Slashdot Log In
Hackers claim zero-day flaw in Firefox
Posted by
CmdrTaco
on Sun Oct 01, 2006 09:32 AM
An anonymous reader writes "The open-source Firefox Web browser is critically flawed in the way it handles JavaScript, two hackers said Saturday afternoon. An attacker could commandeer a computer running the browser simply by crafting a Web page that contains some malicious JavaScript code, Mischa Spiegelmock and Andrew Wbeelsoi said in a presentation at the ToorCon hacker conference here."
Related Stories
[+]
Firefox Zero-Day Code Execution Hoax? 215 comments
Akon writes, "eWeek is running a follow-up story on the claim by two hackers that Firefox's implementation of JavaScript is critically flawed and could result in code-execution attacks. Turns out this is a possible hoax that was overblown for laughs." Mozilla's engineers say the risk is limited to a denial-of-service issue. From the article: "'As part of our talk we mentioned that there was a previously known Firefox vulnerability that could result in a stack overflow ending up in remote code execution. However, the code we presented did not in fact do this, and I personally have not gotten it to result in code execution, nor do I know of anyone who has... I have not succeeded in making this code do anything more than cause a crash and eat up system resources, and I certainly haven't used it to take over anyone else's computer and execute arbitrary code,' Spiegelmock said." Spiegelmock also stated that the claim that there were 30 other undisclosed exploits was made solely by his co-presenter, Andrew Wbeelsoi.
This discussion has been archived.
No new comments can be posted.
Hackers claim zero-day flaw in Firefox
|
Log In/Create an Account
| Top
| 398 comments
| Search Discussion
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Proof? (Score:1, Insightful)
Re:Proof? (Score:5, Insightful)
(http://www.bcgreen.com/~samuel | Last Journal: Saturday April 15 2006, @12:27PM)
The only difference between a zero-day exploit and a normal exploit is whether the person who finds the exploit allows a fix to be crafted before (s)he releases the bug that allows it.
The main difference between Open Source groups like Mozilla and Microsoft is that (responsible) open source projects will fix potential security bugs whenever they're informed of them and whether or not there is an exploit available, while Microsoft seems to have a habit of holding off on fixing a bug unless the exploit is blatently obvious and/or there is an proof of concept exploit already in existence (and sometimes even in the wild).
Given the way that these guys are touting how Firefox is vulnerable because they were able to find a bug that they refused to warn the firefox team about (like that refusal is Firefox's fault) I wouldn't be at all surprised to find that they managed to get some funding (either direct or indirect) from Microsoftl.
you are deluded (Score:5, Insightful)
(http://retropolitan.blogspot.com/ | Last Journal: Tuesday October 09, @04:27PM)
complete bullshit and FUD.
you know nothing about these ppl, they are blackhats, they ruin things for no other reason than to piss ppl off and have a laugh at their expense.
Re:you are deluded (Score:5, Insightful)
This is why good security is done in layers. If your sole defense against having your user account, your root account, and possibly even your identity owned by some script kiddie is to depend on the maintainers of $PROGRAM to patch all exploitable flaws in a timely manner, this is what you call putting all of your eggs into one basket. For this, there are things like the Gentoo Hardened Project [gentoo.org], which ensure that a mere buffer overflow alone will not grant someone access to your system (of course this is not Gentoo-specific; Gentoo has merely organized such things as PaX and Grsecurity and the toolchain in such a way that it is a relatively simple matter to use the Hardened profile). In my opinion, you're crazy not to take some kind of extra measures like this, if you are going to use a potentially hostile network on a daily basis.
Ideally, the good people who maintain Firefox can stay on top of the arms race to improve the browser's security as fast as flaws can be found. But the odds are against them -- in order to succeed, they have to find every possible security flaw; the blackhats only need to find the one thing that they missed to have a workable exploit. If you don't like being exploited, then this situation is not good. There is no such thing as absolute security, and no programmer is perfect, but precisely because programmers make mistakes, there are non-executable stacks, random memory addresses, user-space SSP protections, chroot() jail restrictions, and many other measures one can take to ensure that security does not have a single point of failure.
Re:Proof? (Score:5, Insightful)
Re:Proof? (Score:5, Informative)
(http://trolltalk.com/ | Last Journal: Sunday November 11, @05:38PM)
No, they didn't have a live exploit. The original article is here http://news.zdnet.com/2100-1009_22-6121608.html [zdnet.com], not the site linked to by slashdot.
All they had was a video ... no code to display.
So, maybe they do, maybe they don't ... but you can't tell just from a video.
Also, what sort of drugs do you have to be on to name your kid "Window"? Brings to mind Frank Zappa naming his kid "Moon Unit".
Re:Proof? (Score:5, Insightful)
(http://jlarocco.com/)
Welcome to real life. Firefox is getting large enough to be a target. And when a piece of software is a target, people aren't going to just file a bug report when they find an exploitable bug. Look at Windows/IE. Every time you hear about a new exploit on Windows/IE, it's because it's being exploited. It'd be nice if they filed a bug report first, but you definitely can't expect it. They're black hats for a reason, you know.
That is the most ridiculous thing I've heard all week. Black hat hackers release exploits all the time without warning the software's creator. The fact you think Microsoft is involoved says a lot more about you being a Firefox Fanboy than anything else. Get a clue.
Moo (Score:5, Funny)
(http://tkatch.com/ | Last Journal: Monday October 29, @02:09PM)
The hackers plan to release the next version of the hack under the name IceWeasel Hack, while grumbling about backports. Debian developers have been debating whether they should include the hack in Etch or not.
Re:Oink (Score:5, Funny)
The real storry (Score:4, Informative)
(http://augustz.com/)
Firefox had a build switch that allowed folks to build it without branding (and do whatever they wanted to it) or build it with branding (and follow Mozilla's rules to create a consistent user experience).
Debain dev's took that build switch and broke it, so that everyone wanting to modify or adjust the debian firefox packages would have to go through and hand edit out firefox if they wanted to remove branding. They then packaged this broken thing up, and still called it firefox.
Mozilla said that was bogus, and they were right. Having that build switch makes it easier for folks to make changes to the package without worrying about branding. Redhat and others do exactly this with artwork/branding packages. We are ALL better off if such easy build time switches are available.
I've been around a while, but the debian developers are way out of line here.... You can't create some crazy messed up debian distro and call it debian, you can't create a crazy redhat distro and call it redhat, why is firefox getting all this heat? The amount of fuss they are creating is bogus and dissapointing. I read through the snide commentary and it really is depressing. Even Mozilla Foundation suggests that a non-branded version of firefox would work better for them.
Re:The real storry (Score:4, Informative)
Offtopic: Nice last names, guys (Score:1, Offtopic)
Slightly offtopic... (Score:4, Interesting)
(Last Journal: Tuesday November 30 2004, @06:34PM)
Re:Slightly offtopic... (Score:5, Insightful)
Re:Back on topic... (Score:5, Informative)
Impossible to patch? (Score:3, Informative)
Re:Impossible to patch? (Score:5, Informative)
Re:Impossible to patch? (Score:5, Interesting)
Recent fixes (Score:5, Interesting)
#353249 [Core:JavaScript Engine]-(undisclosed security fix) [All]
#354924 [Core:JavaScript Engine]-(undisclosed security fix) [All]
#354945 [Core:JavaScript Engine]-(undisclosed security fix) [All]
I wonder if these are related to the alleged flaws?
Re:Recent fixes (Score:5, Informative)
(http://www.squarefree.com/ | Last Journal: Saturday August 09 2003, @09:27PM)
Good policies will often save you. (Score:4, Informative)
Yes, whitelisting sites is a pain, but Javascript is a remnant of a more innocent time and should probably be phased out anyway.
Re:Good policies will often save you. (Score:4, Insightful)
Web browsers are, by their very nature, huge targets. Their job is to deal with arbitrary data from all over the damn place. The whole thing should probably be sandboxed, but short of that, it shouldn't be running code from random sites.
Re:Good policies will often save you. (Score:5, Informative)
(Last Journal: Wednesday August 18 2004, @07:52AM)
Running a sandboxed version of a scripting language within a browser should be pretty harmless if the language was available only in the sandbox and couldn't touch anything outside. Creating separate sandboxes for each website would prevent cross site scripting too.
The problem is it's impossible with Firefox. It's a very old design decision that is so deep all over the place that nothing short of redesigning and rewriting everything from scratch could help.
Essentially, Firefox is written in javascript.
There are underlying frameworks written in C++ and others, the renderer engine etc etc. But the glue that binds all these functions together is Javascript on steroids. XUL files-databases that define the looks of the UI, XUL renderer, which displays them, and thousands of lines of javascript bound to every single gadget, button, field, box, dialog. This javascript performs all the basic processing and the whole high-level work of the browser program. And it calls system/framework functions to perform the low-level work - which is strictly forbidden for a sandboxed language.
Developers of Mozilla try to prevent access to all this low-level heavyweight stuff from javascript originating from webpages while allowing it from the system files. Sandbox javascript from one source, run javascript from the other source at full privledges all the time. Can you smell how fragile this is? I'm afraid these exploits will keep popping up. There's no natural barrier of "contained sandbox environment + scripting language" vs "low-level system layer", with no trace of bindings to the system layer within the sandbox, no hook, no crack to exploit by interfacing with the outside. There's an artificial wall which limits "javascript from webpages" and allows "extended javascript from interface", where both sides are essentially the same thing.
This is the old firewalling problem - policy of "deny all, allow essential" vs "allow all, block dangerous". Except currently there is no easy way to switch from one to the other.
Re:Good policies will often save you. (Score:4, Insightful)
No... the only real way to fix it is to leave it there, so you can keep finding and fixing the problems. Removing something doesn't fix it... it removes it and all the functionality that it provides.
Javascript within the browser should be for accessing and manipulating the DOM, and is extremely useful. Whether you are capable of conceiving of uses for it or not says nothing except for the limit of your own imagination.
Javascript is an interpreted language, there are absolutely no fundamental reasons why security holes in implementations should exist, other than that programmers can make mistakes. How many security flaws have been found in document viewers, compression/encryption libraries etc, where no code in the data is run at all?
Branches? (Score:3, Interesting)
(http://blog.mzzt.net/)
All security bugs are zero-day (Score:5, Insightful)
(http://dotfuturemanifesto.blogspot.com/)
Today the hackers have to work a bit harder so zero-day attacks are no longer rare. The vast majority of attacks are still from hackers who are reverse engineering the patches and distributing attacks before the patches are implemented.
If someone reports a new attack against open source code it is by definition unknown before it is reported. Therefore all bug reports with security implications are 'zero-day'.
What the idiots who released this exploit mean by 'zero day' was that they didn't allow time for the problem to be fixed before releasing the exploit.
Real article (Score:2)
All Your Base Are Belong To Them (Score:2)
(Last Journal: Saturday February 25 2006, @11:02PM)
That is a public slap in the face.
Why couldn't Javascript play nicely in a sandbox?
Bastards. (Score:4, Insightful)
(http://grendel.dyndns.org/)
The only thing they're doing by holding onto the security bugs is making the internet a more dangerous place. Yes, Firefox should have been written better in the first place. Yes, the security team should have found these already. No, none of that justifies the childish actions they're taking now.
Or perhaps they're just talking smack, trying to look like big bad grayhats because they found a single flaw. I'd like to think that.
"For the greater good of the Internet" ??? (Score:5, Insightful)
(Last Journal: Friday February 18 2005, @09:17PM)
The hackers claim they know of about 30 unpatched Firefox flaws. They don't plan to disclose them, instead holding on to the bugs.
Jesse Ruderman, a Mozilla security staffer, attended the presentation and was called up on the stage with the two hackers. He attempted to persuade the presenters to responsibly disclose flaws via Mozilla's bug bounty program instead of using them for malicious purposes such as creating networks of hijacked PCs, called botnets.
"I do hope you guys change your minds and decide to report the holes to us and take away $500 per vulnerability instead of using them for botnets," Ruderman said.
The two hackers laughed off the comment. "It is a double-edged sword, but what we're doing is really for the greater good of the Internet, we're setting up communication networks for black hats," Wbeelsoi said.
First of all, guys, so you refuse to tell us what the bugs are, so we can't fix them and do this for the "greater good of the internet... setting up communication networks for black hats" WTF? What does having tens of thousands of additional zombie-machines that could DDoS or send SPAM do with the greater good of the internet. I almost hope you try to make money off the bugs (if you even know any more) so you get to know a nice prison cell and "Life without PC"(TM). Honestly, I think those guys are full of it, they probably don't know even one additional vulnerability and just try to show off how "big and powerful" they are.
Re:"For the greater good of the Internet" ??? (Score:4, Insightful)
Selling bugs to the highest bidder (Score:5, Insightful)
Yeah, right. What they are really saying is, why give away a bug for $500 when we can sell it for much more on the black market?
In fact, the public advertisement of a "zero day exploit" makes a lot of sense if you want to establish yourself as a seller of other undisclosed exploits. Publishing the exploit is a gambit. You will loose the exploit as soon as it gets fixed, but you get your name in the trade press, on Slashdot, etc. Doing so, you establish credibility as a merchant of malware. You can set up shop, and advertise 30 other previously undisclosed bugs. Now, the botnet herders, spammers and other DDOS extortionists know were to buy a new exploit if they need one.
Re:Selling bugs to the highest bidder (Score:4, Informative)
(http://www.squarefree.com/ | Last Journal: Saturday August 09 2003, @09:27PM)
If CNET hadn't cut off my quote mid-sentence, it would have been clear that that was what (jokingly) saying too. I was not trying to bribe them. I was trying to say that I hoped they would change their minds and report the holes to Mozilla despite the fact that they (claimed they) could make much more money exploiting the holes or selling information about the vulnerabilities on the black market.
What about me? (Score:1, Funny)
SElinux (Score:2)
(Last Journal: Sunday August 20 2006, @09:16PM)
IRC (Score:5, Informative)
<Ryan> "Firefox re-entrant threading"?
<reed> http://www.toorcon.org/2006/conference.html?id=13
<Jesse_> yeah, that one
<reed> Jesse_: Did you go to that particular one?
<Jesse_> yes
<Jesse_> i also went up on stage to "debate" "disclosure" with them
<Jesse_> when i said "debate" "disclosure", i didn't mean the usual "how much time should security researchers give vendors to write and deploy patches before making the holes or exploits public" debate
<Jesse_> these guys were *against* disclosure
<Jesse_> preferring to keep the status quo of lots of vulnerabilities, large botnets (so they can be anonymous), etc. or maybe they were joking, it was hard to tell.
<Jesse_> they claim they can make $10,000 or $20,000 selling a vuln in firefox
<Jesse_> compared to $500 telling us about it
<Jesse_> selling to other blackhats, anonymously, using onion networks, of course
<dveditz> TippingPoint and iDEFENSE will pay up to $10K for IE and probably firefox vulns
. . .
<jX> http://news.com.com/Hackers+claim+zero-day+flaw+i
<jX> "...what we're doing is really for the greater good of the Internet, we're setting up communication networks for black hats," How exactly is that for the greater GOOD?
<dveditz> the black hats crusade for our freedom (and credit cards) against the evil fascist empire
<dveditz> they *earn* everything they steal by doing all the good they do keeping "the man" from owning the internet
. . .
<Jesse_> http://news.com.com/Hackers+claim+zero-day+flaw+i
<zach> Jesse_: they dragged you up on stage during their talk?
<jX> Jesse_: Yeah, doesn't reallyt make anyone look good, that article..
<Jesse_> "I do hope you guys change your minds and decide to report the holes to us and take away $500 per vulnerability instead of using them for botnets" is pretty close to the BEGINNING of a sentence i said
<Jesse_> the REST of the sentence was " or selling them to other blackhats for ten thousand dollars"
<Jesse_> with the whole sentence, it's clear that i'm hoping they'll change for ethical reasons, and that i'm not trying to bribe them
<jX> Jesse_: Yeah, but quoting you out of context makes for better copy.
<zach> Jesse_: did they actually drag you on stage during their talk as the article suggusts?
<Jesse_> zach: they left a lot of time after their slides, and asked me to come up
<Jesse_> zach: they told me before the talk that they might ask me to come up
<Jesse_> dveditz: yeah, about 20 minutes before
15 minutes (Score:2)
(http://www.emenoh.com/ | Last Journal: Monday April 17 2006, @10:08PM)
By coincidence (Score:2)
(http://www.revis.co.uk/)
Details here [revis.co.uk].
Holey Browser, FirefoxMan ... (Score:2)
(Last Journal: Friday September 01 2006, @04:53PM)
Well, Firebird, boy wonder, it may very well be ...
How Java Script Should Be Handled (Score:4, Insightful)
(http://thezorch.googlepages.com/home)
I don't ask for trouble (Score:2, Insightful)
You couldn't "commander" my computer unless I gave my web browser administrator privileges, and why would anyone do such a foolish thing? Heh.
The J in AJAX (Score:2)
(http://stereoroid.com/ | Last Journal: Wednesday August 07 2002, @05:45AM)
First, let me Second the previous comments about NoScript. I've also been using it for about a year, and find whitelisting to be only a minor inconvenience. I'm saddened by some of the JS Crud that otherwise legitimate sites try to foist on you, such as "Google Analytics", or the Tacoda [tacoda.com] ad-targeting that Slashdot uses here (which I blacklist).
NoScript plugin (Score:1, Redundant)
(http://www.algorithman.de/)
https://addons.mozilla.org/firefox/722/ [mozilla.org] make a whitelist containing your REALLY trusted sites
never worry about this again...
One of these guys works for SixApart (Score:5, Interesting)
Re:One of these guys works for SixApart (Score:5, Insightful)
(Last Journal: Tuesday May 01 2007, @04:06PM)
This guy is simply a liability for SixApart, and should get fired immediately. Imagine what could happen if he manages to get the exploit code for this or one of the other 30 exploits they claim to have discovered into one of SixApart's blogging tools.
But what do we know, maybe they have already done so. Judging from their strange "for the greater good" believes, I wouldn't be surprised about it. I sure as hell wont advise anyone to use any of their products until they've reviewed their code to make sure it doesn't sport one of Spiegelmock's toys.
So I wrote to SixApart (Score:5, Insightful)
From: [me]
Subject: Responsible disclosure and wreckless behavior
Date: 1 October 2006 14.23.23 GMT-04:00
To: mena@sixapart.com, ben@sixapart.com, brad@danga.com
Cc: mischa@sixapart.com
Hello,
I read this article on ZDNet describing how your employee Mischa Spiegelmock found and revealed a zero-day Firefox flaw:
http://news.zdnet.com/2100-1009_22-6121608.html [zdnet.com]
Mischa and his co-researcher Wbeelsoi refuse to reveal specific details on the flaw--or 30 others they found--to the Mozilla Foundation:
"The two hackers laughed off the comment. 'It is a double-edged sword, but what we're doing is really for the greater good of the Internet, we're setting up communication networks for black hats, Wbeelsoi said."
Considering LiveJournal's recent security flaws causing everyone to change their passwords due to browser-based flaws, do you really want someone working for you who makes the problem worse? To be sure, there is merit to the argument that revealing the flaws would allow Mozilla to continue to use a badly buggy implementation; however, there seems to be more to this.
From FireFox's IRC channel, some dialogue from Jesse Ruderman of the Mozilla foundation, who attended (via Slashdot: http://it.slashdot.org/comments.pl?sid=198519&cid
" they claim they can make $10,000 or $20,000 selling a vuln in firefox
compared to $500 telling us about it
selling to other blackhats, anonymously, using onion networks, of course"
Is one of your employees looking to profit of vulnerabilities in Firefox? With the large number of huge enterprises using TypePad and SixApart software, do you really want to risk him embedding JavaScript code to activate this flaw in your products? If he's saving these flaws to profit from them, what's to say he won't look for the bigger payouts of actively punching holes in your products?
That's unlikely--but more likely is that your customers will hear about this and refuse to do business with you because you have an employee who is actively seeking to make the Internet a more dangerous place.
If I misunderstood anything in these articles, I apologize completely. However, what was described in the article was so outrageous that I had to write.
Best regards,
[me]
No-Script (Score:5, Informative)
Which is why it's smart to run NoScript. A Firefox extention that blocks the execution of any scripts on a webpage without user concent. So, if you're tired of Javascript taking over your Firefox, get NoScript.
https://addons.mozilla.org/firefox/722/ [mozilla.org]
Untrusted X client? (Score:2)
(http://www.faqs.org/rfcs/rfc3675.html)
Anybody know how to run firefox as an untrusted X client? I tried, but I just get this:
we will never have browser security... (Score:2, Insightful)
There is no fix for this. NONE
You either accept executables on web pages and assume the bulk of the websites out there will all use them (and it is getting that way now), or you don't.
We either will have a secure web, or an active web, you cannot have both.
Automated code generating tools will eventually force *multiple 0 day hacks on browsers*, possibly into the hundreds or thousands. You literally won't be able to keep up with the multitude of "emergency patches" required, and it is from a couple things primarily-buffer overflows and active scripting no matter the name of the script.
You cannot make javascript secure because of this "feature", it is *designed* to be an executable. Same with all the other looping zooming call this and bring down that AJAX candy and whatnot shyte.. And you won't get them to stop coding it until they are LIABLE FOR DAMAGES and are forced to offer consumer warranties on released code that is designed to surf the open internet, and I don't care which operating system or license you might care about either, code needs a warranty with it to make it suitable for purposes, just like every other CORPORATION has to offer with their PRODUCT. Once they are liable, they will stop coding crap using junk like javascript. MS is a coprporation that wants to make money, mozilla, the same now, opera, the same, apple, the same. That's where the bulk of the browsers used on the web come from, 99% or better. For-profit corporation, they need to be forced to offer a warranty, simple as that. Once that happens, the pressure will then switch bigtime from those companies literally saying they will not recommend their users go to pages that aren't blessed by no bad code, it will force the web designers to stop using crap that makes people vulnerable and that you are forced to use if you want to surf normally.
Sayng you can "turn off javascript" or use some patch hack is not a solution, that is just pure crap now and everyone knows it, and it never will be. There are too many sites now that require it, and the sites themselves are vulnerable to getting pwned because they use insecure active scripting directly on their web pages. See how this will never be fixable as it stands now?
There needs to be a complete revolution about this, a complete admission that the web has gone offcourse into mega-stupid-land in favor of blinking crap and eyecandy.
And before the first idiot troll reactionary numbnut claims that JS can be made secure-show us that code! Show us that exact magic code you have written in your uberleetness that will make all JS be secure, something every webmaster can go slap on right now and get rid of JS insecurity! Go ahead, you'll be rich!
Redmond's response (Score:5, Funny)
One thing in life... (Score:3, Insightful)
Oh and since everyones recomended NoScript, I'd also recomend firewall tools like Sunbelt Keiro Personal Firewall (KPF), which can be configured to pop up a box every time your system attempts to run a program, very handy to stop any spyware/addware/anywhere you don't want loading on your system.
Open source is more vulnerable to 0days (Score:2)
This is the other side of the "many eyes make bugs shallow" coin: many eyes make exploits shallow too. If your bad guys are more motivated than your good guys to find exploitable bugs (and why not, if they're worth $10K each!), open source can be inherently less secure than closed source.
It's just good that Firefox has only 10% of the market. If it ever goes over 50% we're in for a security nightmare.
Why not browse in a discardable environment (Score:1)
Well... (Score:1)
(http://www.icanseethepixels.com/)
I;ve been reading about this all day (Score:1)
It sounds more like a Microsoft recommendation than anything.
I know some very intelligent people will be looking at the code at present, but a bit more information about possible timescales would be nice.
Before anyone says go look on mozilla forums, I have been there and the one thread on the subject has the same crap posted here.
No-one appears to be doing anything about it and that worries me.
Is it lack of details about the exploits? Is it lack of understanding? It is just a very complex bug being examined in private?
MS vs Mozilla (Score:1)
IE vs. Firefox (Score:2, Insightful)
(http://sinbios.org/)
Firefox: Hackers "claim" zero-day flaw in Firefox [slashdot.org]
Biased much?
is it really firefox (Score:1)
Noscript doesn't solve anything (Score:2)
1. Turn off Javascript completely for all sites.
2. Use a browser with a rock-solid Javascript implementation.
One is easy, but breaks functionality, as people rely on Javascript for everything nowadays -- Mostly for things that don't need it. As for two, Firefox will never be this browser unless it is fundamentally re-architected, as others have mentioned here. It seems like the only option currently is to pick the safest browser you can find (I run Safari, which has far less vulnerabilities reported than Firefox, although I realize that means little in an absolute sense), sandbox it as best you can, be wary of any site you go to, keep your data backed up, have good password policies (don't use the same password for Slashdot and your back account), and cross your fingers.
This sucks -- We're still paying for the browser feature race that Microsoft and Netscape had years ago. This is not to say that passing code to a client and having it run it to render something is a bad thing. No one is up in arms about Postscript. What we do need is some technology that is limited to certain very specific things, and is not depended on to interact with the browser itself in any major ways (as it currently is in Firefox). Saying "draw this line 10 times" is fine. Saying "open these tabs and turn off your bookmark bar" is not. Once you go past Postscript-level rendering and into client UI or system interaction, you're just asking for it.
RMS are your listening? (Score:1, Interesting)
OSS needs this in licenses. Forget the DRM stuff GPLv3 is trying to deal with, let's try to deal with a real problem that we can solve. This is a minor act of terrorism like behavior, they go out, announce they have a bunch of exploits that they aren't going to publish and basically say they would rather get them to other black hats rather than mozilla to fix them. That should be criminal and if it's not and since I don't trust the government to do it right, Mozilla should have recourse to sue these guys for damages and to figure out fixes to the problem.
Look at the apple wireless thing, same exact problem. We'll never know if there was a real exploit, it will never be released or actually demoed. Any time apple fixes anything in the wireless area (and they'll continue to fix stuff for years) a group of people will simply parrot that the whole thing was real, another group will do the same and echo the fraud charges. The fact remains that it is the least responsible disclosure, it is an attempt to generate fear that cannot be fixed and generate some fame and defame another company all at once.
RMS mandate full disclosure in the next GPL.
Probably won't affect many /. readers ... (Score:2)
(http://trillian.mit.edu/~jc/ | Last Journal: Saturday August 14 2004, @05:03PM)
The whole security concept... (Score:1)
And even that is no guarantee for security. Actually, with today's solution you cannot securely isolate process domains. You can still use bandwidth modulation (RAM, disk etc.) to send information to any other process on the system (it just needs to measure the bandwidth...). I think such problems can only be avoided if one uses a proven concept to build the whole OS.
But who am I to tell how to do such things. Wait a few years, and I'm usually proven to be right.
Define "secure". No handwaving. (Score:2)
(http://www.scarydevil.com/~peter/ | Last Journal: Monday September 26 2005, @06:53PM)
There's many answers, depending on what you mean by secure...
1. A browser in which no path throough the code can in principle be exploited. Technically, yes, but in practise you're unlikely to see such a browser in wide use because it wouldn't permit third party plug-ins nor would its scripting language allow many of the capabilities people are used to seeing.
2. A browser in which no security flaws can be practically exploited. This would be possible, if you don't count holes in third-party plugins. You would need to implement the browser in an inherently safe language and restrict the ability of scripts to only change the presentation of data, to communicate with plugins at a high level, and trigger events within the same document.
3. A browser in which no security flaws require changing the exposed API to be fixed. This is easily implemented, and Gecko is actually not far from it. Scripts would need to be somewhat restricted to prevent cross-site information exposure, but most of the problems with Firefox are at a higher level... for example, the use of the same scripting engine to implement user interface features and to execute untrusted scripts, or (and worse) the support code for XPI installs from the web that requires a hole in the sandbox to implement. A browser such as Camino that uses Gecko for rendering HTML but implements the user interface in native code is safer in principle.
4. A browser in which 'trusted' documents can run unsandboxed code, and which is still secure? Not possible. This is where Internet Explorer is. The difference between point 3 and point 4 is huge... you can build a class three secure browser using the Gecko engine with minor changes that don't effect the API. You can't make a class 4 browser secure without turning it into a class 3 browser, and to do that you have to fundamentally change the API. Microsoft could do it now, but it would have been much easier for them to do it in 1998.
terrorist (Score:2)
(http://www.codepunk.com/)
that you intend to use it to create a botnet. The only thing I can say is these crap heads should be labeled what they are, terrorist. Send them to gitmo with the rest of the terrorist, never to be heard or seen again.
The community is greater than a couple of hackers? (Score:1)
Any ideas anyone?
What was the reason for the security flaw? (Score:2)
So, I am asking: is it because of flawed design or because of using C as the language to program firefox in?
If it is the latter, then maybe we (i.e. the software community) shall consider stop using C and move to a safer environment (e.g. Cyclone).
Firefox. Mozilla? (Score:2)
It is a joke (Score:2)
(Last Journal: Wednesday October 31, @08:33AM)
Re:Firefox has become IE (Score:3, Funny)
Re:Intersting Spin (Score:2, Informative)
Neither of which apply to this situation. An announcement from a crerdible source or a demonstration would clear things right up. Even if you consider whitedust.net to be a good source, the flaw was not found by them and they only reference a ZDNet article which contains slightly more information but not enough to really confirm anything. The people who found the exploit are deliberately keeping it secret and therefore will not produce a PoC.
=Smidge=
Re:Firefox has become IE (Score:2, Insightful)
(Last Journal: Monday February 13 2006, @07:11PM)
Not even close.
"I guess it's time to start using Opera, instead."
If you're looking for a browser that never has any special security flaws to talk of that's still usable for modern web sites, you're up for a hell of a search.
Re:Interesting Spin (Score:2)
Re:Javascript is the security problem (Score:2)
(http://dattaway.us/)
Re:Javascript is the security problem (Score:2)
Re:Javascript is the security problem (Score:3, Funny)
Re:Interesting Spin (Score:2)
(http://www.pembo13.com/)
Re:Javascript is the security problem (Score:2)
(http://wakaba.c3.cx/)
Where "correctly coded" is defined as "works perfectly when I've turned off Javascript", right? God, what a useless statement to make.