Live data from Hacker News

Actively exploited sandbox RCE in all Chromium versions

nvd.nist.gov

201–210 of 528 posts

Re: Actively exploited sandbox RCE in all Chromium versions

#201

Earlier quoted context omitted.

Books I've read would disagree. Are you the emdash police?

[flagged]

> Spacing around an em dash varies. Most newspapers insert a space before and after the dash, and many popular magazines do the same, but most books and journals omit spacing, closing whatever comes before and after the em dash right up next to it.

Re: Actively exploited sandbox RCE in all Chromium versions

#202

Earlier quoted context omitted.

They pay in plain old money, too. On the market your counterparty will be a criminal who is trying to scam you every step of the way.

Not so much, the grey market is pretty well structured.

Is there anywhere I could read more about this?

Sound very interesting!

Re: Actively exploited sandbox RCE in all Chromium versions

#203

[flagged]

It’s not. Same as credible threats are also seen as nothing to do with free speech. It just isn’t what free speech is. It’s a separate thing.

No, it is a limit on free speech but it is one of several that various governments (and cultures as a whole) throughout the world have upheld fairly consistently. Free speech is more or less an unachievable platonic ideal that we aspire to. Success varies, as do the compromises made along the way.

Speaking more generally, don't let your ideals bias your judgment. Just because you support policy X and also view ideal Y as good that doesn't mean that X isn't detrimental to Y. It's important to be objective about these things.

Re: Actively exploited sandbox RCE in all Chromium versions

#204

Sounds wild. (Posted from memory safe WebKit; i.e. WebKit compiled with filcc and all of WebKit's dependencies compiled with filcc.)

Wait, you have that working? What's the lowest friction to run it? Like, VM or docker container or...

VM

https://fil-c.org/pizlix

Then build WebKit using do_cmake_yolo_simpler.sh in projects/webkitgtk-2.44.3

It's still pretty rough, but works more than well enough to post on HN. My regression test is to post on X. That works too

Re: Actively exploited sandbox RCE in all Chromium versions

#205
post #180

Earlier quoted context omitted.

Yeah

It sounds technically possible to build a JIT where a verifier checks that the JIT-generated code is correctly pizlonated before allowing it to become executable. :)

Yes

I have a new tech called SaRCAsm, which is a memory-safe assembler. So the next step is a "Sarcastic JIT" :-)

Re: Actively exploited sandbox RCE in all Chromium versions

#206

I’m so tired. I think I’m just going to get a job as a garbage man and cancel my internet.

They just released a CVE for a garbage truck vulnerability where an attacker could brick the vehicle by exploiting the telemetry system these things now have preinstalled in factory.

Re: Actively exploited sandbox RCE in all Chromium versions

#208

Earlier quoted context omitted.

Wait, you have that working? What's the lowest friction to run it? Like, VM or docker container or...

VM https://fil-c.org/pizlix Then build WebKit using do_cmake_yolo_simpler.sh in projects/webkitgtk-2.44.3 It's still pretty rough, but works more than well enough to post on HN. My regression test is to post on X. That works too

Sweet, thanks. I guess running in a VM is also a bonus protective layer:)

Re: Actively exploited sandbox RCE in all Chromium versions

#209

Earlier quoted context omitted.

jira and confluence come to mind...

Is it their app’s features that are slow, or the analytics bolted on top?

Both. And all the dependencies of both are slow. And the dependencies of those are slow, too.

Re: Actively exploited sandbox RCE in all Chromium versions

#210

Earlier quoted context omitted.

VM https://fil-c.org/pizlix Then build WebKit using do_cmake_yolo_simpler.sh in projects/webkitgtk-2.44.3 It's still pretty rough, but works more than well enough to post on HN. My regression test is to post on X. That works too

Sweet, thanks. I guess running in a VM is also a bonus protective layer:)

lol yeah

Pls file bugs if you encounter issues.

Also, fair warning, it's hella slow right now on JS-heavy websites (like X). It barely works.

But we can fix that with some effort, I think

Post reply on HN