Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla fixes Firefox zero-day actively exploited in attacks

bleepingcomputer.com

Post reply on HN
Print view View original

61–70 of 151 posts

Re: Mozilla fixes Firefox zero-day actively exploited in attacks

#61

Post by high_na_euv »

Ygg2 wrote: post #53
high_na_euv wrote: post #41

Earlier quoted context omitted.

Im aware of Rust, but there is C#/Java too, with way bigger ecosystem, community and lower entry level. At the end of the day web browser is just bunch of parsers and compilers working together, and some video/audio

> At the end of the day web browser is just bunch of parsers and compilers working together At the end of the day, OS is just a bunch of command lines being piped together. /sarcasm Sure, you are just missing: rendering, layout, security, network traffic for sockets, low-level control over hardware, writing a decent enough VM, image processing, video playback, music playback, compression, decompression, self-update,…

Why would you need to reinvent networking layer instead of just sending http requests via matrue, battle tested lib available in your programming ecosystem e.g from MSFT? Same with crypto, sockets, compression, etc?

Video and audio I mentioned.

Extensions are tricky, right, but more from privacy standpoint cuz after all you can just expose too much

Re: Mozilla fixes Firefox zero-day actively exploited in attacks

#62

Post by olejorgenb »

palata wrote: post #56

> The vulnerability impacts the latest Firefox (standard release) and the extended support releases (ESR). Does that mean it impacts Firefox 131.0.+, Firefox ESR 115.16.+ and Firefox ESR 128.3.+? I.e. Firefox 130.0.+ or Firefox ESR 114.+.+ are fine? It's not clear to me when the vulnerability was introduced...

> This vulnerability affects Firefox https://nvd.nist.gov/vuln/detail/CVE-2024-9680

Re: Mozilla fixes Firefox zero-day actively exploited in attacks

#63

Post by krageon »

fransje26 wrote: post #37
nullc wrote: post #35

Regain your ability to sleep at night: https://www.qubes-os.org/

From your experience, what are the system requirements needed to use that as comfortably as your daily driver?

If you anything with a GPU anywhere, you can essentially forget it. Or at least this was the case a few years ago when I briefly toyed with using qubes seriously.

Re: Mozilla fixes Firefox zero-day actively exploited in attacks

#64

Post by [deleted] »

mrob wrote: post #50
btdmaster wrote: post #34

Earlier quoted context omitted.

Ticket in Tor Browser: https://gitlab.torproject.org/tpo/applications/tor-browser/-... It seems to be JavaScript-free from the description, which makes it even scarier. Imagine the libwebp decoder bug except embedded media blocking doesn't really work (who blocks CSS?).

I block CSS animations: https://news.ycombinator.com/item?id=33223080 I'd be interested to know if it's sufficient to avoid this recent vulnerability. Either way, it confirms my opinion that UI animations are an anti-feature.

[deleted]

Re: Mozilla fixes Firefox zero-day actively exploited in attacks

#65

Post by krageon »

creata wrote: post #46
nullc wrote: post #35

Regain your ability to sleep at night: https://www.qubes-os.org/

Does virtualization have that big a security benefit over containers? It's certainly a lot more expensive.

Containers aren't a security measure, so you'd be comparing a stick of wood to a car in this case.

Re: Mozilla fixes Firefox zero-day actively exploited in attacks

#66

Post by aryonoco »

high_na_euv wrote: post #38
Ygg2 wrote: post #29

Earlier quoted context omitted.

Sounds like Mozilla should invent a low level language with great safety guarantees, maybe even call it after some form of oxidation process[1]. Then make a browser engine called after a motor[2], and then NOT axe the team responsible for it[3]. I think the last part might be crucial. [1] https://www.rust-lang.org/ [2] https://servo.org/ [3] https://paulrouget.com/bye_mozilla.html

Im aware of Rust, but there is C#/Java too, with way bigger ecosystem, community and lower entry level

I think of browsers these days on par with OSes. I mean, they provide a runtime to execute binary code (wasm). They do process management and scheduling. They do a lot of things which up until 15 years ago, we thought bongs to the realm of Operating Systems.

And history has shown that when you need to do that kind of low level code, it's nigh on impossible to achieve acceptable results with a garbage collected language. Many people tried, none really succeeded.

Hence why Rust was made

Re: Mozilla fixes Firefox zero-day actively exploited in attacks

#68

Post by m4rtink »

high_na_euv wrote: post #38
Ygg2 wrote: post #29

Earlier quoted context omitted.

Sounds like Mozilla should invent a low level language with great safety guarantees, maybe even call it after some form of oxidation process[1]. Then make a browser engine called after a motor[2], and then NOT axe the team responsible for it[3]. I think the last part might be crucial. [1] https://www.rust-lang.org/ [2] https://servo.org/ [3] https://paulrouget.com/bye_mozilla.html

Im aware of Rust, but there is C#/Java too, with way bigger ecosystem, community and lower entry level

It seems to me that both C#/Java have build their own niches and are hard to impossible to realistically use outside of them, such as to write a web browser.

Re: Mozilla fixes Firefox zero-day actively exploited in attacks

#69

Post by Malidir »

high_na_euv wrote: post #41
SoothingSorbet wrote: post #20

Earlier quoted context omitted.

Why managed when it could be in Rust and have both performance and safety? The Servo shouldn't have ever been laid off. Yes, I'm aware a team is working on it now, but it isn't up to the same speed and enthusiasm as it was when funded by Mozilla, is it?

Im aware of Rust, but there is C#/Java too, with way bigger ecosystem, community and lower entry level. At the end of the day web browser is just bunch of parsers and compilers working together, and some video/audio

Microsoft are re-writing c# stuff in Rust! https://news.ycombinator.com/item?id=39240205

Re: Mozilla fixes Firefox zero-day actively exploited in attacks

#70

Post by guerrilla »

NicolaiS wrote: post #67

A note for Ubuntu users; if Firefox is installed using `snap` (default) and you run `snap refresh` it will output "All snaps up to date" - but this is not true! You have to close firefox, then run `snap refresh` for snap to upgrade firefox...

Not an Ubunutu or snap user but curious, why?
Post reply on HN