Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla fixes Firefox zero-day actively exploited in attacks

bleepingcomputer.com

Post reply on HN
Print view View original

31–40 of 151 posts

Re: Mozilla fixes Firefox zero-day actively exploited in attacks

#31

Post by fulafel »

flohofwoe wrote: post #27
fulafel wrote: post #25

Earlier quoted context omitted.

They already are partly in JS so there's a smooth path. (Wasm isn't safe but could be a building block too)

I can't find the link right now but I seem to remember that Firefox already replaced some internal native subsystems with the same code compiled to WASM - or maybe even compiled to WASM and then translated back to C, which basically adds a runtime memory safety layer to unsafe C code at the cost of some performance (I think it was a couple of media codecs, but not sure). Not sure why you think that WASM is less secur…

If your browser is running in a wasm sandbox, it's a minor comfort that only your browser gets compromised which contains all your creds, etc.

Re: Mozilla fixes Firefox zero-day actively exploited in attacks

#32

Post by flohofwoe »

fulafel wrote: post #31
flohofwoe wrote: post #27

Earlier quoted context omitted.

I can't find the link right now but I seem to remember that Firefox already replaced some internal native subsystems with the same code compiled to WASM - or maybe even compiled to WASM and then translated back to C, which basically adds a runtime memory safety layer to unsafe C code at the cost of some performance (I think it was a couple of media codecs, but not sure). Not sure why you think that WASM is less secur…

If your browser is running in a wasm sandbox, it's a minor comfort that only your browser gets compromised which contains all your creds, etc.

Only parts of the browser are running in multiple small isolated WASM sandboxes, those WASM sandboxes are isolated from outside world about as well as if they would run in their own process.

Re: Mozilla fixes Firefox zero-day actively exploited in attacks

#33

Post by fulafel »

flohofwoe wrote: post #32
fulafel wrote: post #31

Earlier quoted context omitted.

If your browser is running in a wasm sandbox, it's a minor comfort that only your browser gets compromised which contains all your creds, etc.

Only parts of the browser are running in multiple small isolated WASM sandboxes, those WASM sandboxes are isolated from outside world about as well as if they would run in their own process.

Compartments of internally unsafe sandboxes are what we have now, with browsers employing native-code sandboxes and isolated renderer processes etc. It gets leaky.

Re: Mozilla fixes Firefox zero-day actively exploited in attacks

#34

Post by btdmaster »

statusfailed wrote: post #2

Seems bad. "An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild." See: - NVD page for CVE-2024-9680: https://nvd.nist.gov/vuln/detail/CVE-2024-9680 - Mozilla security advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2024-5...

Ticket in Tor Browser: https://gitlab.torproject.org/tpo/applications/tor-browser/-...

It seems to be JavaScript-free from the description, which makes it even scarier. Imagine the libwebp decoder bug except embedded media blocking doesn't really work (who blocks CSS?).

Re: Mozilla fixes Firefox zero-day actively exploited in attacks

#38

Post by high_na_euv »

Ygg2 wrote: post #29
high_na_euv wrote: post #11

We need a browser written in managed lang Even if it means some perf drop, modern hardware will get it back in X years, but safety will be significantly improved

Sounds like Mozilla should invent a low level language with great safety guarantees, maybe even call it after some form of oxidation process[1]. Then make a browser engine called after a motor[2], and then NOT axe the team responsible for it[3]. I think the last part might be crucial. [1] https://www.rust-lang.org/ [2] https://servo.org/ [3] https://paulrouget.com/bye_mozilla.html

Im aware of Rust, but there is C#/Java too, with way bigger ecosystem, community and lower entry level

Re: Mozilla fixes Firefox zero-day actively exploited in attacks

#39

Post by actualwitch »

mikae1 wrote: post #26
high_na_euv wrote: post #11

We need a browser written in managed lang Even if it means some perf drop, modern hardware will get it back in X years, but safety will be significantly improved

Ladybird[1] is switching to Swift[2]. [1] https://ladybird.org [2] https://news.ycombinator.com/item?id=41208836

Swift didn't save apple from rce's in blastdoor.

Re: Mozilla fixes Firefox zero-day actively exploited in attacks

#40

Post by psychoslave »

ftrobro wrote: post #28
high_na_euv wrote: post #11

We need a browser written in managed lang Even if it means some perf drop, modern hardware will get it back in X years, but safety will be significantly improved

Rust was created at Mozilla and currently 11.7% of the Firefox source code is in Rust: https://4e6.github.io/firefox-lang-stats/ That's down from 12.49% at the peak in July 2020 so I assume the conversion work was halted after the layoffs in 2020: https://docs.google.com/spreadsheets/d/1flUGg6Ut4bjtyWdyH_9e...

But the CEO got it’s pay raise, so we are safe.

https://techrights.org/o/2022/02/17/mozilla-salaries/

https://www.reddit.com/r/browsers/comments/yy986k/can_someon...

https://news.ycombinator.com/item?id=38849580

Post reply on HN