Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I discovered a browser bug

jakearchibald.com

Post reply on HN
Print view View original

31–40 of 137 posts

Re: I discovered a browser bug

#31

Post by pjc50 »

obl wrote: post #2

It's quite incredible how the web managed to get along with such a janky sandbox model. It's a very important thing that users trust their browser and won't hesitate a second to enter an unknown URL. They see "going to a webpage" as the equivalent to looking at a poster in the street, not eating candy provided by a random stranger. Eroding this trust would ruin it for everyone, even well behaved static websites witho…

The key thing is differentiating one set of pages from another set of pages - putting security boundaries into a hypertext system that was originally designed to allow mixing resources from different sources.

Re: I discovered a browser bug

#32

Post by acdha »

chrisfinazzo wrote: post #23
acdha wrote: post #7

The Microsoft experience reminded me of the time when security@apple.com went to the building security office, who just quietly deleted bug reports. Poor processes amd communication is one of the worst classes of security problem.

product-security@apple.com is the real one these days. Of course, this gets me thinking, what kind of super powers do these addresses have that allows people to send potentially malicious things there to be disassembled and analyzed? I suspect they are quarantined in some way, but it would be interesting to hear from the ops sec crowd how this gets handled.

Yes – I even got a nice email from someone apologizing about that and explaining that they were trying to get the security@apple.com people to at least forward messages when I did a full disclosure release after not receiving a response.

Re: I discovered a browser bug

#33

Post by MatthewPhillips »

jaffathecake wrote: post #30
MatthewPhillips wrote: post #28

I can echo his experience reporting browser bugs and provide my own reviews: Firefox - By far the best. Quick response, usually from engineers. If it's important the fix will be quick. Edge - No reply for months / years. When I've gotten replies back it's been to ask me to try with the current version. When I do and the bug still exists it goes back at the bottom of the queue it seems. Chrome - Somewhat of a mixed ba…

Yeah that Chrome experience doesn't sound great. Fwiw I tend to put my test cases on jsbin or Glitch, but yeah, a Chrome engineer should know to put the page on a basic web server. If anyone runs into problems like this, feel free to bug one of the Chrome dev rel folks, such as me.

Like I said, my impression is that often the people replying are not engineers. Here's one with that problem: https://bugs.chromium.org/p/chromium/issues/detail?id=674096...

Re: I discovered a browser bug

#36

Post by jaffathecake »

MatthewPhillips wrote: post #33
jaffathecake wrote: post #30

Earlier quoted context omitted.

Yeah that Chrome experience doesn't sound great. Fwiw I tend to put my test cases on jsbin or Glitch, but yeah, a Chrome engineer should know to put the page on a basic web server. If anyone runs into problems like this, feel free to bug one of the Chrome dev rel folks, such as me.

Like I said, my impression is that often the people replying are not engineers. Here's one with that problem: https://bugs.chromium.org/p/chromium/issues/detail?id=674096...

Yeah, that's not great, but the commenter in #12 is a senior engineer on devtools, so at least the right person saw it in the end.

Re: I discovered a browser bug

#37

Post by krapp »

Retric wrote: post #29
krapp wrote: post #24

Earlier quoted context omitted.

What definitions of "application" and "document" are being used here? Banking websites are applications in terms of their functionality - they're certainly not documents. At least not the parts where I can access and modify my account.

Client side code including third party media players etc. IMO it's a simple question 'can you do the same thing with a sheet of printed paper.' I can fill out paper forms and hand them to someone just fine. Don't forget a Check is really just a piece of paper with a form on it.

So a spreadsheet running in the client with javascript or WASM would be an application, but a spreadsheet running on the backend wouldn't?

I'm not trying to be overly pedantic or combative here but making a distinction between client-side and server-side code seems arbitrary. I understand it in terms of managing privilege - you can't control what someone does on a remote server, and that code isn't running on your machine, but it seems like the meaningful distinction here isn't between documents and applications but between local and remote applications.

Re: I discovered a browser bug

#38

Post by hobs »

chrisfinazzo wrote: post #23
acdha wrote: post #7

The Microsoft experience reminded me of the time when security@apple.com went to the building security office, who just quietly deleted bug reports. Poor processes amd communication is one of the worst classes of security problem.

product-security@apple.com is the real one these days. Of course, this gets me thinking, what kind of super powers do these addresses have that allows people to send potentially malicious things there to be disassembled and analyzed? I suspect they are quarantined in some way, but it would be interesting to hear from the ops sec crowd how this gets handled.

Often badly, I remember Tavis O crashing Symantec's email server when sending an exploit using standard username/password combos, it unzipped it and crashed itself.

https://twitter.com/RyPeck/status/732405198644228096

Re: I discovered a browser bug

#39

Post by Avamander »

dannyw wrote: post #3

This was such a nasty bug for Edge. Visiting any page means I could now read your private Messenger messages, or your email. You could even automate resetting the password to an account, and then automatically exfiltrating the URL!

superlogout.com v2.0

Re: I discovered a browser bug

#40

Post by philipodonnell »

acdha wrote: post #32
chrisfinazzo wrote: post #23

Earlier quoted context omitted.

product-security@apple.com is the real one these days. Of course, this gets me thinking, what kind of super powers do these addresses have that allows people to send potentially malicious things there to be disassembled and analyzed? I suspect they are quarantined in some way, but it would be interesting to hear from the ops sec crowd how this gets handled.

Yes – I even got a nice email from someone apologizing about that and explaining that they were trying to get the security@apple.com people to at least forward messages when I did a full disclosure release after not receiving a response.

> they were trying to get the security@apple.com people to at least forward messages when I did a full disclosure release after not receiving a response

That sounds a bit dysfunctional on Apple's part that they can't exert that kind of control over their own employees for an issue with potentially enormously negative consequences.

Post reply on HN