Earlier quoted context omitted.
?
did I stutter, nerd?
When did being a nerd become unfashionable again?
Actively exploited sandbox RCE in all Chromium versions
521–524 of 524 posts
Re: Actively exploited sandbox RCE in all Chromium versions
#522Earlier quoted context omitted.
I think the problem is that we've let JS engines become absurdly complex so there's no way to avoid them having really gross bugs. That said, I think that the V8 team has done a fantastic job of securing their engine. Their heap sandbox feature is really inspiring! It's really wild that (as far as I can understand this issue) someone is able to bypass it. (Posted from a memory safe browser - WebKit MiniBrowser compil…
When Chromium and V8 are written in a memory-safe language then I might believe this. Yes, if your JavaScript engine is written in C++, it’s going to be very hard to avoid very gross bugs. We have better options now. The ability of adversaries to find and exploit very gross bugs in C++ codebases should have already compelled the industry to move to memory safety. Now that AI has democratized the ability to scour C++…
I believe programmers still write in C(++) after memory safe options, in order to continue being occupied afterwards, fixing the bugs that will arise. Without criminals, police is obsolete.
Re: Actively exploited sandbox RCE in all Chromium versions
#523> Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) What's the difference between "executing arbitrary code inside the sandbox via a crafted HTML page" and running whatever is in the tag?
In the script tag you only have access to JS. This allows you to escape JS and have native code execution. It is still sandboxed by os-level primitives, but it is an escalation/first step in successful exploitation.
I see, so there are certain things that arbitrary native code could try do (let's say, try to execute a certain syscall) that native code produced by the JIT compiler wouldn't normally be able to attempt?
Re: Actively exploited sandbox RCE in all Chromium versions
#524Earlier quoted context omitted.
Google is routinely buying and destroying competitors. They lower prices to kill competition en-masse. They promote their own products in search and elsewhere over paid ads. Search Engine have chicken and egg problem, you can only have a good search if enough people use it to tune the ranking and see enough search spam cases. “Just compete with a monopoly on their own field with one hand tied behind”
Every Google competitor has the problem that 40% of users won't load ads and 99% won't pay a subscription. They don't need to do anything adversarial, the greed driven mindset of the internet (ads suck, everything should be free) staves off any real competition.
That 40 percent is definitely not true in the general audience. Also they will load ads, just not all of them. Surveys ask that. Especially on mobile, and apps. Also, when we measured on our car rental site, with near perfect precision (it's absolutely not difficult), then the number was around 20%. Also, according to download statistics, there are less than half a billion people who use ad blocking browsers or other solutions on Android. And that's downloads, which is obviously inflated, even obvious from browser statistics (no not 100% of Firefox users are on Android, it's almost the opposite).
It's not nothing, but it's probably around 20%.
Also as others stated. I pay for everything, if they give me the opportunity to pay them for ad free versions. I don't see ads on my Android, and I don't use a general ad blocker on it (except my browser, but I rarely visit sites which would contain ads, and basically all of them from Hacker News). I don't use free search, email, newspapers, I pay for YouTube, and I would pay for Facebook if I would use it. I don't even use Hacker News freely, because I paid for the app which I use to not see ads, and have more features. Heck, I pay even for my torrent, because I support them.
You're in the wrong neighborhood with this sentiment. But yes, the general populace is not like this.