The Chrome VRP Panel has decided to award $250k for this report

Post by pyrale » Mon, Aug 11, 2025, 4:28 PM UTC

tptacek wrote: post #237

pyrale wrote: post #236

Earlier quoted context omitted.

Not commenting about the ic/leo part specifically, but there is a pretty abundant body of work on what "normal" people are willing to do, as long as they find a way to rationalize it away. The banality of evil is well documented. In that light, what others would do is rarely a reliable indicator that you shouldn’t think twice about your actions, lest you regret later, once the thinking has happened.

I have no idea what any of this has to do with anything I just wrote, I'm sorry.

Post by sidewndr46 » Mon, Aug 11, 2025, 4:42 PM UTC

Enginerrrd wrote: post #183

remus wrote: post #113

Earlier quoted context omitted.

Immediate follow up questions from the tax man, and then shortly afterwards the police "who is this guy? where is the invoice? what is his phone number?"

No, it doesnt typically work that way at all. The tax man just wants to get paid. I grew up in an area known for people growing cannabis before it was legal. An enormous amount of taxes got dodged through cash land deals, but tons of people just claimed the income under various categories and no one ever came knocking because of that. Its usually the other way around. If you caught the Fed's eye, then they might try…

Post by WalterBright » Mon, Aug 11, 2025, 5:15 PM UTC

jve wrote: post #72

WalterBright wrote: post #13

Earlier quoted context omitted.

Spending a lot of time debugging code. Eventually, the pattern recognizer in your brain will pick out the bugs. The term for this is "code smell". For example, when I'd review C code I'd look at the str???() function use. They are nearly always infested with bugs, usually either neglecting to add a terminator zero or neglecting to add sufficient storage for the terminating zero.

It is crazy that anytime someone works on application layer and wants to manipulate string, which is a very, very common thing to do when writing application, one has to consider \0 which would be an implementation detail. How can that language still be so popular?

Post by WalterBright » Mon, Aug 11, 2025, 5:19 PM UTC

uecker wrote: post #94

jve wrote: post #72

Earlier quoted context omitted.

It is crazy that anytime someone works on application layer and wants to manipulate string, which is a very, very common thing to do when writing application, one has to consider \0 which would be an implementation detail. How can that language still be so popular?

The language is just fine. The real question is: Why do people not use a string library that abstracts this away safely?

Post by pests » Mon, Aug 11, 2025, 5:38 PM UTC

kristianp wrote: post #125

Retr0id wrote: post #39

Earlier quoted context omitted.

First you compromise the renderer process via e.g. a bug in the JS engine. But even if you have native code execution in the context of the renderer process, you're still in a sandbox. The bug in the OP is for the second stage - breaking out of the sandbox. The referenced `patch.diff` is basically for simulating a compromised renderer.

> The referenced `patch.diff` is basically for simulating a compromised renderer. The patch.diff part is hard to understand. Surely if you have a compromised renderer, you have effectively full access to the machine already?