Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome 0day is being exploited now for CVE-2022-1096; update immediately

forbes.com

Post reply on HN
Print view View original

111–120 of 150 posts

Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately

#111

Post by Osiris »

gnu8 wrote: post #102
______-_-______ wrote: post #79

Earlier quoted context omitted.

I found this comparison of JIT vs non-JIT. https://microsoftedge.github.io/edgevr/posts/Super-Duper-Sec... If you take those charts at face value, they're pretty incredible. The JIT ends up worse than the interpreter for most (real-world non-synthetic) use cases for power usage, memory usage, and startup time. Page load time is a wash. And this is after Google has poured $billions into optimizing V8.

I don't get why Microsoft is even working on this. They don't have a web browser.

Microsoft has Edge, which is a browser. If your argument is that it's Chromium based and this not their own browser, there are several other companies like Opera, Vivaldi, and Brave who's sole product is a Chromium based browser. I don't think it would be appropriate to say that those companies "don't have a browser".

Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately

#113

Post by tedunangst »

bastawhiz wrote: post #110
tedunangst wrote: post #107

Earlier quoted context omitted.

The threat model where the analytics company is hacked. I don't know why you would trust your bank to never let that happen. There are some APIs on the bank site you need to conduct your business, and there are also some extraneous APIs. Yeah, sure, you tell the bank it's their fault clickwatcher.js got hacked, and maybe they give you your money back, but it seems like unnecessary exposure to unnecessary hassle to le…

But having a more hardened browser literally does nothing to protect you. If your bank's website is hacked because of a third party API, the most well-hardened browser (as the commenter that I replied to describes) in the world will happily allow all of your money to be stolen. A slow-but-secure JS engine does not protect you from JS that's doing things it's allowed to do.

Oh, oh, oh. I thought this was the thread where we turned javascript off or used adblock or some such. Yeah, secure vs insecure jit engine isn't going to help here.

Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately

#114

Post by noduerme »

Ourgon wrote: post #16
_Nat_ wrote: post #2

> Not much is known, at least publicly, at this stage about CVE-2022-1096 other than it is a "Type Confusion in V8." This refers to the JavaScript engine employed by Chrome. Is there a safer JavaScript engine folks can use without having to worry about this sorta thing? Even if it's slower, less compatible, more resource-intensive, etc.? I feel like, in most cases, I could make due with JavaScript being 10x or even 1…

> I feel like, in most cases, I could make due with JavaScript being 10x or even 100x slower, taking up 10x the RAM, lacking some uncommon features, and so forth -- if it meant being able to enable it without needing to worry about new zero-days. Not on the "modern web" you wouldn't, even the current speedy versions of V8 and ${whatever}monkey now used by Firefox the thing often is brought to a crawl by the deluge of…

I've been waiting for the arguments against Flash and Java applets (constant vulnerabilities + sites clogged with bad code) to finally become the argument against Javascript. Still waiting. The only reason it hasn't seems to me the massive investment by Google in speeding up the engine to the point where something even slower and more full of crud can seem relatively snappy on a mobile device.

Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately

#116

Post by rurban »

gruez wrote: post #19
_Nat_ wrote: post #2

> Not much is known, at least publicly, at this stage about CVE-2022-1096 other than it is a "Type Confusion in V8." This refers to the JavaScript engine employed by Chrome. Is there a safer JavaScript engine folks can use without having to worry about this sorta thing? Even if it's slower, less compatible, more resource-intensive, etc.? I feel like, in most cases, I could make due with JavaScript being 10x or even 1…

>Is there a safer JavaScript engine folks can use without having to worry about this sorta thing? Even if it's slower, less compatible, more resource-intensive, etc.? You can disable JIT in firefox[1], which makes it fall back to an interpreter. That should theoretically make it safer as there are less optimizations going on and less generated code being directly executed by the CPU. [1] https://github.com/arkenfox/u…

you can also install Fennec on Android, which has much more privacy extensions, and a better JavaScript engine (a Firefox fork).

on the PC Firefox is good enough.

Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately

#117

Post by rurban »

_Nat_ wrote: post #48
meibo wrote: post #43

Earlier quoted context omitted.

What you're asking for will probably put you more at risk than V8 does: 1) JavaScript engines with any kind of usable performance are inherently complex 2) V8 is hardened, battle-tested and fuzzed/verified by the best engineers at Google and indepentently by third party researchers, since inception - the engine you will be using probably won't be All of this is really a side-effect of Chrome's popularity and Google's…

I'd prefer a [provably secure]( https://en.wikipedia.org/wiki/Provable_security ) JavaScript-engine as a default. Or, if provable-security would be a bit much for a near-term project, something more heavily based in a simple engine-design, without trying to optimize stuff and perhaps including seemingly-redundant run-time checks. Ya know, stuff like type-checking arguments, using stronger restrictions on async-calls…

https://bellard.org/quickjs/ would be the easiest effort then

Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately

#118

Post by ComradePhil »

sofixa wrote: post #56
johndfsgdgdfg wrote: post #37

Earlier quoted context omitted.

I just love MS. A company so focused on security and caring about its customers. I always encourage people to use Edge. We need to stop spyware companies like Google.

Microsoft is not focused on security. The amount of trivially exploitable extremely serious security bugs in Azure scream "nobody even pretends to think about security here".

Where are these and why are they not being exploited then?

Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately

#119

Post by ComradePhil »

kentonv wrote: post #93
stjohnswarts wrote: post #85

Earlier quoted context omitted.

Yeah wondering if this also a 0 day for node.js and electron apps...

This is a 0 day for anything that uses V8 to execute possibly-malicious JavaScript. Node.js and Electron aren't designed to do that in the first place, so this doesn't really affect them.

Unless some protestware decides to delete all your data and replace everything with "icri4ukraine".

Re: Chrome 0day is being exploited now for CVE-2022-1096; update immediately

#120

Post by 28304283409234 »

rurban wrote: post #116
gruez wrote: post #19

Earlier quoted context omitted.

>Is there a safer JavaScript engine folks can use without having to worry about this sorta thing? Even if it's slower, less compatible, more resource-intensive, etc.? You can disable JIT in firefox[1], which makes it fall back to an interpreter. That should theoretically make it safer as there are less optimizations going on and less generated code being directly executed by the CPU. [1] https://github.com/arkenfox/u…

you can also install Fennec on Android, which has much more privacy extensions, and a better JavaScript engine (a Firefox fork). on the PC Firefox is good enough.

And ublock.
Post reply on HN