Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Serious Chrome zero-day

nakedsecurity.sophos.com

Post reply on HN
Print view View original

91–100 of 377 posts

Re: Serious Chrome zero-day

#91

Post by ancarda »

elorant wrote: post #82
staticassertion wrote: post #77

I'll be that guy. Chrome has probably invested > 1 billion dollars into their codebase at this point. Certainly >100million into security. They sandbox their code aggressively . They build this project with security in mind from day 1 - it's been architected for it. The Chrome security team(s) has a lot of power for a product security org. They fuzz. They invent new fuzzers. They cluster their fuzzers. They have a wo…

So what language should they've written it in?

C++, as that was a reasonable choice in Bits of Firefox are written in Rust, so Chrome could in theory under go the same "oxidation" (gradually replace the C++ code with Rust).

Edit: Clarify that Chrome was released in 2008 but was likely in development for some time before that.

Re: Serious Chrome zero-day

#92

Post by qrbLPHiKpiux »

mda wrote: post #62
crushcrashcrush wrote: post #9

Honest question - why do people use Chrome? It’s from an arguably as-evil company as Facebook. Alternatives exist. What’s the draw?

It is fast, responsive, has much better security history and architecture than all others, super convenient if you have multiple computers. I have absolutely no problems with Chrome, I already trusted my information with Google, so I always stay signed in as well, never had any issues.

Caveat: if something’s “free,” you’re the product. Google wants to pull as much metadata from you as possible. I don’t trust anyone who gives me something for free. I therefore limit how I use it.

Re: Serious Chrome zero-day

#93

Post by staticassertion »

peterwwillis wrote: post #84
staticassertion wrote: post #77

I'll be that guy. Chrome has probably invested > 1 billion dollars into their codebase at this point. Certainly >100million into security. They sandbox their code aggressively . They build this project with security in mind from day 1 - it's been architected for it. The Chrome security team(s) has a lot of power for a product security org. They fuzz. They invent new fuzzers. They cluster their fuzzers. They have a wo…

No codebase will ever be fully free of security bugs, but having 7 million lines of code definitely doesn't help.

The question is, how much effort is it to keep users safe given language X vs C++.

Apparently, when the language is C++, the value is somewhere above many millions of dollars, and we don't know what it is.

Can we reasonably expect that price to be lower with language X? For many reasons, I would argue 'yes'.

Re: Serious Chrome zero-day

#94

Post by gpm »

staticassertion wrote: post #86
elorant wrote: post #82

Earlier quoted context omitted.

So what language should they've written it in?

A memory safe one. There are many of them. They could build their own if they chose to - they've built multiple languages in the past. Picking a language for the Chrome team doesn't seem practical - we all know where your question is going to head. The point is they have to not pick C++. Again, they've invested many, many millions of dollars into security. Let's not pretend that they're priced out of using another la…

It doesn't even have to be memory safe, just less memory accident prone.

D for example would have been an interesting choice (and I think it was usable back then).

Re: Serious Chrome zero-day

#95

Post by city41 »

crushcrashcrush wrote: post #9

Honest question - why do people use Chrome? It’s from an arguably as-evil company as Facebook. Alternatives exist. What’s the draw?

I have made several attempts to switch to Firefox. But for me at least Firefox seems to crash about once a day. I don't think Chrome has ever crashed on me in about a decade of using it, and crashed tabs are extremely rare.

Re: Serious Chrome zero-day

#96

Post by [deleted] »

staticassertion wrote: post #86
elorant wrote: post #82

Earlier quoted context omitted.

So what language should they've written it in?

A memory safe one. There are many of them. They could build their own if they chose to - they've built multiple languages in the past. Picking a language for the Chrome team doesn't seem practical - we all know where your question is going to head. The point is they have to not pick C++. Again, they've invested many, many millions of dollars into security. Let's not pretend that they're priced out of using another la…

[deleted]

Re: Serious Chrome zero-day

#97

Post by vortico »

qrbLPHiKpiux wrote: post #92
mda wrote: post #62

Earlier quoted context omitted.

It is fast, responsive, has much better security history and architecture than all others, super convenient if you have multiple computers. I have absolutely no problems with Chrome, I already trusted my information with Google, so I always stay signed in as well, never had any issues.

Caveat: if something’s “free,” you’re the product. Google wants to pull as much metadata from you as possible. I don’t trust anyone who gives me something for free. I therefore limit how I use it.

What browser do you use then?

Re: Serious Chrome zero-day

#98

Post by TimTheTinker »

elorant wrote: post #82
staticassertion wrote: post #77

I'll be that guy. Chrome has probably invested > 1 billion dollars into their codebase at this point. Certainly >100million into security. They sandbox their code aggressively . They build this project with security in mind from day 1 - it's been architected for it. The Chrome security team(s) has a lot of power for a product security org. They fuzz. They invent new fuzzers. They cluster their fuzzers. They have a wo…

So what language should they've written it in?

I'll be that guy. :)

Rust.

(I'm a front-end dev. I have no dog in this fight.)

Re: Serious Chrome zero-day

#99

Post by lima »

MikeHolman wrote: post #81

This looks bad for Google. EdgeSpot detected an in-the-wild exploit and told Google about this in December, but Google wasn't going to fix the bug until late April. Google only released a patch early because the finder blogged about it. https://blog.edgespot.io/2019/02/edgespot-detects-pdf-zero-d...

That's an entirely different vulnerability.

Re: Serious Chrome zero-day

#100

Post by Someone1234 »

peterwwillis wrote: post #84
staticassertion wrote: post #77

I'll be that guy. Chrome has probably invested > 1 billion dollars into their codebase at this point. Certainly >100million into security. They sandbox their code aggressively . They build this project with security in mind from day 1 - it's been architected for it. The Chrome security team(s) has a lot of power for a product security org. They fuzz. They invent new fuzzers. They cluster their fuzzers. They have a wo…

No codebase will ever be fully free of security bugs, but having 7 million lines of code definitely doesn't help.

It can be for a specific class of bugs. A solution doesn't need to be perfect for it to be better.
Post reply on HN