Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft fixes 5-year-old Defender bug, reducing Firefox-related CPU use by 75%

bugzilla.mozilla.org

Post reply on HN
Print view View original

61–70 of 443 posts

Re: Microsoft fixes 5-year-old Defender bug, reducing Firefox-related CPU use by 75%

#61

Post by bogwog »

vntok wrote: post #19
jupp0r wrote: post #13

Earlier quoted context omitted.

The platform feature in question was normally cheap and just made artificially expensive by Defender intercepting calls to it and blocking until analysis was performed. I don't think it's the FireFox' team's responsibility to be aware of and take into account arbitrary software intercepting system calls.

> I don't think it's the FireFox' team's responsibility to be aware of and take into account arbitrary software intercepting system calls. Per the bug report, Firefox was generating up to ~14,000 calls where Chrome was generating ~300, though. Surely it is Firefox' team's responsibility to use system calls in a sane way, say not almost 50x more than the competition?

> Surely it is Firefox' team's responsibility to use system calls in a sane way, say not almost 50x more than the competition?

The docs for that function don't say anything about performance: https://learn.microsoft.com/en-us/windows/win32/api/memoryap...

They also don't say anything about "sane" usage, and while I don't have an MBA, I'm pretty sure they don't teach anything about `VirtualProtect` ratios when doing competitor analysis.

One possibility is that the Chrome team's implementation was more efficient due to luck, or they invested the resources to identify the performance characteristics of this function call, whereas the Firefox team missed it. I don't think "Chrome has more development resources than Firefox" is news to anybody.

Re: Microsoft fixes 5-year-old Defender bug, reducing Firefox-related CPU use by 75%

#62

Post by lordnacho »

duxup wrote: post #55
arnaudsm wrote: post #40

Quick napkin math of the wasted power : Firefox has ~300e6 users, let's assume the bug wasted 5 extra watts 4 hours a day. That's 250 megawatts saved, the equivalent of an average coal power plant. Because some Microsoft engineer missed a bug.

> the equivalent of an average coal power plant Produces in an hour, four hours?

Continuous. We need one less coal plant to support the Firefox code after the bug fix.

Re: Microsoft fixes 5-year-old Defender bug, reducing Firefox-related CPU use by 75%

#63

Post by agloe_dreams »

echelon wrote: post #21
gtop3 wrote: post #3

I would like anyone that considers Microsoft to be a recent champion of Open Source to reflect on corporate doublespeak. It's plausible that this bug was engineered as an attack on Firefox.

Why would Microsoft attack Firefox specifically and not Chrome? Chrome is the bigger threat to their business. Firefox has become almost too small to care about - little revenue, small browser market share.

There's an argument that Microsoft's Edge use of Chromium and then the Surface Duo would cause 'don't bite the hand that feeds you" problems. Not agreeing with OP, but it would make sense.

Re: Microsoft fixes 5-year-old Defender bug, reducing Firefox-related CPU use by 75%

#64

Post by SketchySeaBeast »

chillstreem wrote: post #53
SketchySeaBeast wrote: post #49

Earlier quoted context omitted.

I don't know if that's the case. I'm a Firefox user but consider all the 3rd party apps nearly as much malware as the things they are trying to solve. I run strictly defender and try to make good choices when downloading and browsing.

well, if we're taking strictly subjective personal experiences as some sort of a relevant benchmark, then I'm a Windows Firefox user that has never used MS defender for any length of time, and always strictly a reliable low-impact 3rd party AV like ESET or Emsisoft. so I guess the two of us cancel each other out.

So based upon rigorous analysis, approximately half of all Firefox users use the default choice, and half use a different AV.

Re: Microsoft fixes 5-year-old Defender bug, reducing Firefox-related CPU use by 75%

#65

Post by BuckRogers »

jupp0r wrote: post #26
vntok wrote: post #19

Earlier quoted context omitted.

> I don't think it's the FireFox' team's responsibility to be aware of and take into account arbitrary software intercepting system calls. Per the bug report, Firefox was generating up to ~14,000 calls where Chrome was generating ~300, though. Surely it is Firefox' team's responsibility to use system calls in a sane way, say not almost 50x more than the competition?

Did you read the bug report? This is literally about writing to files in a temp folder. Surely you can optimize that but you should also be able to assume that this does not use excessive amounts of CPU on a modern operating system.

You really shouldn’t assume anything in software or any complex system. I know this wouldn’t fly at my job, and I don’t work at Mozilla.

This is basic testing.

Normally this is the mark of a bad software engineer, but attempting to blame the platform you’re on for your lack of testing takes it a to a new low.

Mistakes happen, admitting full incompetence that basic testing isn’t done is damning. This is not a good defense of Firefox nor Mozilla.

Re: Microsoft fixes 5-year-old Defender bug, reducing Firefox-related CPU use by 75%

#66

Post by uoaei »

recursive wrote: post #51
uoaei wrote: post #43

Earlier quoted context omitted.

The new Edge browser is basically a revamped Chromium, so that'd be a pretty dumb move.

Seems less dumb than targeting Firefox though. Presumably, in the universe of this conspiracy hypothesis, they would do it in a way that wouldn't effect Edge.

Then they would lose any semblance of plausible deniability, which would expose them to being positively identified as bad actors. What it looks like now is mere incompetence in the face of enormous complexity, which means they lose a lot less face compared to doing what you suggest. Put bluntly, they're hiding within the space covered by Hanlon's razor.

Re: Microsoft fixes 5-year-old Defender bug, reducing Firefox-related CPU use by 75%

#67

Post by JustSomeNobody »

maccard wrote: post #12
gtop3 wrote: post #3

I would like anyone that considers Microsoft to be a recent champion of Open Source to reflect on corporate doublespeak. It's plausible that this bug was engineered as an attack on Firefox.

Have you any semblance of proof of this? By the looks of it took Firefox a few years to figure out what the repro was, they reported it to MS, it was (very) promptly fixed and they were warned that the syscall they were using isn't being used as intended and they should consider changes to FF for future use cases.

>> It's plausible that this bug was engineered as an attack on Firefox.

> Have you any semblance of proof of this?

Does it need proof? Someone can make a statement like this solely based upon past behavior. They're merely stating that it is plausible.

Re: Microsoft fixes 5-year-old Defender bug, reducing Firefox-related CPU use by 75%

#68

Post by cesarb »

vntok wrote: post #33
jupp0r wrote: post #26

Earlier quoted context omitted.

Did you read the bug report? This is literally about writing to files in a temp folder. Surely you can optimize that but you should also be able to assume that this does not use excessive amounts of CPU on a modern operating system.

Yes, I have read the bug report. It mentions that Firefox writes wayyyyy too much in the temp folder. It also mentions that the team should fix this behaviour independently of the fact that some of those calls are more costly than they should be because of the bug in Defender: > With a standard Firefox configuration, the amount of calls to VirtualProtect is currently very high, and that is what explains the high CPU…

> It mentions that Firefox writes wayyyyy too much in the temp folder.

> > the amount of calls to VirtualProtect is currently very high

Calling VirtualProtect is not writing to the temp folder. The VirtualProtect call is to change the permissions of the in-memory pages. It should be an inexpensive system call (other than the cost of TLB flushes and/or shootdowns).

Re: Microsoft fixes 5-year-old Defender bug, reducing Firefox-related CPU use by 75%

#69

Post by whalesalad »

ChuckNorris89 wrote: post #58
whalesalad wrote: post #39

My only interaction with Windows Defender is the (undefeatable) nag popup every boot that warns me it is disabled.

My car also nags me every time I unbuckle my seatbelt to park yet that doesn't mean everyone should have it unbuckled all the time. There's a reason it's designed to be naggy. Having everyone easily disable Windows Defender will not lead to a great outcome. There's a reason malware on Windows has been on a steep decline from the Windows XP days and I'd prefer it to keep it that way.

TBH the main reason I commented this was to get some kind of validation from the community (positive or negative). Sounds like I need to turn it back on :)

I really only use this machine for MWII, Halo and Titanfall. It's a glorified Xbox. I even contemplated putting it on a standalone VLAN to 100% physically isolate it from my core net.

Re: Microsoft fixes 5-year-old Defender bug, reducing Firefox-related CPU use by 75%

#70

Post by agloe_dreams »

stalfosknight wrote: post #17
gtop3 wrote: post #3

I would like anyone that considers Microsoft to be a recent champion of Open Source to reflect on corporate doublespeak. It's plausible that this bug was engineered as an attack on Firefox.

Do we have to assume negative intent every time something like this happens?

Well no, but I also would question the inverse. Holding accountable companies that gain from possibly bad actions and asking the questions is helpful.

See: Microsoft's Supreme court case over their preference for IE and forced monopoly. While Microsoft 'won' the case, the outcomes were exactly what the case feared but "convenient" political climate helped them avoid travelling back to court of course. Microsoft took extreme steps to avoid being broken up in the 1990s however and it's arguable that one of their political mitigation methods, investing in Apple, actually had worse effects on them. (Prior to the iPhone in 2007, it was assumed that RIM and Microsoft would be the big two players in the smartphone space, Apple and Google have basically become the big two players in the Computing space mindshare)

https://en.wikipedia.org/wiki/United_States_v._Microsoft_Cor....

Post reply on HN