Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Angular 1.x Banned from Firefox Addons

github.com

Post reply on HN
Print view View original

51–60 of 222 posts

Re: Angular 1.x Banned from Firefox Addons

#51

Post by sidcool »

pestaa wrote: post #10
TD-Linux wrote: post #9

Earlier quoted context omitted.

It is possible that the researcher also secretly shared the results with Google, but then nothing happened?

As claimed in the comments, Angular 1 is now community driven instead of officially supported by Google.

Not true. Google has diverged development of Angular 1 and 2. Angular 1 was initially developed with designers in mind, but it caught on with developers. They developed Angular 2 with developers in mind. Angular 2 is different from 1 in many respects. I don't see Google dropping Angular 1 support anytime soon.

Re: Angular 1.x Banned from Firefox Addons

#52

Post by AgentME »

phs2501 wrote: post #6

So someone found some sort of vulnerability in Angular 1, told Mozilla about it, but told them not to tell the Angular team? What is going on here?

The vulnerability specifically has to do with Angular being used in extensions where the extension has more privileges than the webpage it's affecting. Judging by http://www.slideshare.net/x00mario/an-abusive-relationship-w..., the issue has to do with a general design feature of Angular: it runs eval-like functions on text within the page DOM. Angular simply isn't built for the page DOM is controlled by an attacker (ie. Angular is running in a higher-privilege extension, and the webpage controls the DOM and wants to inject code into the higher-privilege extension). Angular has band-aids over a few specific ways that this can be taken advantage of, but it's extremely difficult to make bullet-proof (as blacklisting strategies often are) and it's not an issue that affects regular non-extension web pages.

Re: Angular 1.x Banned from Firefox Addons

#53

Post by water42 »

lucb1e wrote: post #46
water42 wrote: post #35

Earlier quoted context omitted.

I'd agree if I actually framed it as a legitimate theory. But I didn't.

What do you mean by claiming to not have framed it as a legitimate theory; you're saying it's an illegitimate theory, as in, you yourself don't believe it's true?

See https://news.ycombinator.com/item?id=12754526

It was hyperbole. I personally think that the language is clear too. Here's a good post explaining the usage of the phrase "For all I know" since apparently HN isn't familiar with the idiom https://english.stackexchange.com/questions/92207/what-is-th...

Re: Angular 1.x Banned from Firefox Addons

#54

Post by vonklaus »

smrtinsert wrote: post #2

> My information is that Google stopped supporting angular 1.x months ago. It is now a community driven project. I totally missed this - was there a notice of this posted somewhere?

based on that statement and others my read is basically:

We know a lot of important people and they gave us information you don't have, to which we have made business decisions that affect you that we didn't communicate. Did we tell you? no. Now that you know, are we going to elaborate? nope. trust us, our people on the inside will be proven correct soon enough, so you can thank us later.

Re: Angular 1.x Banned from Firefox Addons

#55

Post by nchelluri »

vosper wrote: post #49
nchelluri wrote: post #29

Earlier quoted context omitted.

I can't help but think that he's right though. Not explicitly but implicitly. By keeping the vulnerability from the dev team they're allowing it to stay out in the wild. No? Edit: It may be that this is only an issue inside of Firefox extensions (addons). In which case, maybe the point is moot. See: https://github.com/mozilla/addons-linter/blob/master/docs/th...

There's a world of difference between an exploit being known to someone and that exploit being put up for sale on the black market. In either case, if the researcher who found the exploit sold it, that hardly makes Mozilla complicit in his actions.

I am not sure that I agree. It's hard for me to say where the responsibility for disclosure lies, but if I was Mozilla I'd need to find a good reason not to disclose such a vulnerability to the project owner/development team.

I am not sure that being asked not to disclose is a good enough reason without further justification; in fact it seems like a poor reason to me. Mozilla is in my view kind of a shepherd for internet users and I'd hope they'd fall more on the side of "let's not let our users get owned unnecessarily" than that of "let's sit on this vulnerability just because the disclosing party asked us to."

Re: Angular 1.x Banned from Firefox Addons

#56

Post by wnevets »

sgc wrote: post #48
mlent wrote: post #14

Earlier quoted context omitted.

Was recently at an angular conference -- they said they would continue to support it until the _majority_ of the community had made the switch. That's so far from happening, I imagine they'll be supporting it for years.

At least until they get tired and change their minds, which may not take that long.

while could be true, its probably not currently the case.

Re: Angular 1.x Banned from Firefox Addons

#58

Post by secmax »

nathancahill wrote: post #45
Gigablah wrote: post #31

Earlier quoted context omitted.

In other words, the vulnerability is with Firefox instead of Angular?

Not necessarily. JS in addons has to run in a more privileged environment to interact with the browser. However, that makes it possible to write insecure addons. In this case, Angular 1.x might contain the insecure code. For example: arbitrary user input from a web page is passed to the addon. Angular handles it, and does "eval-like things"[0] with it. Now the attacker is running arbitrary code in a privileged enviro…

So a vulnerability of this kind would not only affect Firefox but also Chrome and others?

Re: Angular 1.x Banned from Firefox Addons

#59

Post by moron4hire »

Jare wrote: post #47
moron4hire wrote: post #33

Earlier quoted context omitted.

I read that and said a literal WTF. How is it at all acceptable to honor such a request? What possible good reason could there be? Unless the discloser was the US Government and the request was actually a court order. But this seems ludicrous. If they require secrecy around the exploit, they wouldn't have disclosed it to Mozilla at all.

Mozilla is probably unable to disclose not just the vulnerability, but other surrounding info they may have been provided, including which other parties have received that info. They are not saying the Angular team is unaware of the problem, right? Only that they themselves are not the ones reporting it. If you don't honor such request without a VERY STRONG reason, nobody in their right mind will ever disclose anythi…

"They are not saying the Angular team is unaware of the problem, right?"

Are we just going to assume the folks at Mozilla are clairvoyants? How would they know what the Angular team knows? If it's known in general that the Angular team knows about this issue already, perhaps through other means, then the statement that they haven't disclosed this to the Angular team makes no sense. The statement is, "Mozilla is choosing to do it's part to keep Angular in the dark about this."

Re: Angular 1.x Banned from Firefox Addons

#60

Post by DannyBee »

So, there's so many problems with this i don't know where to begin. Since folks have already noted the "not notifying google" issue, let me point out another:

Prior to banning, i can find literally no discussion or details about this being about to happen (IE no notice), pretty much ever.

You can see it was initially noted here: https://github.com/mozilla/addons-linter/commit/86f4dfb44355...

I can find no discussion around it (maybe it's there but i'm missing it? I looked in a lot of places).

You can see it fixed an issue to "warn third party developers of things we banned/don't advise", but there's nothing about initially banning anything there, and it was added with an initial ban list containing angular. I would have expected a page added, then a ban discussed, then a ban added. or something.

In fact, the details of the ban changed (https://github.com/mozilla/addons-linter/commit/2dcc2226e2ec...) repeatedly without notice either.

This seems really bad. I would have expected, at the very least, a heads up to extension developers or something or even a more public notice when it happened so that some discussion could be had about it.

Instead, it looks like the only way you would have found out about it is by trying to lint an extension and see it banned (IE after you developed it), or somehow random browsing of doc pages mozilla has.

Post reply on HN