The Rule of 2
chromium.googlesource.com
The Rule of 2
1–10 of 59 posts
Re: The Rule of 2
#2> The Rule Of 2 is: Pick no more than 2 of
> * untrustworthy inputs;
> * unsafe implementation language; and
> * high privilege.
> Security engineers in general, very much including Chrome Security Team, would like to advance the state of engineering to where memory safety issues are much more rare. Then, we could focus more attention on the application-semantic vulnerabilities. That would be a big improvement.
> Unsafe implementation languages are languages that lack memory safety, including at least C, C++, and assembly language. Memory-safe languages include Go, Rust, Python, Java, JavaScript, Kotlin, and Swift
Very nice. At the end of the process, Google might adopt Rust in Chromium. As much as I use and love Firefox, it's only realist to say that Chrome has higher chances of being around in 10 years.
I wonder why the list doesn't include their wuffs language.
Re: The Rule of 2
#3> But if you transform the image into a format that doesn‘t have PNG’s complexity (in a low-privilege process, of course), the malicious nature of the PNG ‘should’ be eliminated and then safe for parsing at a higher privilege level. Even if the attacker manages to compromise the low-privilege process with a malicious PNG, the high-privilege process will only parse the compromised process' output with a simple, plausibly-safe parser.
It's interesting to get a sense of how deeply unrealistic they think it is, to write a safe parser for a typical data format in an unsafe language.
Re: The Rule of 2
#4Two actually seems like a lot here. Why would you angle for two and not one? It seems like the latter two (unsafe implementation language and high privilege) are both within the purview of developers. Is it just a case of resource management?
Re: The Rule of 2
#5> But if you transform the image into a format that doesn‘t have PNG’s complexity (in a low-privilege process, of course), the malicious nature of the PNG ‘should’ be eliminated and then safe for parsing at a higher privilege level. Even if the attacker manages to compromise the low-privilege process with a malicious PNG, the high-privilege process will only parse the compromised process' output with a simple, plausi…
[deleted]
Re: The Rule of 2
#6> The Rule Of 2 is: Pick no more than 2 of > * untrustworthy inputs; > * unsafe implementation language; and > * high privilege. > Security engineers in general, very much including Chrome Security Team, would like to advance the state of engineering to where memory safety issues are much more rare. Then, we could focus more attention on the application-semantic vulnerabilities. That would be a big improvement. > Uns…
"Memory-safe languages include Go, Rust, Python, Java, JavaScript, Kotlin, and Swift"
An interesting list. They left out C# and PHP if it's supposed to be the most popular languages.
Re: The Rule of 2
#7> But if you transform the image into a format that doesn‘t have PNG’s complexity (in a low-privilege process, of course), the malicious nature of the PNG ‘should’ be eliminated and then safe for parsing at a higher privilege level. Even if the attacker manages to compromise the low-privilege process with a malicious PNG, the high-privilege process will only parse the compromised process' output with a simple, plausi…
Because as of 2019 the same errors as in early 1980's keep being repeated, regardless how many tools have been developed to tame C and it's derivatives.
It is so unrealistic that Android is following up Solaris footsteps.
Google has announced that ARM memory tagging extensions will be required in future Android versions.
Re: The Rule of 2
#8Image is broken.
Re: The Rule of 2
#9"If you can be sure that the input comes from a trustworthy source"
Perl's "taint"[1] capability is pretty interesting in this space. Do other languages have something similar?
[1] https://perldoc.perl.org/perlsec.html#Taint-mode
"You may not use data derived from outside your program to affect something else outside your program--at least, not by accident. All command line arguments, environment variables, locale information (see perllocale), results of certain system calls (readdir(), readlink(), the variable of shmread(), the messages returned by msgrcv(), the password, gcos and shell fields returned by the getpwxxx() calls), and all file input are marked as "tainted"."
Unrelated rant: Sometime recently mobile chrome omits any part of a url after a # when you copy/share the url. Grrr.
Re: The Rule of 2
#10> But if you transform the image into a format that doesn‘t have PNG’s complexity (in a low-privilege process, of course), the malicious nature of the PNG ‘should’ be eliminated and then safe for parsing at a higher privilege level. Even if the attacker manages to compromise the low-privilege process with a malicious PNG, the high-privilege process will only parse the compromised process' output with a simple, plausi…
The PSP was hacked by pirates when a bug was discovered in its image app (I think for tiff files). It makes me wonder if security should be baked in to a data format.