It references "Bug 1923344" but when I click the link I get "You are not authorized to access bug 1923344."
This is a feature.
Mozilla fixes Firefox zero-day actively exploited in attacks
21–30 of 151 posts
Re: Mozilla fixes Firefox zero-day actively exploited in attacks
#22until the next one...
It has been like that for most 'internet software' in the last decades, no light at the end of this tunnel.
Re: Mozilla fixes Firefox zero-day actively exploited in attacks
#23Fixed many months ago just being made public now, according to the bug tracker. Why a 7 month delay?
Citation needed.
Re: Mozilla fixes Firefox zero-day actively exploited in attacks
#24Seems bad. "An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild." See: - NVD page for CVE-2024-9680: https://nvd.nist.gov/vuln/detail/CVE-2024-9680 - Mozilla security advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2024-5...
[deleted]
Re: Mozilla fixes Firefox zero-day actively exploited in attacks
#25We need a browser written in managed lang Even if it means some perf drop, modern hardware will get it back in X years, but safety will be significantly improved
They already are partly in JS so there's a smooth path.
(Wasm isn't safe but could be a building block too)
Re: Mozilla fixes Firefox zero-day actively exploited in attacks
#26We need a browser written in managed lang Even if it means some perf drop, modern hardware will get it back in X years, but safety will be significantly improved
Ladybird[1] is switching to Swift[2].
Re: Mozilla fixes Firefox zero-day actively exploited in attacks
#27We need a browser written in managed lang Even if it means some perf drop, modern hardware will get it back in X years, but safety will be significantly improved
They already are partly in JS so there's a smooth path. (Wasm isn't safe but could be a building block too)
I can't find the link right now but I seem to remember that Firefox already replaced some internal native subsystems with the same code compiled to WASM - or maybe even compiled to WASM and then translated back to C, which basically adds a runtime memory safety layer to unsafe C code at the cost of some performance (I think it was a couple of media codecs, but not sure).
Not sure why you think that WASM is less secure than JS though. Even if the WASM heap has internal corruption there's no way for this to do damage outside the WASM sandbox that wouldn't be possible in JS.
Re: Mozilla fixes Firefox zero-day actively exploited in attacks
#28We need a browser written in managed lang Even if it means some perf drop, modern hardware will get it back in X years, but safety will be significantly improved
Rust was created at Mozilla and currently 11.7% of the Firefox source code is in Rust:
https://4e6.github.io/firefox-lang-stats/
That's down from 12.49% at the peak in July 2020 so I assume the conversion work was halted after the layoffs in 2020:
https://docs.google.com/spreadsheets/d/1flUGg6Ut4bjtyWdyH_9e...
Re: Mozilla fixes Firefox zero-day actively exploited in attacks
#29We need a browser written in managed lang Even if it means some perf drop, modern hardware will get it back in X years, but safety will be significantly improved
Sounds like Mozilla should invent a low level language with great safety guarantees, maybe even call it after some form of oxidation process[1]. Then make a browser engine called after a motor[2], and then NOT axe the team responsible for it[3].
I think the last part might be crucial.
Re: Mozilla fixes Firefox zero-day actively exploited in attacks
#30Fixed many months ago just being made public now, according to the bug tracker. Why a 7 month delay?
Why the need for patch releases then like 128.3.1?
128 is the current ESR: https://whattrainisitnow.com/calendar/