Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Chrome VRP Panel has decided to award $250k for this report

issues.chromium.org

Post reply on HN
Print view View original

141–150 of 292 posts

Re: The Chrome VRP Panel has decided to award $250k for this report

#141

Post by saagarjha »

kristianp wrote: post #125
Retr0id wrote: post #39

Earlier quoted context omitted.

First you compromise the renderer process via e.g. a bug in the JS engine. But even if you have native code execution in the context of the renderer process, you're still in a sandbox. The bug in the OP is for the second stage - breaking out of the sandbox. The referenced `patch.diff` is basically for simulating a compromised renderer.

> The referenced `patch.diff` is basically for simulating a compromised renderer. The patch.diff part is hard to understand. Surely if you have a compromised renderer, you have effectively full access to the machine already?

Modern browsers have multiple processes with different sandbox policies. The renderer process handles untrusted web content and is heavily sandboxed. The browser process does all the other stuff required to interact with your computer (and is generally much less isolated).

Re: The Chrome VRP Panel has decided to award $250k for this report

#144

Post by saagarjha »

jve wrote: post #72
WalterBright wrote: post #13

Earlier quoted context omitted.

Spending a lot of time debugging code. Eventually, the pattern recognizer in your brain will pick out the bugs. The term for this is "code smell". For example, when I'd review C code I'd look at the str???() function use. They are nearly always infested with bugs, usually either neglecting to add a terminator zero or neglecting to add sufficient storage for the terminating zero.

It is crazy that anytime someone works on application layer and wants to manipulate string, which is a very, very common thing to do when writing application, one has to consider \0 which would be an implementation detail. How can that language still be so popular?

Programming is the consideration of implementation details. When you manipulate strings in C you consider the terminating nul byte just like when you manipulate strings in Python you consider how its stores codepoints or when you manipulate strings in Swift you think about grapheme clusters. There is no free lunch. (Though, of course, you can get reduced price lunches based on the choices you make!)

Re: The Chrome VRP Panel has decided to award $250k for this report

#145

Post by saagarjha »

uecker wrote: post #94
jve wrote: post #72

Earlier quoted context omitted.

It is crazy that anytime someone works on application layer and wants to manipulate string, which is a very, very common thing to do when writing application, one has to consider \0 which would be an implementation detail. How can that language still be so popular?

The language is just fine. The real question is: Why do people not use a string library that abstracts this away safely?

Why does the language not make one?

Re: The Chrome VRP Panel has decided to award $250k for this report

#146

Post by Retr0id »

matsemann wrote: post #41
Retr0id wrote: post #39

Earlier quoted context omitted.

First you compromise the renderer process via e.g. a bug in the JS engine. But even if you have native code execution in the context of the renderer process, you're still in a sandbox. The bug in the OP is for the second stage - breaking out of the sandbox. The referenced `patch.diff` is basically for simulating a compromised renderer.

Ah, so it's like a two stage rocket, this turns a small exploit into a humongous one?

Sorta, although I wouldn't necessarily call the first exploit "small", it's at least equally important in the overall chain. "Chain" being the more usual metaphor, for this reason.

Re: The Chrome VRP Panel has decided to award $250k for this report

#148

Post by petcat »

handsclean wrote: post #137
sgjohnson wrote: post #101

Earlier quoted context omitted.

Depends on where in the world you are. I wouldn't call $250k life-changing-money anywhere developed. It's "I can probably stop worrying about money for a while" kind of money, not "life-changing" money. Not a whole lot you can buy for $250k. After taxes, that probably doesn't even buy a house.

Can somebody help me understand why these obviously very stupid takes keep popping up on HN? Is it rich people who genuinely have no idea what anything costs? Is it rich people intentionally being cruel to everybody else? Is it people trying to appear rich by pretending they have no idea what anything costs? Is it a bay area thing, are people just blowing through a literal fortune every year and unaware of their spen…

> Is it rich people intentionally being cruel to everybody else?

If you got a $240,000 bonus in the mid-2000s in tech, that very likely means you were living in one of the tech metros (SF, NYC) and you could expect nearly 50% of that to be paid in taxes (CA/Fed, NY/NYC/Fed). So you take home about $120,000.

It's a windfall of money to be sure. But being in an employment situation where even such a bonus is possible likely means you already have significantly higher costs than the average person. Maybe you'll pay down some student loans and bolster your savings. But this is far from being "rich". High-earners also tend to have high costs of living.

Re: The Chrome VRP Panel has decided to award $250k for this report

#149

Post by [deleted] »

handsclean wrote: post #137
sgjohnson wrote: post #101

Earlier quoted context omitted.

Depends on where in the world you are. I wouldn't call $250k life-changing-money anywhere developed. It's "I can probably stop worrying about money for a while" kind of money, not "life-changing" money. Not a whole lot you can buy for $250k. After taxes, that probably doesn't even buy a house.

Can somebody help me understand why these obviously very stupid takes keep popping up on HN? Is it rich people who genuinely have no idea what anything costs? Is it rich people intentionally being cruel to everybody else? Is it people trying to appear rich by pretending they have no idea what anything costs? Is it a bay area thing, are people just blowing through a literal fortune every year and unaware of their spen…

[deleted]

Re: The Chrome VRP Panel has decided to award $250k for this report

#150

Post by tonyhart7 »

handsclean wrote: post #137
sgjohnson wrote: post #101

Earlier quoted context omitted.

Depends on where in the world you are. I wouldn't call $250k life-changing-money anywhere developed. It's "I can probably stop worrying about money for a while" kind of money, not "life-changing" money. Not a whole lot you can buy for $250k. After taxes, that probably doesn't even buy a house.

Can somebody help me understand why these obviously very stupid takes keep popping up on HN? Is it rich people who genuinely have no idea what anything costs? Is it rich people intentionally being cruel to everybody else? Is it people trying to appear rich by pretending they have no idea what anything costs? Is it a bay area thing, are people just blowing through a literal fortune every year and unaware of their spen…

this is just US people culture, its all about money and taxes they should worrying their budget when they have 1 trillion to fund war machine
Post reply on HN