Serious Chrome zero-day • Hacker News Board

Re: Serious Chrome zero-day

#101

Post by mda » Wed, Mar 06, 2019, 11:23 PM UTC

qrbLPHiKpiux wrote: post #92

mda wrote: post #62

Earlier quoted context omitted.

It is fast, responsive, has much better security history and architecture than all others, super convenient if you have multiple computers. I have absolutely no problems with Chrome, I already trusted my information with Google, so I always stay signed in as well, never had any issues.

Caveat: if something’s “free,” you’re the product. Google wants to pull as much metadata from you as possible. I don’t trust anyone who gives me something for free. I therefore limit how I use it.

I made my choices carefully and consciously. As I said, I entrusted Google with my data, my emails, pictures, history. I know that my data is never sold to anyone and always kept secure. Google is probably one of the most careful companies when dealing with private data in the world. I can delete or take a copy of it if I want as well. Needless to say, I disagree with the "you are the product" polemic.

Re: Serious Chrome zero-day

#102

Post by core-questions » Wed, Mar 06, 2019, 11:26 PM UTC

ancarda wrote: post #91

elorant wrote: post #82

Earlier quoted context omitted.

So what language should they've written it in?

C++, as that was a reasonable choice in Bits of Firefox are written in Rust, so Chrome could in theory under go the same "oxidation" (gradually replace the C++ code with Rust). Edit: Clarify that Chrome was released in 2008 but was likely in development for some time before that.

> Chrome was released in 2008 but was likely in development for some time before that.

Well, sure, didn't it end up taking WebKit from Safari, which was C++, because it came from KDE Konqueror's KHTML?

Re: Serious Chrome zero-day

#103

Post by sterlind » Wed, Mar 06, 2019, 11:27 PM UTC

lima wrote: post #99

MikeHolman wrote: post #81

This looks bad for Google. EdgeSpot detected an in-the-wild exploit and told Google about this in December, but Google wasn't going to fix the bug until late April. Google only released a patch early because the finder blogged about it. https://blog.edgespot.io/2019/02/edgespot-detects-pdf-zero-d...

That's an entirely different vulnerability.

Yeah, I was going to say... it would make zero sense for an attacker to waste a Chrome RCE 0day on tracking people who read academic books about Honduras!

Although, I'm not sure why they'd do that in the first place, even. Anti-piracy? Seems a lot of effort..

Re: Serious Chrome zero-day

#104

Post by ru999gol » Wed, Mar 06, 2019, 11:27 PM UTC

staticassertion wrote: post #77

I'll be that guy. Chrome has probably invested > 1 billion dollars into their codebase at this point. Certainly >100million into security. They sandbox their code aggressively . They build this project with security in mind from day 1 - it's been architected for it. The Chrome security team(s) has a lot of power for a product security org. They fuzz. They invent new fuzzers. They cluster their fuzzers. They have a wo…

if you think C or C++ programmers are ever going to admit this, you must never have met one

Re: Serious Chrome zero-day

#105

Post by [deleted] » Wed, Mar 06, 2019, 11:27 PM UTC

uniformlyrandom wrote: post #51

benatkin wrote: post #32

Earlier quoted context omitted.

Next time you see a shortened word, you can just assume it's useful. Because they are.

Not really, I have seen a lot of unneeded abbreviations. Thankfully we are (almost) out of the age of 140c messages and 40c editor lines. But more to the point, 'vulns' seems like a very unnatural abbreviation. I would go with v11n (similar to i18n).

[deleted]

Re: Serious Chrome zero-day

#106

Post by nothrabannosir » Wed, Mar 06, 2019, 11:28 PM UTC

stcredzero wrote: post #88

staticassertion wrote: post #77

I'll be that guy. Chrome has probably invested > 1 billion dollars into their codebase at this point. Certainly >100million into security. They sandbox their code aggressively . They build this project with security in mind from day 1 - it's been architected for it. The Chrome security team(s) has a lot of power for a product security org. They fuzz. They invent new fuzzers. They cluster their fuzzers. They have a wo…

Let's just collectively admit it, finally - you can't write safe C++ in a codebase this complex. Do they distrust their own coders to the same degree they distrust the processes they sandbox? I suspect the answer to this is "no" but I would like to hear from someone who actually codes there. I think the truth is more like this: You can write safe C++, just like you can keep a secret. It's just that the odds that you…

The number of people required was a function of the "this complex" qualifier.

I can write a safe C++ app on my own. I can't write Chrome on my own.

Re: Serious Chrome zero-day

#107

Post by doctorpangloss » Wed, Mar 06, 2019, 11:28 PM UTC

staticassertion wrote: post #86

elorant wrote: post #82

Earlier quoted context omitted.

So what language should they've written it in?

A memory safe one. There are many of them. They could build their own if they chose to - they've built multiple languages in the past. Picking a language for the Chrome team doesn't seem practical - we all know where your question is going to head. The point is they have to not pick C++. Again, they've invested many, many millions of dollars into security. Let's not pretend that they're priced out of using another la…

Their egos have priced them out of a lot of stuff though.

The Chrome team is great but when you're surrounded by people who think they're god damn gods on Earth it's hard to question orthodoxies, especially old ones.

Re: Serious Chrome zero-day

#108

Post by core-questions » Wed, Mar 06, 2019, 11:31 PM UTC

vortico wrote: post #97

qrbLPHiKpiux wrote: post #92

Earlier quoted context omitted.

Caveat: if something’s “free,” you’re the product. Google wants to pull as much metadata from you as possible. I don’t trust anyone who gives me something for free. I therefore limit how I use it.

What browser do you use then?

Arachne for DOS

Re: Serious Chrome zero-day

#109

Post by kbenson » Wed, Mar 06, 2019, 11:32 PM UTC

arcticfox wrote: post #40

ktjfi wrote: post #20

The version that includes the fix was released a few days ago... how is this a 0-day at this point?

It was exploited before the vendor was aware; IMO that earns it a permanent "Zero-day" title. Obviously it's not currently a zero-day, given that we're hearing about it from the vendor. The moniker is pretty paradoxical otherwise, the discoverer writing a post about a zero-day would make it no longer a zero-day.

I always thought it was from the patch date. As I understand it there are 1-days, and 2-days, where people rush to make exploits for released patches to capitalize on the lag time between patch availability and wide deployment (and also zero-days which were recently patched), which is why zero-day denotes that there has been no time since a patch is available (since there isn't one). So, I would say this was a zero-day up until the point Chrome released a patch, and as of now it's some low X-day.

Re: Serious Chrome zero-day

#110

Post by simcop2387 » Wed, Mar 06, 2019, 11:34 PM UTC

ancarda wrote: post #91

elorant wrote: post #82

Earlier quoted context omitted.

So what language should they've written it in?

C++, as that was a reasonable choice in Bits of Firefox are written in Rust, so Chrome could in theory under go the same "oxidation" (gradually replace the C++ code with Rust). Edit: Clarify that Chrome was released in 2008 but was likely in development for some time before that.

Yes, the KHTML base for the rendering engine was started back in 1998, so C++ was a fine choice then. It's grown up as a code base significantly since then.