mccr8

6 ms·

1.
by mccr8 12d ago
Writing Chromium entirely in Rust wouldn't prevent a JIT bug like this.
2.
by mccr8 12d ago
JIT bugs like this are not easily solved simply by writing a browser in a typesafe language. Here's the commit that fixes this issue: https://chromium.googlesource.com/v8/v8/+/e0562d87ad9c17042b...
3.
by mccr8 12d ago
In fact, Google will pay you $250,000 for a full chain exploit. The CVE reported here is a renderer process vulnerability. Google used to pay more for those before the vulnpocalypse. Now, they are fixing hundreds of bugs per week that they
4.
by mccr8 17d ago
While working on Firefox, I do sometimes look back at Bugzilla (the project's issue tracker) activity from 26 years ago to try to figure out why some code is the way it is. However it feels hard to believe that the role of LLMs in anot
5.
by mccr8 2mo ago
AI is very good at finding security bugs. If you are working on a product that processes hostile data like a web browser and has a security bug bounty program, your choices are either to find them yourself or be overwhelmed by external subm
6.
by mccr8 4mo ago
The cute thing about asm.js is that it was fully backwards compatible with the web: it was just a lot slower without dedicated support. So Epic or whomever could put out a demo that would run just fine in Chrome, but the performance was a l
7.
by mccr8 4mo ago
One of the big issues with NaCl is that the API it used wasn't standardized at all and there was only a single implementation. You could pick a random function and ask "hey, what happens if you pass in some slightly weird argument
8.
by mccr8 4mo ago
The incentive is that Mozilla will pay you thousands of dollars if you find a security bug: https://www.mozilla.org/en-US/security/client-bug-bounty/ We have many outside contributors who have successfully su
9.
by mccr8 4mo ago
Fuzzing isn't good at things like dealing with code behind a CRC check, whereas the audit based approach using an LLMs can see the sketchy code, then calculate the CRC itself to come up with a test case. I think you end up having to wr
10.
by mccr8 4mo ago
Mostly I think this just means that having a test case makes it easier to fix and verify. You can't actually take for granted having a test case when fixing a security bug. Sometimes you only have a crash stack or maybe a vague and hyp
11.
by mccr8 4mo ago
A general limitation of this approach is that it is only as good as your validator, and there's nothing easier to validate than a test case that creates, say, an AddressSanitizer use-after-free. For subtler issues will we have to more
12.
by mccr8 4mo ago
Firefox developers do fix issues found by Coverity. I haven't looked at the results in over a decade, but the last time I did there were a few code patterns we used in a lot of places which Coverity didn't like (but were actually
13.
by mccr8 4mo ago
Possibly! One of the many areas that might need rethinking in the age of AI (that started in February of this year) is how long security bugs should be hidden. We live in interesting times.
14.
by mccr8 4mo ago
I'd say it leans towards memory corruption kinds of issues, as those are easiest to pass the validator, thanks to AddressSanitizer. I think there's a lot of potential for making the validator more sophisticated. Like maybe you add
15.
by mccr8 4mo ago
Quantifying the abilities of an LLM is a hard research problem, so I'm not sure if I can describe it in any great way, but Mythos did seem to be fairly clever about putting together things from different domains to find problems. For i
16.
by mccr8 4mo ago
The usual sorts of fuzzing and static analyses, using AddressSanitizer and ThreadSanitizer. Also, with a bug bounty program to try to encourage external researchers to report issues. (I work on Firefox security; also I fixed 2 of the bugs l
17.
by mccr8 4mo ago
If you go to about:memory and click on "measure" you can see a bit of where the memory is going. The per-tab overhead isn't that high, but unfortunately there's quite a bit of overhead to have the browser open at all, so
18.
by mccr8 5mo ago
You can't just use a linter to fix buffer overflows, or people would have done it already.
19.
by mccr8 5mo ago
The basic technique (as has been publicly described by Anthropic) is you ask one agent to come up with a test case that triggers, say, an ASan use-after-free. Then you have a second agent that validates the test case. This eliminates a lot
20.
The zero-days are numbered(blog.mozilla.org)
59 points by mccr8 5mo ago|7 comments
21.
by mccr8 5mo ago
Not really. The models were pointed specifically at the location of the vulnerability and given some extra guidance. That's an easier problem than simply being pointed at the entire code base.
22.
by mccr8 5mo ago
The flood of reports that open source projects like curl, Linux and Chromium are getting are presumably due to public models like Open 4.6 that released earlier this year, and not models with limited availability.
23.
by mccr8 5mo ago
No, they stopped paying bounties.
24.
by mccr8 6mo ago
You should generally assume that in a web browser any memory corruption bug can, when combined with enough other bugs and a lot of clever engineering, be turned into arbitrary code execution on your computer.
25.
by mccr8 7mo ago
Google already has an AI-powered security vulnerability project, called Big Sleep. It has reported a number of issues to open source projects: https://issuetracker.google.com/savedsearches/7155917?pli=1
26.
by mccr8 7mo ago
The bugs that were issued CVEs (the Anthropic blog post says there were 22) were all real security bugs. The level of AI spam for Firefox security submissions is a lot lower than the curl people have described. I'm not sure why that is
27.
by mccr8 7mo ago
I think the trick to making the "shorts" feature stop showing scantily clad women is to use it actively a bit, and only watch the videos that are decidedly something else. I did that for awhile and now my videos are like "let
28.
by mccr8 8mo ago
Rust did exist in some form in 2011. Source: I ate lunch with part of the Rust team in 2011.
29.
by mccr8 8mo ago
Each tab can be a dozen or more processes nowadays, thanks to site isolation.
30.
by mccr8 10mo ago
One longstanding issue with gradients was fixed recently. https://bugzilla.mozilla.org/show_bug.cgi?id=627771

More ›