Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla fixes Firefox zero-day actively exploited in attacks

bleepingcomputer.com

Post reply on HN
Print view View original

81–90 of 151 posts

Re: Mozilla fixes Firefox zero-day actively exploited in attacks

#81

Post by schiffern »

mrob wrote: post #50
btdmaster wrote: post #34

Earlier quoted context omitted.

Ticket in Tor Browser: https://gitlab.torproject.org/tpo/applications/tor-browser/-... It seems to be JavaScript-free from the description, which makes it even scarier. Imagine the libwebp decoder bug except embedded media blocking doesn't really work (who blocks CSS?).

I block CSS animations: https://news.ycombinator.com/item?id=33223080 I'd be interested to know if it's sufficient to avoid this recent vulnerability. Either way, it confirms my opinion that UI animations are an anti-feature.

As a uBlock Origin filter (paste in Settings > My Filters):

  ! No CSS animations
  ##*,::before,::after:style(transition:none !important;animation-delay:0ms !important;animation-duration:0ms !important)
  
  ! No CSS animations (different method)
  ##*,::before,::after:style(animation-timing-function:step-start !important;transition-timing-function:step-start !important)
There's other (often perf heavy) CSS clutter that's nice to get rid of:

  ! No image filters
  ##*,::before,::after:style(filter:none !important)
  
  ! No text-shadow
  ##*,::before,::after:style(text-shadow:none !important)
  
  ! No box-shadow
  ##*,::before,::after:style(box-shadow:none !important)

  ! No rounded corners
  ##*,::before,::after:style(border-radius:0px !important)
No rounded corners is fun. You realize many loading spinners are actually CSS rounded corners! Youtube becomes almost unrecognizable — mercifully — especially if you also revert the new TikTok-inspired font:

  ! Un-bold Youtube
  youtube.com##*:style(font-weight:400 !important)

Re: Mozilla fixes Firefox zero-day actively exploited in attacks

#82

Post by acidburnNSA »

palata wrote: post #56

> The vulnerability impacts the latest Firefox (standard release) and the extended support releases (ESR). Does that mean it impacts Firefox 131.0.+, Firefox ESR 115.16.+ and Firefox ESR 128.3.+? I.e. Firefox 130.0.+ or Firefox ESR 114.+.+ are fine? It's not clear to me when the vulnerability was introduced...

Got my update on Ubuntu this morning, but not seeing any updates for Firefox Android in Google Play yet.

Re: Mozilla fixes Firefox zero-day actively exploited in attacks

#83

Post by Yoric »

sph wrote: post #48
Yoric wrote: post #36

Earlier quoted context omitted.

And OCaml or Haskell :)

Why go fancy? Even Python saves you from use-after-free.

Come on, I had to outbid Ada somehow :)

For what it's worth, Python was also considered at some point for use in the Firefox codebase. I don't remember the rationale for not adopting it, but I think the idea was "we all like Python, but we already have one messy language (JavaScript), let's not make it two".

Re: Mozilla fixes Firefox zero-day actively exploited in attacks

#85

Post by jokoon »

loopdoend wrote: post #7

Fixed many months ago just being made public now, according to the bug tracker. Why a 7 month delay?

Because if you make it public too early, it gives some time for attackers to write exploit to target unpatched versions.

Firefox is used in other projects, so the patch needs to spread, and time is needed.

Re: Mozilla fixes Firefox zero-day actively exploited in attacks

#87

Post by Ygg2 »

high_na_euv wrote: post #61
Ygg2 wrote: post #53

Earlier quoted context omitted.

> At the end of the day web browser is just bunch of parsers and compilers working together At the end of the day, OS is just a bunch of command lines being piped together. /sarcasm Sure, you are just missing: rendering, layout, security, network traffic for sockets, low-level control over hardware, writing a decent enough VM, image processing, video playback, music playback, compression, decompression, self-update,…

Why would you need to reinvent networking layer instead of just sending http requests via matrue, battle tested lib available in your programming ecosystem e.g from MSFT? Same with crypto, sockets, compression, etc? Video and audio I mentioned. Extensions are tricky, right, but more from privacy standpoint cuz after all you can just expose too much

> Why would you need to reinvent networking layer instead of just sending http requests via matrue, battle tested lib available in your programming ecosystem e.g from MSFT?

Because modern browsers are essentially cross-compatible OSes.

Re: Mozilla fixes Firefox zero-day actively exploited in attacks

#88

Post by jokoon »

I wonder how many skilled black hats work for Iran, China or Russia.

And I can imagine that those countries use front companies to buy exploit.

I just hope that those blackhats understand that their discovery might land in the wrong hands.

I guess those blackhats don't like authoritarian regimes.

Re: Mozilla fixes Firefox zero-day actively exploited in attacks

#89

Post by joha4270 »

guerrilla wrote: post #80
dspillett wrote: post #79

Earlier quoted context omitted.

It doesn't update actively running application containers. You don't actually need to stop it before running “snap refresh” though, it'll just be out of date as long as it is kept open. Once the application stops running, next time it is run the updated image will be used. [caveat: I'm not a snap user myself currently, so my information may be inaccurate, take with a pinch of your favourite condiment]

Interesting. On Arch, Firefox just refuses to keep working after I've updated and requests me to restart it.

Now, I don't know how your setup looks like, but I don't think anything is distributed as snaps by default on Arch. At least AFAIK its mostly an Ubuntu & derivatives thing.

Re: Mozilla fixes Firefox zero-day actively exploited in attacks

#90

Post by michaelt »

high_na_euv wrote: post #61
Ygg2 wrote: post #53

Earlier quoted context omitted.

> At the end of the day web browser is just bunch of parsers and compilers working together At the end of the day, OS is just a bunch of command lines being piped together. /sarcasm Sure, you are just missing: rendering, layout, security, network traffic for sockets, low-level control over hardware, writing a decent enough VM, image processing, video playback, music playback, compression, decompression, self-update,…

Why would you need to reinvent networking layer instead of just sending http requests via matrue, battle tested lib available in your programming ecosystem e.g from MSFT? Same with crypto, sockets, compression, etc? Video and audio I mentioned. Extensions are tricky, right, but more from privacy standpoint cuz after all you can just expose too much

All the major browsers came out when Windows XP had substantial market share.

So browser vendors couldn't rely on the platform to provide up-to-date SSL support. Or MP3 support. Or MPEG-4 support. Or PDF support. This established the norm that browsers would ship their own video support, their own SSL support, and so on.

And Google realised they like the power this gives them - if Google wants to replace HTTP with QUIC or introduce a new video DRM standard, or a new video codec like VP9 - they don't need the cooperation of anyone outside of Google.

If Chrome bundles DRM support (allowing it to play Netflix), and its own HTTP/2 stack for speed - are you going to release a browser that's slower and doesn't play Netflix? Doesn't sound like a recipe for big market share.

Post reply on HN