Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla fixes Firefox zero-day actively exploited in attacks

bleepingcomputer.com

Post reply on HN
Print view View original

41–50 of 151 posts

Re: Mozilla fixes Firefox zero-day actively exploited in attacks

#41

Post by high_na_euv »

SoothingSorbet wrote: post #20
high_na_euv wrote: post #11

We need a browser written in managed lang Even if it means some perf drop, modern hardware will get it back in X years, but safety will be significantly improved

Why managed when it could be in Rust and have both performance and safety? The Servo shouldn't have ever been laid off. Yes, I'm aware a team is working on it now, but it isn't up to the same speed and enthusiasm as it was when funded by Mozilla, is it?

Im aware of Rust, but there is C#/Java too, with way bigger ecosystem, community and lower entry level.

At the end of the day web browser is just bunch of parsers and compilers working together, and some video/audio

Re: Mozilla fixes Firefox zero-day actively exploited in attacks

#42

Post by moffkalast »

high_na_euv wrote: post #11

We need a browser written in managed lang Even if it means some perf drop, modern hardware will get it back in X years, but safety will be significantly improved

> if it means some perf drop, modern hardware will get it back in X years

I think the unfortunate reality is that other browsers will also take advantage of that speed boost, sites will get even more bloated because they can and it will stay unusable for a long long time.

Re: Mozilla fixes Firefox zero-day actively exploited in attacks

#43

Post by heresie-dabord »

high_na_euv wrote: post #11

We need a browser written in managed lang Even if it means some perf drop, modern hardware will get it back in X years, but safety will be significantly improved

From the fine article:

> Throughout 2024, so far, Mozilla had to fix zero-day vulnerabilities on Firefox only once.

> On March 22, the internet company released security updates to address CVE-2024-29943 and CVE-2024-29944, both critical-severity issues

Vulnerabilities will be found in everything. Firefox is a fully internationalised application and it is FOSS. The team responsible for Firefox is doing a good job.

Re: Mozilla fixes Firefox zero-day actively exploited in attacks

#44

Post by nullc »

fransje26 wrote: post #37
nullc wrote: post #35

Regain your ability to sleep at night: https://www.qubes-os.org/

From your experience, what are the system requirements needed to use that as comfortably as your daily driver?

They're increased, and some things are just obviously slow at least without extra effort to setup things like gpu pass-through. But is it worth basically turning back the clock on your computer's performance a few years to live in a world where a random click from HN or reddit can't quietly compromise your entire computer? I think so.

Probably the biggest thing is to have a lot of ram, because if you're really using the virtualization it's a bit ram inefficient.

Many things I expected to be hard or annoying just turn out to be non-issues. Qubes has lots of good automation to make it pretty seamless to use multiple VMs.

I was already a fedora user, so I just copied my old home into a new app vm and was instantly productive. Then over time I weaned myself off the monolithic legacy vm into partitioned VMs.

Re: Mozilla fixes Firefox zero-day actively exploited in attacks

#45

Post by sph »

psychoslave wrote: post #40
ftrobro wrote: post #28

Earlier quoted context omitted.

Rust was created at Mozilla and currently 11.7% of the Firefox source code is in Rust: https://4e6.github.io/firefox-lang-stats/ That's down from 12.49% at the peak in July 2020 so I assume the conversion work was halted after the layoffs in 2020: https://docs.google.com/spreadsheets/d/1flUGg6Ut4bjtyWdyH_9e...

But the CEO got it’s pay raise, so we are safe. https://techrights.org/o/2022/02/17/mozilla-salaries/ https://www.reddit.com/r/browsers/comments/yy986k/can_someon... https://news.ycombinator.com/item?id=38849580

What's that got to do with anything? The CEO situation is awful, but this is just flame bait on your part.

Re: Mozilla fixes Firefox zero-day actively exploited in attacks

#47

Post by hypeatei »

mikae1 wrote: post #26
high_na_euv wrote: post #11

We need a browser written in managed lang Even if it means some perf drop, modern hardware will get it back in X years, but safety will be significantly improved

Ladybird[1] is switching to Swift[2]. [1] https://ladybird.org [2] https://news.ycombinator.com/item?id=41208836

That's not completely accurate. The plan is to use Swift for "security critical" areas like decoding data. It's unlikely core components like the layout/CSS engine will be converted to Swift.

Re: Mozilla fixes Firefox zero-day actively exploited in attacks

#50

Post by mrob »

btdmaster wrote: post #34
statusfailed wrote: post #2

Seems bad. "An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild." See: - NVD page for CVE-2024-9680: https://nvd.nist.gov/vuln/detail/CVE-2024-9680 - Mozilla security advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2024-5...

Ticket in Tor Browser: https://gitlab.torproject.org/tpo/applications/tor-browser/-... It seems to be JavaScript-free from the description, which makes it even scarier. Imagine the libwebp decoder bug except embedded media blocking doesn't really work (who blocks CSS?).

I block CSS animations:

https://news.ycombinator.com/item?id=33223080

I'd be interested to know if it's sufficient to avoid this recent vulnerability. Either way, it confirms my opinion that UI animations are an anti-feature.

Post reply on HN