211–220 of 223 posts
Earlier quoted context omitted.
I'm confused. Why would the government want to break Chrome? Also, if they are not going to release the exploit soon (especially to Google), why are you saying 'safer software for all'?
Maybe I'm naive but it could simply be because they are evaluating it for internal use. The FBI and CIA don't want to use vulnerable browsers any more than we do.
Google has/had the 'do no evil' in their philosophy, and disabling a scheme that misuses their software for cyber-warfare sounds like a good thing.
Earlier quoted context omitted.
"VUPEN provides vulnerability research and intelligence for defensive and offensive security." so, they are I presume happy to help the US CIA/MIL fvck people over (who most likely don't deserve it).
You may want to check the spelling on your profanity there.
Unless Google is one of their customers it may actually be a little while before this exploit is fixed. VUPEN does security research and doesn't disclose to original vendors unless they happen to be customers. I both love and hate them. They are extremely talented and find absolutely awesome bugs that are hard to discover without a lot of work, and I hate them because they don't disclose their work unless it is for m…
The reality is that there is probably no chance that they would ever find these bugs if they weren't funded to do it and the only way to be funded is to have customers. The net result is probably safer software for all.
I don't think that follows. Clearly there are folks in some governments who would fund finding zero day exploits so that they can use them to conduct cyber-warfare operations. Stuxnet comes to mind and the HBGary emails were telling in this regard. It seems there is a market for 0 day attacks that are not known to the manufacturer. So while Google would clearly give them $13,373 for the bug report but that is no doubt mouse nuts compared to what the someone would pay them while it's not in the 'known' state.
So I find Vupen's business model not unlike the business of creating munitions. No doubt profitable but not something I'd personally want to participate in.
vupen: "Hey Google, your browser has a very nasty bug that allows for potentially horrible things to happen. We thought we'd share that with the world. If you'd like to know where it is though, you'd better give us money."
I'm tired of doing volunteer work for corporations, personally.
Earlier quoted context omitted.
I'm tired of doing volunteer work for corporations, personally.
Don't think of it as volunteer work -- think of it as a non-financial exchange of value. You provide beta testing in exchange for significantly more affordable software and/or earlier access. If you want rock solid reliability, there are companies and operating systems that provide it, with the price tag and turnaround time to match.
The 100% unhackable browser and OS... how much does it cost? I think the turnaround time is going to be infinite. I'm not sure what you're saying.
These companies have employees, who have a nice situation with a financial exchange of value. Let them do their own work. If I'm going to do something their employees should be doing, they're free to hire me or pay me as a consultant.
Earlier quoted context omitted.
That works as long as the exploit is known. What happens when it's not?
same thing that happens when an exploit is found for a browser that doesn't automatically update
Impressive, but not surprising. Chrome isn't magical; ASLR and DEP have been bypassed in the past, and even if its own sandbox is perfect, the kernel it's sitting under is a huge attack surface.
ASLR and DEP, by and large, have nothing to do with the kernel. ASLR is a function of the binary loader and memory allocators, which are in userland. DEP is a function of userland memory protection flags (they're handled on the bare metal by the kernel, but the kernel just sets what it's told to by the userland). I'd put any amount of money down on the table that there is no kernel vulnerability here at all -- if the…