i.e. it's the same security people with your product team through the life of the product, mostly), but that security team reports to different management and has their promotions, bonuses, etc. handled by a different leadership chain than the product team.

Re: I discovered a browser bug

#55

Post by Endy »

obl wrote: post #2

It's quite incredible how the web managed to get along with such a janky sandbox model. It's a very important thing that users trust their browser and won't hesitate a second to enter an unknown URL. They see "going to a webpage" as the equivalent to looking at a poster in the street, not eating candy provided by a random stranger. Eroding this trust would ruin it for everyone, even well behaved static websites witho…

No. The burden needs to be on the user to understand their own security. If we stopped taking the burden out of user's hands and tried to ensure that everyone on the Internet understood that anything they access becomes data on their computer/device, we'd have a smarter Internet. Frankly, I think if we made people understand that they have a responsibility to choose what they download, there might be more vocal group demanding the ability to do whatever they want with data transmitted to their computer, save for directly malicious acts against other users.

The browser should be only two things: a client between a user and a server, passing information; and a parser which displays that information on the client-side. The moment a browser alone begins controlling what the user sees, or does not see, without the user having the ability to control it, we have a major problem.

That becomes a security problem, a privacy problem, and a functionality problem. All data on the Internet should be treated the same by all browsers' client functions. The display may vary (e.g. the difference between Lynx and Firefox), but all data should be treated equally and the user should have both the authority and the responsibility for their own computer.

Re: I discovered a browser bug

#56

Post by bjornstar »

jaffathecake wrote: post #36
MatthewPhillips wrote: post #33

Earlier quoted context omitted.

Like I said, my impression is that often the people replying are not engineers. Here's one with that problem: https://bugs.chromium.org/p/chromium/issues/detail?id=674096...

Yeah, that's not great, but the commenter in #12 is a senior engineer on devtools, so at least the right person saw it in the end.

https://bugs.chromium.org/p/chromium/issues/detail?id=674096... was an assignment 6 months ago. It's still open after 2.5 years. I would not call this a good outcome.

Re: I discovered a browser bug

#57

Post by jaffathecake »

bjornstar wrote: post #56
jaffathecake wrote: post #36

Earlier quoted context omitted.

Yeah, that's not great, but the commenter in #12 is a senior engineer on devtools, so at least the right person saw it in the end.

https://bugs.chromium.org/p/chromium/issues/detail?id=674096... was an assignment 6 months ago. It's still open after 2.5 years. I would not call this a good outcome.

Sure, but priorities are a thing. I don't think it's fair to compare this to an origin model exploit.

Re: I discovered a browser bug

#58

Post by evfanknitram »

acdha wrote: post #7

The Microsoft experience reminded me of the time when security@apple.com went to the building security office, who just quietly deleted bug reports. Poor processes amd communication is one of the worst classes of security problem.

Last time I reported a security issue to Microsoft I got reply same day and a confirmation that it was in fact an issue some day later. And then a few days later they notified me that my report was eligible for a bounty (I didn't have to ask).

This was the opposite experience of my previous report where the bug was acknowledged 9 months later and then fixed another 3 later.

I wonder if it just depends on whether your report ends up in a escalation path with lots of busy people.

Re: I discovered a browser bug

#59

Post by datenwolf »

tzahola wrote: post #5
obl wrote: post #2

It's quite incredible how the web managed to get along with such a janky sandbox model. It's a very important thing that users trust their browser and won't hesitate a second to enter an unknown URL. They see "going to a webpage" as the equivalent to looking at a poster in the street, not eating candy provided by a random stranger. Eroding this trust would ruin it for everyone, even well behaved static websites witho…

Sorry, but we need a Turing-complete language for ads and tracking. Preferably with JITting, and unfettered access to the GPU and other misc. peripherals like GPS, webcam, etc. In return you get free cat videos. You’re welcome.

…and with unfettered access to USB devices. WebUSB my ass.

Re: I discovered a browser bug

#60

Post by jlg23 »

This just happened to be two anecdotes with 2 browser dev teams that should not be generalized.

Everyone who has to deal with n-th layer tech support regularly (where n > 2) knows that even there it's hit or miss. Sometimes you file a bug report and get a "thanks, fixed!" an hour later. Sometimes you spend an hour to gather all the data upfront only to be painstakingly taken through the exact same data gathering process step by step. By email. Over days. On a "4h response" SLA (and they always just barely make it, not considering the value of the "response").

Randall Munroe has the best description: https://www.xkcd.com/806/

Post reply on HN