161–170 of 377 posts
I'll be that guy. Chrome has probably invested > 1 billion dollars into their codebase at this point. Certainly >100million into security. They sandbox their code aggressively . They build this project with security in mind from day 1 - it's been architected for it. The Chrome security team(s) has a lot of power for a product security org. They fuzz. They invent new fuzzers. They cluster their fuzzers. They have a wo…
Earlier quoted context omitted.
If the Electron app never shows untrusted HTML with Javascript enabled, then it's not an issue. Generally, only Electron apps with arbitrary web browsing functionality would do that.
The thing seems to be linked to FileReader. Maybe just linking to an external image is enough.
So attacker would still need to have some javascript loaded somewhere for it to work. If electron app displays user-generated content, XSS can help run a javascript payload, however.
Earlier quoted context omitted.
A memory safe one. There are many of them. They could build their own if they chose to - they've built multiple languages in the past. Picking a language for the Chrome team doesn't seem practical - we all know where your question is going to head. The point is they have to not pick C++. Again, they've invested many, many millions of dollars into security. Let's not pretend that they're priced out of using another la…
Back when Chrome was getting started there were no memory safe languages that did not come with huge downsides. Now one could argue for Rust, but let's not pretend that C++ was a bad choice. C++ was the overwhelmingly best choice at the time.
Honest question - why do people use Chrome? It’s from an arguably as-evil company as Facebook. Alternatives exist. What’s the draw?
Earlier quoted context omitted.
Back when Chrome was getting started there were no memory safe languages that did not come with huge downsides. Now one could argue for Rust, but let's not pretend that C++ was a bad choice. C++ was the overwhelmingly best choice at the time.
That doesn't mean that they (or anyone) should still be using it. The choice of language 15 years ago has nothing to do with the languages that could be in use today on the same project. Rust has `unsafe` all over the place; it's no more safe if you use that keyword to do the same things that are done in C++. Get more compiler people on Go and it will be even faster than it is now (really fast), and Go is written in…
Earlier quoted context omitted.
I can write a safe C++ app on my own But only if you don't use any external libraries, once you link in someone else's code, you can no longer be sure your program is "safe".
> I can write a safe C++ app on my own >> But only if you don't use any external libraries using an external library is not "on your own"
Earlier quoted context omitted.
That seems to be this one: https://www.thezdi.com/blog/2019/2/28/finding-unicorns-when-... It's a straightforward miscompilation. I'm not sure why they even classify it as a vulnerability. From Microsoft, per the article: "The said vulnerability is about downloading and running untrusted code, which has always existed in all releases prior VS2017 Update 9 that supported lambdas. The scenario is not common coding prac…
> If you’re still on the fence about deploying this update, we would consider it Important since it could allow for attacker-controlled code to execute at the level of the logged on user. What does that even mean? I download some c++ code from the internet, compile it, run it, and... it runs as my user?
> Exploitation of the vulnerability requires that a user open a specially crafted file which was compiled with an affected version of Visual Studio. In an email attack scenario, an attacker could exploit the vulnerability by sending a specially crafted project, or resource file, to the user and convince the user to open the file.
So yeah sure looks like a basic code execution results in code execution. Surprised this even got a CVE.
Earlier quoted context omitted.
Caveat: if something’s “free,” you’re the product. Google wants to pull as much metadata from you as possible. I don’t trust anyone who gives me something for free. I therefore limit how I use it.
I made my choices carefully and consciously. As I said, I entrusted Google with my data, my emails, pictures, history. I know that my data is never sold to anyone and always kept secure. Google is probably one of the most careful companies when dealing with private data in the world. I can delete or take a copy of it if I want as well. Needless to say, I disagree with the "you are the product" polemic.
>private data
Ah, the fabled "metadata is not data" defense. Sadly, given the scale and pervasiveness of Google, observing meta-data and cross-referencing your activity with others' activities is good enough to deduce most of the valuable information about you with reasonably good reliability. And this data, both by itself, and also aggregated with other users', is "good enough" for any privacy-busting use.
tl;dr: you are the meta-product.
Honest question - why do people use Chrome? It’s from an arguably as-evil company as Facebook. Alternatives exist. What’s the draw?
I gave Firefox an honest go, but some web apps just don't work 100% in it. Chrome does not have this issue. Most of us drive cars filled with fuel from evil oil companies, why do we all drive cars?
Used to be the same problem with Firefox vs IE6. And that was exactly when people got serious about the need to defeat the monopoly of IE.