Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Serious Chrome zero-day

nakedsecurity.sophos.com

Post reply on HN
Print view View original

361–370 of 377 posts

Re: Serious Chrome zero-day

#361

Post by ketralnis »

naikrovek wrote: post #351
IX-103 wrote: post #191

Earlier quoted context omitted.

Sorry. Until Go gets its head out of its ass and gets proper generics Go will still be painful to use and slow. Not to mention with all the extra code complexity from writing everything with interface{}{} and reflection there are bound to be plenty of exploitable vulnerabilities. I honestly think it is worse than pre-generic Java because switching over the type of the variable is encouraged. Most sane type-checked la…

Generics are slower, that's the trade-off. Developer time vs. execution time. Saying Go has it's head up it's ass is extremely disrespectful to the people that created it and are maintaining it. You lost all credibility when you chose the low road and said that.

Most generics work by monomorphisation, which basically means the compiler is doing a copy paste from int_btree.go to string_btree.go with the types changed. There is no runtime cost except text segment bloat. Generally modern compilers are smart enough to unify the identical machine code paths too, so you might not even get the code bloat.

Re: Serious Chrome zero-day

#362

Post by PopsiclePete »

naikrovek wrote: post #351
IX-103 wrote: post #191

Earlier quoted context omitted.

Sorry. Until Go gets its head out of its ass and gets proper generics Go will still be painful to use and slow. Not to mention with all the extra code complexity from writing everything with interface{}{} and reflection there are bound to be plenty of exploitable vulnerabilities. I honestly think it is worse than pre-generic Java because switching over the type of the variable is encouraged. Most sane type-checked la…

Generics are slower, that's the trade-off. Developer time vs. execution time. Saying Go has it's head up it's ass is extremely disrespectful to the people that created it and are maintaining it. You lost all credibility when you chose the low road and said that.

Look, there are core Go developers who admit that parametric polymorphism is a good idea. In fact, I'm not aware of anyone on the Go team arguing against that. Which is what you mean by "generics", right? In fact Go already has "generics" - maps, slices, channels. Are those "slow" in your opinion?

The only thing left to do is to propose a system that has reasonable trade-offs, doesn't suck, and doesn't completely break the existing language. Easy peasy!

I wonder who is doing Go more a disservice - people who hate everything about, or the blind fanatical devotees who think any criticism towards any aspect of Go is heretical.

Re: Serious Chrome zero-day

#363

Post by Teknoman117 »

pjmlp wrote: post #282
Teknoman117 wrote: post #275

Earlier quoted context omitted.

I still wonder what the plans for Fuchsia are. Is Google really thinking about just throwing out the millions of man-years which have been sunk into Linux?

They don't need to please everyone, just make their use case work. Also porting the drivers to Fuschia should be relatively easy, thanks the Treble changes that kind of made their Android Linux kernel into a kind of hybrid-microkernel. Android is already being ported to run on top of Fuchsia. Google isn't the only one, the IoT space is getting crowed with BSD/MIT/Apache POSIX compatible OSes, including Zephyr from Li…

> 28 years ago no would would believe that Linux distributions would eventually kill commercial UNIX.

That's certainly a fair point.

I was thinking more along the lines of that, at least in the scenario of consumer usage of Linux, some really interesting features are finally gaining traction from various companies (3D accelerators for instance). Was just fearing that ditching existing work for the new shiny thing would send us back to square one.

Re: Serious Chrome zero-day

#364

Post by pjmlp »

Teknoman117 wrote: post #363
pjmlp wrote: post #282

Earlier quoted context omitted.

They don't need to please everyone, just make their use case work. Also porting the drivers to Fuschia should be relatively easy, thanks the Treble changes that kind of made their Android Linux kernel into a kind of hybrid-microkernel. Android is already being ported to run on top of Fuchsia. Google isn't the only one, the IoT space is getting crowed with BSD/MIT/Apache POSIX compatible OSes, including Zephyr from Li…

> 28 years ago no would would believe that Linux distributions would eventually kill commercial UNIX. That's certainly a fair point. I was thinking more along the lines of that, at least in the scenario of consumer usage of Linux, some really interesting features are finally gaining traction from various companies (3D accelerators for instance). Was just fearing that ditching existing work for the new shiny thing wou…

3D acceleration works just fine in Android.

Re: Serious Chrome zero-day

#365

Post by naikrovek »

GenericsMotors wrote: post #360
naikrovek wrote: post #351

Earlier quoted context omitted.

Generics are slower, that's the trade-off. Developer time vs. execution time. Saying Go has it's head up it's ass is extremely disrespectful to the people that created it and are maintaining it. You lost all credibility when you chose the low road and said that.

You lost all credibility when you wrote that first sentence. But you carry on using empty interface with runtime type assertions and reflection if you think that's faster.

Well, pardon me for stating things as I understand them and making a mistake in doing so.

I sincerely apologise for wasting your time by typing something that was true as I understood it.

Clearly you've never made a similar mistake.

Re: Serious Chrome zero-day

#366

Post by naikrovek »

fredmorcos wrote: post #358
naikrovek wrote: post #351

Earlier quoted context omitted.

Generics are slower, that's the trade-off. Developer time vs. execution time. Saying Go has it's head up it's ass is extremely disrespectful to the people that created it and are maintaining it. You lost all credibility when you chose the low road and said that.

> Generics are slower, that's the trade-off. Developer time vs. execution time. You have no idea what you're talking about. > Saying Go has it's head up it's ass is extremely disrespectful to the people that created it and are maintaining it. You lost all credibility when you chose the low road and said that. No it's not disrespectful, it is entirely true. Do consider the origins of Go, where it all started as an exp…

> No it's not disrespectful, it is entirely true.

Yes, it is disrespectful, and no, it is not entirely true.

If you want to talk literally, a team has no ass to shove things into.

If you want to talk figuratively, making mistakes does not constitute having your "head up your ass." Even making multiple mistakes doesn't warrant that kind of statement. It's rude and it's pointless and doesn't add anything at all except to make you look asinine. So now you're just as asinine as I am with my misunderstandings. Well done.

Re: Serious Chrome zero-day

#367

Post by GordonAitchJay »

aboodman wrote: post #339
nneonneo wrote: post #244

Earlier quoted context omitted.

So what happened here? There's an in-the-wild exploit that's bypassing sandboxing - so there must be at least two bugs, or the sandbox isn't tight enough (which, for Chrome, would surprise the hell out of me).

I used to work on Chrome. There have been periodic sandbox escapes, and chained exploits that escape to userland are routinely performed at pwn2own. This is just notable because there is a live exploit in the wild.

There there any public information about what the live exploit does?

Re: Serious Chrome zero-day

#368

Post by randomsearch »

staticassertion wrote: post #77

I'll be that guy. Chrome has probably invested > 1 billion dollars into their codebase at this point. Certainly >100million into security. They sandbox their code aggressively . They build this project with security in mind from day 1 - it's been architected for it. The Chrome security team(s) has a lot of power for a product security org. They fuzz. They invent new fuzzers. They cluster their fuzzers. They have a wo…

Completely agree. The refusal of us nerds to accept that our tools can be improved and replaced is a broken record that has been playing since the dawn of programming. It reminds me of how assembly programmers rejected high level languages; even with the glaring historical repetition, we are unable to recognise our loyalty to all languages is irrational.

It’s patently obvious C/C++ is just a bad choice for many tasks, particularly where security is so important. I’ve never heard someone who works with those languages agree.

However - if you’re reading this and feeling vindicated in your particular language choice - be prepared to accept that the language you favour right now is already or will soon be in the same position. That’s progress. Even if you love Haskell or Rust or Scala or Ocaml, if you think it’s anything but a stepping stone in language development then you’re just as wrong as those defending C/C++. As far as programming languages are concerned, we still don’t know what we’re doing.

If you have managed to be open minded about languages, then test yourself further by telling yourself that emacs/vim is a local optima and will be superseded by better programming tools, and you should be exploring IDEs and imagining what a world than doesn’t code in plain text could look like. Because typing coding in text form is almost certainly not the best way to write programs, any more than assembler was.

Hard to accept, ain’t it?

Re: Serious Chrome zero-day

#369

Post by fredmorcos »

naikrovek wrote: post #366
fredmorcos wrote: post #358

Earlier quoted context omitted.

> Generics are slower, that's the trade-off. Developer time vs. execution time. You have no idea what you're talking about. > Saying Go has it's head up it's ass is extremely disrespectful to the people that created it and are maintaining it. You lost all credibility when you chose the low road and said that. No it's not disrespectful, it is entirely true. Do consider the origins of Go, where it all started as an exp…

> No it's not disrespectful, it is entirely true. Yes, it is disrespectful, and no, it is not entirely true. If you want to talk literally, a team has no ass to shove things into. If you want to talk figuratively, making mistakes does not constitute having your "head up your ass." Even making multiple mistakes doesn't warrant that kind of statement. It's rude and it's pointless and doesn't add anything at all except…

(I'm going to ignore the personal attack and insult)

> If you want to talk figuratively, making mistakes does not constitute having your "head up your ass." Even making multiple mistakes doesn't warrant that kind of statement.

Making deliberate mistakes multiple times and resisting fixing them for 10 years does qualify as having their "head up their ass" (or asses if that's what you prefer).

Re: Serious Chrome zero-day

#370

Post by GenericsMotors »

naikrovek wrote: post #365
GenericsMotors wrote: post #360

Earlier quoted context omitted.

You lost all credibility when you wrote that first sentence. But you carry on using empty interface with runtime type assertions and reflection if you think that's faster.

Well, pardon me for stating things as I understand them and making a mistake in doing so. I sincerely apologise for wasting your time by typing something that was true as I understood it. Clearly you've never made a similar mistake.

It was not true yet you stated it with certainty as fact.

Not interested in your snarky "apology".

Post reply on HN