Microsoft claims to be developer friendly these days, but they are clearly not white-hat friendly.
My entirely anecdotal experience is that they are white-hat friendly some time. My last experience was super good.
I discovered a browser bug
61–70 of 137 posts
Re: I discovered a browser bug
#62Earlier quoted context omitted.
What about differentiating applications and web sites? The line between the two is blurry, I know, but I would be happy if the document metaphor were divorced from the application one.
Absolutely, there should be a different port for web pages than applications. Even if we started by disabling js on port 80
I agree, but it would be much easier if we had a new document-only port instead, since it wouldn't break most of the Internet.
Re: I discovered a browser bug
#63Do you get a cash reward for doing the right thing these days?
Re: I discovered a browser bug
#64Earlier quoted context omitted.
https://bugs.chromium.org/p/chromium/issues/detail?id=674096... was an assignment 6 months ago. It's still open after 2.5 years. I would not call this a good outcome.
Sure, but priorities are a thing. I don't think it's fair to compare this to an origin model exploit.
Yeah, this is a UI bug in devtools for a feature not a lot of people use. Plus web worker bugs always get pushed to the bottom of the queue for every browser. So I don't have any problem with how long my weird issues take to get fixed.
It's more about comparing to Firefox where you usually get a quick response which at least conveys that the person on the other end understands what is being reported. I'm fine with the eventual outcome here. A comment acknowledging that it's a real bug (or not) would have been better, but being assigned to someone sort of acknowledges that, I guess.
Re: I discovered a browser bug
#65It's quite incredible how the web managed to get along with such a janky sandbox model. It's a very important thing that users trust their browser and won't hesitate a second to enter an unknown URL. They see "going to a webpage" as the equivalent to looking at a poster in the street, not eating candy provided by a random stranger. Eroding this trust would ruin it for everyone, even well behaved static websites witho…
No. The burden needs to be on the user to understand their own security. If we stopped taking the burden out of user's hands and tried to ensure that everyone on the Internet understood that anything they access becomes data on their computer/device, we'd have a smarter Internet. Frankly, I think if we made people understand that they have a responsibility to choose what they download, there might be more vocal group…
> The moment a browser alone begins controlling what the user sees, or does not see, without the user having the ability to control it, we have a major problem.
What you're describing would be inordinately taxing for even the most experienced developer, not to mention the average internet user. The only way this could possibly be viable would be if we used gopher:// instead of http(s)://
Currently, there are tools such as Privoxy Actions & Filters, which allow you to do 100% of what you're describing, Greasemonkey which allows you to do ~80% of what you describe, or uMatrix which allow you to do quite a lot. The prerequisites for using those range from full-blown programming skill (for the former 2) to managing a relatively advanced in-browser UI (for uMatrix), and having a lot of spare time. For every single webpage you visit on the web. This isn't viable for 99% of people.
Re: I discovered a browser bug
#66Earlier quoted context omitted.
Sure, but priorities are a thing. I don't think it's fair to compare this to an origin model exploit.
Yeah, this is a UI bug in devtools for a feature not a lot of people use. Plus web worker bugs always get pushed to the bottom of the queue for every browser. So I don't have any problem with how long my weird issues take to get fixed. It's more about comparing to Firefox where you usually get a quick response which at least conveys that the person on the other end understands what is being reported . I'm fine with t…
> Plus web worker bugs always get pushed to the bottom of the queue for every browser.
Why is that?
Re: I discovered a browser bug
#67Earlier quoted context omitted.
So a spreadsheet running in the client with javascript or WASM would be an application, but a spreadsheet running on the backend wouldn't? I'm not trying to be overly pedantic or combative here but making a distinction between client-side and server-side code seems arbitrary. I understand it in terms of managing privilege - you can't control what someone does on a remote server, and that code isn't running on your ma…
The entire point is managing privileges. Just because I type in yourdomain.com does not mean I want you to be able to start playing death metal from my speakers. What about typing yourdomain.com means I want you to break my back button? Show a popup rather than close the browser? Churn CPU cycles crypto mining or do just about anything beyond hand me a document? Display a flashing GIF? The current model is basically…
> The single greatest web innovation in the last 30 years was readability mode.
For you. From what I see, everyone else seems to be enjoying the dancing and singing monkeys online.
Re: I discovered a browser bug
#68cool, good for you
Re: I discovered a browser bug
#69Earlier quoted context omitted.
Yes – I even got a nice email from someone apologizing about that and explaining that they were trying to get the security@apple.com people to at least forward messages when I did a full disclosure release after not receiving a response.
> they were trying to get the security@apple.com people to at least forward messages when I did a full disclosure release after not receiving a response That sounds a bit dysfunctional on Apple's part that they can't exert that kind of control over their own employees for an issue with potentially enormously negative consequences.
That sounds a bit dysfunctional on Apple's part that they can't exert that kind of control over their own employees for an issue with potentially enormously negative consequences.
I'm not saying it isn't dysfunctional, but it sounds like every single large company I've ever worked with or for.
Especially when "security" is provided by a third-party security company.
Re: I discovered a browser bug
#70Earlier quoted context omitted.
Yeah that Chrome experience doesn't sound great. Fwiw I tend to put my test cases on jsbin or Glitch, but yeah, a Chrome engineer should know to put the page on a basic web server. If anyone runs into problems like this, feel free to bug one of the Chrome dev rel folks, such as me.
I have an S3 bucket for mine. E.g. a js closure memory leak: https://bugs.chromium.org/p/chromium/issues/detail?id=315190 https://s3.amazonaws.com/chromebugs/memory.html
Whoa, that page crashed my (long running) Nightly (presumably exhausted RAM completely) and in freshly started got 4 GB for the tab process (and survived). Nice.