121–130 of 156 posts
It seems that a watering hole attack by definition targets users of a particular organization, but articles on this event make no mention of which organizations would that be, sounding like it affects general public. Wondering who should be worried. Related: can community recommend some forums, periodic publications or other sources that aggregate information security news?
r/netsec
I said this once and I'll say it again: To counter such threats we need a healthy heterogeneous ecosystem. According to the article, the attack would have been prevented by using Firefox, (because it relied on a Chrome CVE). It also did not work on Linux and presumably not on Apple's ARM CPUs. But unfortunately we don't get exponential security. Normally, one would expect that n variables (Browser, OS, CPU architectu…
And how do you get that?
>But unfortunately, n is rather small nowadays, the number of choices shrinks every year, and -even more worrying- the attack vectors compose extremely well so you actually just need 3n exploits.
Let me tell you about early-to-mid 2000s. Now that was a time of very low 'n'. Compared to then, we live in a heterogenous nirvana.
How long until we realize that JIT was a mistake and that we should offer orders of magnitude slower JS in browsers that is actually safe (or start building webpages without JS at all again, which will probably never happen) lest we give every website the ability to take over our device? I'd pay real money for a browser with a slow, safe JS interpreter.
The v8 engine has a -—jitless option, however it isn’t clear to me whether Chrome allows that as a command line option. https://v8.dev/blog/jitless
chrome --js-flags="--jitless"Earlier quoted context omitted.
But these are attacks that worked across multiple systems. Heterogeneity is going to lead to more systems with less overall security work being done per system. Sure, using Firefox would have prevented the attacks we know about, but who's to say Google found all of the attacks. They exploit Chrome, Samsung browser, Windows, Android, iOS, and Safari. It seems silly to say "if we had one more, it would have stopped the…
> They exploit Chrome, Samsung browser, Windows, Android, iOS, and Safari. It seems silly to say "if we had one more, it would have stopped them." Samsung's browser and Chrome share 100% of attack surface; Safari and Chrome share likely near 70%. Windows and Android have Chrome built-in at the OS layer, iOS has Safari built in at the OS layer. In this case, something like Firefox which shares much less attack surface…
Earlier quoted context omitted.
The reason is that the product is Windows 10 as a whole. Linux Distros are just bundles of software that make up the operating system. So if your compromise is that you don't want new Windows 10 updates because they also bundle in new features rather than using an OS like linux, then it'd be your fault if you get hacked via an exploit that was patched in an update. Microsoft aren't going to care.
Microsoft aren't going to care. Then the obvious solution is to make them care. We penalise corporations for financial negligence and failing to take proper precautions and report correctly. We increasingly penalise them for violations of privacy and data protection rules, where similarly they are expected and required to provide adequate infrastructure to comply with the regulatory obligations. If failing to impleme…
What if they rewrote a component to have new features and it also fixed a security issue?
What's the difference between a security patch and a bug fix?
At the end of the day if someone gets so angry that Microsoft added Paint 3D in an update that they disabled updates.
What's the obligation here? They chose not to update their computer.
Earlier quoted context omitted.
But these are attacks that worked across multiple systems. Heterogeneity is going to lead to more systems with less overall security work being done per system. Sure, using Firefox would have prevented the attacks we know about, but who's to say Google found all of the attacks. They exploit Chrome, Samsung browser, Windows, Android, iOS, and Safari. It seems silly to say "if we had one more, it would have stopped the…
> They exploit Chrome, Samsung browser, Windows, Android, iOS, and Safari. It seems silly to say "if we had one more, it would have stopped them." Samsung's browser and Chrome share 100% of attack surface; Safari and Chrome share likely near 70%. Windows and Android have Chrome built-in at the OS layer, iOS has Safari built in at the OS layer. In this case, something like Firefox which shares much less attack surface…
This is wrong. I'd say it's more like 5%. Blink forked from WebKit 7 years ago and development has been very active on both sides since then. And probably the majority of the attack surface is outside Blink/WebKit proper to start with (e.g. JS engine, font libraries, media decoding, networking, etc).
Earlier quoted context omitted.
The reason why general computing sites don't recommend it is because users won't be happy when they can't sign into their bank or use other websites they wish to use. The average user doesn't know anything about how sites are constructed. Telling them to use uMatrix is non sensical. Though that's not to say there's good advice on these kinds of sites. I've seen a "Windows 10 tips" list from a very popular site tellin…
Yep Regarding Update/UAC Please blame microsoft. I don't want forced updates when I am working. And many time I have encountered issues like computer not booting. After updates they prompts "Please install our cool new software called edge". I want security update not the marketing update. So I make a compromise and disable update all together. Why not give linux style update where I can review each and every package…
For the record I hate this, but history has shown that if you don't try your absolute hardest to get security updates installed onto users' machines, they're going to constantly get owned by malicious third parties. Chrome and Firefox aggressively auto-update for the same reason (if you try to manually install old Chrome for testing it'll obliterate itself on next launch!) The vast majority of users simply do not pay attention to security and will not make the right decisions if you offer them choices about updates and security, because they don't have enough knowledge or context to make the right choices.
Earlier quoted context omitted.
I agree, and on my computer I disable custom fonts in the web browser anyways. A better web browser is really needed; one of things it can have is support for the Gemini protocol and file format. (It can also omit many things, as well as adding things.)
What else to omit? Not snark. I'm playing with a Firefox fork and ripping stuff out (pocket).
It might be nice to have a prompt like "This page wants to use a web font" like how you get for location. I realize that may be a lot of work to add in though.
Really, I'd just like to re-enable webfonts on Netflix so the subtitles don't look like garbage, but keep the fonts off on almost all websites. If anyone at Netflix is reading this, please fallback to something like sans-serif and not serif.
Earlier quoted context omitted.
What else to omit? Not snark. I'm playing with a Firefox fork and ripping stuff out (pocket).
Could I make a suggestion? It'd be great if it were possible to white-blacklist all web features? We can do this for some features like location, but I can't selectively turn off images, JavaScript, or web fonts (only globally). It might be nice to have a prompt like "This page wants to use a web font" like how you get for location. I realize that may be a lot of work to add in though. Really, I'd just like to re-ena…
I wish servo was in a better place to fork