Live data from Hacker News

Actively exploited sandbox RCE in all Chromium versions

nvd.nist.gov

451–460 of 527 posts

Re: Actively exploited sandbox RCE in all Chromium versions

#451

Earlier quoted context omitted.

I've never seen an SPA which scales properly and doesn't become a bloated mess, maybe that's possible but it's definitely harder to make it work than using traditional server side template rendering

Plenty of app usecases don’t need to “scale” - immediately or ever!

That's a good point but you never know that from the start, "this app won't scale well" is a hard sell for a new project in my opinion

Re: Actively exploited sandbox RCE in all Chromium versions

#453

Earlier quoted context omitted.

Right but the implication of a SPA is that it’s an application which has many logical pages, but only one real page. The logical pages are constructed by dynamically updating the DOM using JavaScript. As opposed to navigating to a new, server-provided page. For example, a search function. For a MPA, each search query would be a new page. For a SPA, each query is a new logical page, served on the same real page. Techn…

> it’s just a site sigh …does someone else want to finish this up?

This reply means basically nothing to me or anyone.

To expand on what I mean, if the implication isn’t obvious: a SPA with no client side rendering is just a single HTML page. It’s a document, not an application.

So SPA naturally implies client side rendering.

The difference between a SPA and MPA isn’t the amount of pages, they both have about the same amount of logic pages. It’s about where those pages are rendered. Dynamically on the front end, or on the back end.

EDIT: okay okay to expand, my website has a contact form. With JS enabled, the form submit displays a little box that says “thank you for submitting”. With JS disabled, it navigates you to a “thank you for submitting” page.

Both are the same logic page, they have the same function. One page is just rendered client side, and one server side. Most websites or applications are hybrids. There’s very few true single page applications, and very few true multi page applications. Most SPAs have multiple real pages for different things. Most MPAs combine multiple logic pages into one real page.

Re: Actively exploited sandbox RCE in all Chromium versions

#454

Google has the means and ability to rewrite Chromium ; bug for bug in Rust from C++ using Astra & Fable. Same for the Linux kernel. Considering the Fermat's Last Theorem lean proof was 13MLoC and cost $300,000 it would cost $2M to rewrite Chromium & Linux in Rust going purely of combined LoC.

Why don't you do it and post it here then?

I don't have $2M

Re: Actively exploited sandbox RCE in all Chromium versions

#455

Earlier quoted context omitted.

I think it makes more sense to verify that the jit is correct than to verify that it's output is correct at runtime.

Nah It's damn near impossible to verify that the JIT is correct. But it is possible to verify at runtime that the code that the JIT emitted obeys some memory safety law. (V8's heap sandbox is an example of this; a sarcastic JIT would be an arguably stronger example of this.)

If you have a runtime check of some correctness, why can't you just prove that the output of your compiler always passes that check?

Re: Actively exploited sandbox RCE in all Chromium versions

#456
post #112

Earlier quoted context omitted.

"Aiding and Abetting" crime is also a crime. Free speech has nothing to do with it.

"this vulnerability is being sold for research purposes only and must never be used outside of a tightly controlled research sandbox"

courts are very good at reasoning about things like this and figuring out its bullshit. Zerodium is probably the closest you could get to some reasonable denial about this. Selling an exploit on crime.com for "research puposes only" will get you laughed at on the way to the cell.

Re: Actively exploited sandbox RCE in all Chromium versions

#457

Earlier quoted context omitted.

Has anyone actually been convicted of abetting a crime by selling a vulnerability, by itself, not conspiring with the buyer to commit a crime using said vulnerability? Not as far as I can see. It would be absurd to jail someone for accurately describing a bug.

It would be absurd to jail someone for accurately describing a bug on their blog or whatever. Not so much for taking money from someone who the buyer should know has no reason to be interested in buying the information. And either you know who your counterparty is, in which case you know that they are using it nefariously, or you don't know who your counterparty is, in which case you know that they are using it nefar…

Has anyone actually been charged and convicted for disclosing knowledge of a vulnerability in exchange for money with no further collusion to commit a crime?

Re: Actively exploited sandbox RCE in all Chromium versions

#458
post #419

Earlier quoted context omitted.

Who is to say they didn’t already do that?

you're not allowed to burn exploits like that if you've signed a deal, and who would risk that for $1k? of course it could be a colleague or someone with access to such tools

[deleted]

Re: Actively exploited sandbox RCE in all Chromium versions

#459
post #419

Earlier quoted context omitted.

Who is to say they didn’t already do that?

you're not allowed to burn exploits like that if you've signed a deal, and who would risk that for $1k? of course it could be a colleague or someone with access to such tools

“You are not allowed to do things” - lol

Re: Actively exploited sandbox RCE in all Chromium versions

#460
post #424

Earlier quoted context omitted.

There’s a reason I use Firefox (Gecko). Also, Ladybird—another completely different web engine—is really promising. I spent five hours building it from source, having it take about 8 gigabytes of space, and it perfectly renders my own webpages and blogs. I have a feeling someone’s going to make an open source browser using Ladybird’s engine before Ladybird has official binaries.

Is Firefox actually safer than Chromium-based browsers though? I know this is old: https://madaidans-insecurities.github.io/firefox-chromium.ht... but has the situation changed substantially in favor of Firefox?

No. The post applies to Android, but the situation is significantly worse on desktop platforms since Android at least has OS-level sandboxing, etc.

https://www.reddit.com/r/GrapheneOS/comments/1unhtxu/initial...

Post reply on HN