quotheth

Why should an application developer implement a sandbox?

Because they are the ones who understand the necessary capabilities of their program and the ones who have access to the source code...

That's a huge waste of time and it's much more efficient if the operating system or the user enforces it instead by using existing sandboxing technologies like firejail.

Actually it's a far better sandbox when built into the program. And it doesn't leave users relying on installing arcane operating systems or becoming technically savvy.

It is also untrustworthy and insecure, since after all you don't trust the application.

No, trusting the application is implicit since it's installed by the user. The sandbox exists to protect against a compromised application.

I think this is the wrong attitude. No one is better suited to implement a sandbox than the developer of the application. The fact that most developers are not trained to do so is just a reflection of our field's terrible progress re: education devs on secure app dev.

Leaving this to the user leaves the vast majority of users unsafe. This is an unacceptable state.

How many apps do this?

Your argument seems to be that because there are multiple ways to exploit people that closing any of those methods is not useful. I shouldn't have to explain why this is not a meaningful argument.

What I will say is that in many cases an attacker is far more capable of MITM than they are of posting forum comments, or otherwise convincing you to click a link. A phishing campaign is noisy - you are often alerting many parties that you're malicious. MITM within a network is much stealthier and you don't have to rely on users clicking on anything.

Really, they're just completely different attacks and the existence of one has no bearing on the other. TLS on every page would close off real attacks and, if it forced attackers to use noisy methods like phishing, that's a huge win.

Sure it is. If I have a Chrome exploit that I want to deliver to you and I'm on your network I can inject it into the webpage.

It's impossible to get a valid SSL certificate for an appliance running within someone their lan

Can you not just create a certificate and push it to the system as a trusted cert?

And opening ports would make the appliance even more vulnerable to attack.

Presumably there is already some sort of communication going on if they're receiving Chrome updates.

I'll assume you intended to write 'insecure'.

I'd say the main issue is that anyone between you and that website can inject scripts into the site in order to phish/ exploit you.

OK, so in your example they create a certificate and use HTTPS and I'm unsure what the problem is.

And why would they think outside of their internet only box when they're providing an internet browser?

The "premature optimization is the root of all evil" thing is totally blown out of proportion. I think what they're saying is don't use that quote as a reason to write garbage slow code.

None of these are likely the reason - it should be as simple as Java's own managed heap preallocating that space.

Do you think there's much overlap between the people generating reports and the people in charge of hosting their domain/ managing certs?

I can't tell what this post is implying - that sec analysts are like... a fake job?

Can you please elaborate?

An attacker needs the ability to compute on your local machine. Javascript is the way to do that in a browser.

With just CSS this should be impossible/ very unlikely. I guess it is probably technically possible, but I do not expect to see exploits using just CSS.

With HTML5 idk, that's really outside of my area.

I work for a company with a massive rust codebase. Rust is very much about building production code.

What is 'good production code' ?

* Few errors * Readable, well documented * Testable, has tests, has testing tools like quickcheck, fuzzing, etc * Meets performance constraints

Rust hits those better than any language I've used. The downside is, oh gosh, you'll have to actually learn a programming language that isn't just another variation of the ones you learned in school.

I personally find Rust quite a joy to read.

Yep, it's disabled by default. It is a great indicator of the forward thinking work they do, though. And from a corp perspective we can push out policies to enable site isolation for high risk websites (SSO).

"The only interesting thing" is a bit disparaging haha that's kind of a big deal. It means that third party iframes, as one example, run in a separate process. It breaks the case where I am evil.com, and you are okta.com, and there is a way for me to leak data within a process (or exploit the process), I can read okta.com's data.

With site isolation is this made considerably more difficult.

My point with site isolation was more their continued effort to push interesting, compelling security improvements. Currently, from a corp perspective, enabling site isolation for internal high security websites (SSO pages etc) is possible with GPO and a big win imo.

Please don't take it the wrong way, I think Firefox is awesome too :)

Vulnerability counting is never a metric for security when comparing counts across products.

It's very helpful for counting within a product.

One simple example - A and B are browsers. A has a bounty program that they invest millions into, B does not.

A gets 100 vulnerability reports a month, B gets 5.

Is B safer?

No.

However, let's say we just look at A. It gets 100 a month, and then a new feature is added - suddenly it's 200 a month, and the vulns tend to be in the new codebase. That's interesting information for A - it has nothing to do with B.

There is no universal metric for security.

What I will say is that Edge and Firefox are doing an excellent job - I'm really impressed. Chrome is still the safest browser today, in my opinion.

Site isolation, which was released recently, is a really great example of how far ahead they are - site isolation is at least 3, maybe 4 years in the making. That's serious work.

They have had an excellent bounty program. They have project 0 doing advanced offensive research, much of which has been relevant to browsers.

They fuzz a ton and have managed to solicit others to do the same (not that other browsers don't/ haven't).

Their sandbox is incredible and constantly evolving. They basically invented seccomp v2 just to improve their sandboxing stature on linux. They implemented 'forceaslr' before EMET was even a thing to help prevent info leaks from third party libs.

Their new kernel32.dll unloading mitigation is awesome, and as far as I know the first instance of such a thing.

I could really go on and on, I'm sure - they have taken incredible proactive measures and they're just getting better at it.

We can see similar growth in Edge, which has had a sandbox for years. Firefox has more recently gotten a sandbox and the move to rust is encouraging.

But... yeah, in my opinion, Chrome takes the cake.

I read posts like this and it's just so clear to me why we're so fucked.

I don't get what you're arguing - this has nothing to do with the developer mindset. He just has to flip a compiler switch and vulnerabilities won't be trivially exploitable anymore.

It's totally irresponsible.

This is really just not accurate. You can say that AVs are crap, but please don't put all of your eggs in the 'proactive security' basket. At one point that was actually the prevailing attitude, and it just failed absolutely miserably.

Instead, today, we see more companies invest in what's called "incident response". Part of a healthy incidence response program is signature detection - AV plays a role in this.

If you don't have good detection capabilities you're missing a huge portion of what makes an organization secure.

Relying on proactive users is also a recipe for disaster and not a realistic goal at all, nor should it be.

It isn't even per function call in all implementations.

I feel strongly that you do not understand the performance implications of the mentioned mitigation techniques.

Really? My comment doesn't add anything meaningful to the discussion?

I linked to a far more informative post that actually discusses a technical issue. Frankly, the response should have been what was linked on HN, not some rant.

I can't believe the irony of telling me to "chill out" with personal attacks when commenting on a rant that is majority perosnal attacks.

None of this is adult.

Really? The long technical explanation, with the word "shouty" is not adult? The plea for sensible discussion?

Your post isn't worth responding to beyond that. You've taken extreme liberties in your reading of his response. "Directly insulting Linus" lmfao are you fucking kidding me? You're calling "shouty" as directly insulting, when it's a response to "Fucking morons" writing "garbage" code? This is disingenuous at best if not willfully ignorant.

Cheap jokes about Linus's behavior?????

Seriously, take a step back and realize the loops you're jumping through to try to somehow justify Linus's behavior by attacking a reasoned response to it.

I asked you to provide an example of the situation you described. I was as specific as you were.

I will try to be more straightforward.

You've stated that Linus has a unique role, and that he has to be this way or he'll lose the kernel/ essentially be worse at his job.

You've provided no examples or evidence (and I asked).

In your opinion, Linus must be this way, it is "just required" by his unique position. We have this totally unknowable position that you, for no apparent reason, assume is best suited to people who insult others publicly. And because this position is unique we can't compare him to others, by nature of the position.

You have essentially placed Linus in a position where you could basically justify anything. "Oh, well, it's a very unique role - you just have to be xyz for this sort of work".

The thing is, Linus's position may be unique, but it has a lot in common with lots of positions we have a good handle on. There are lots of open source leaders out there, lots of people who manage codebases, write code, etc. Maybe not exactly all of those things in exactly the same way, but we have plenty of similar positions.

I do not imagine a community so vehemently defending members of those positions who act like Linus. By your own admission this is a bad model for others in the same exact industry with similar roles - you even say they should be fired for acting the way he does.

So I guess my question is; what unique aspect of Linus's role makes him so different from everyone else with incredibly similar roles? What evidence is there that, against everything we know about positions like the one he fills, acting the way he does is the right way for his role?

Can you show me an example where a leader of an OSS project had reasonable discussions with other developers (read: n steps below calling them morons who write garbage code), and as a result their project was "stolen" by a powerful tech company?

A human being can only have one account on one website. How about this - you delete your post, and I delete my post, and we both contribute to the conversation by removing useless posts!

See my edit: I don't want to continue this discussion as I have a fairly high up comment and I think this is just a bunch of clutter for the purpose of meta discussion. Talk about 'makes for boring reading'.