Serious Chrome zero-day • Hacker News Board

Re: Serious Chrome zero-day

#31

Post by tcbasche » Wed, Mar 06, 2019, 9:35 PM UTC

crushcrashcrush wrote: post #9

Honest question - why do people use Chrome? It’s from an arguably as-evil company as Facebook. Alternatives exist. What’s the draw?

I gave Firefox an honest go, but some web apps just don't work 100% in it. Chrome does not have this issue.

Most of us drive cars filled with fuel from evil oil companies, why do we all drive cars?

Re: Serious Chrome zero-day

#32

Post by benatkin » Wed, Mar 06, 2019, 9:36 PM UTC

uniformlyrandom wrote: post #28

munchbunny wrote: post #23

Earlier quoted context omitted.

I do in team chat. It's obvious enough in context, as in "hey can you deploy, I just patched this urgent vuln: [url to ticket]" You won't see me using it in an email or other long form writing though.

Yep, chat makes sense. Thank you for actually stating a use-case.

Next time you see a shortened word, you can just assume it's useful. Because they are.

Re: Serious Chrome zero-day

#33

Post by bezosbaldballs » Wed, Mar 06, 2019, 9:36 PM UTC

uniformlyrandom wrote: post #6

This blog post is so watered down and manages to digress at every possible point that it is almost impossible to read. The only useful part of the text are the URLs. Also, this: > A vulnerability, or vuln for short, is a bug that makes software go wrong in a way that reduces computer security. Does anyone actually use this abbreviation?

u r n0t 1337 h4xx0r

This sounds like it was written by the same guy who started the "Hacker known as 4Chan" meme

Re: Serious Chrome zero-day

#34

Post by nickysielicki » Wed, Mar 06, 2019, 9:36 PM UTC

AgentME wrote: post #18

yayr wrote: post #3

What does this mean for Electron Apps?

If the Electron app never shows untrusted HTML with Javascript enabled, then it's not an issue. Generally, only Electron apps with arbitrary web browsing functionality would do that.

Do most Electron apps make use of CSP? eg: is it an inherent part of the build process, or is it something that the developer needs to explicitly add?

Re: Serious Chrome zero-day

#35

Post by smsm42 » Wed, Mar 06, 2019, 9:36 PM UTC

ktjfi wrote: post #20

The version that includes the fix was released a few days ago... how is this a 0-day at this point?

I think people who don't know what 0-day actually used to mean use it in a sense of "new security bug". Classically, no 0-day can by definition have a CVE, for example. But right now any new bug which is widely exploitable in the wild can be called in the press "0-day", despite the fix being released.

Re: Serious Chrome zero-day

#36

Post by diminoten » Wed, Mar 06, 2019, 9:36 PM UTC

blattimwind wrote: post #29

uniformlyrandom wrote: post #6

This blog post is so watered down and manages to digress at every possible point that it is almost impossible to read. The only useful part of the text are the URLs. Also, this: > A vulnerability, or vuln for short, is a bug that makes software go wrong in a way that reduces computer security. Does anyone actually use this abbreviation?

> Does anyone actually use this abbreviation? More common in plural (vulns). However, it sounds oddly vulgar in my ears.

I've typed it, but I dunno if I've ever said it out loud. Kind of like i18n.

Re: Serious Chrome zero-day

#37

Post by paulpauper » Wed, Mar 06, 2019, 9:37 PM UTC

This write-up is not helpful and says nothing about how one would be infected. it just says it can do code execution but no evidence anyone has been infected in any way or how would would be infected. The worst 0day possible is un-sandboxed code execution that is activated by merely visiting a webpage or clickinig.

Re: Serious Chrome zero-day

#38

Post by bezosbaldballs » Wed, Mar 06, 2019, 9:37 PM UTC

eternal_virgin wrote: post #12

yayr wrote: post #3

What does this mean for Electron Apps?

Electron Apps are basically already malware

> uses up all your resources > is enormous in size for no reason > javascript

Ok, agreed.

Re: Serious Chrome zero-day

#39

Post by cjones26 » Wed, Mar 06, 2019, 9:37 PM UTC

AgentME wrote: post #18

yayr wrote: post #3

What does this mean for Electron Apps?

If the Electron app never shows untrusted HTML with Javascript enabled, then it's not an issue. Generally, only Electron apps with arbitrary web browsing functionality would do that.

Which is a massive security issue in itself--Electron documentation even warns you about this.

Re: Serious Chrome zero-day

#40

Post by arcticfox » Wed, Mar 06, 2019, 9:38 PM UTC

ktjfi wrote: post #20

The version that includes the fix was released a few days ago... how is this a 0-day at this point?

It was exploited before the vendor was aware; IMO that earns it a permanent "Zero-day" title. Obviously it's not currently a zero-day, given that we're hearing about it from the vendor.

The moniker is pretty paradoxical otherwise, the discoverer writing a post about a zero-day would make it no longer a zero-day.