5 ms·

Firefox, by contrast, “had turned off [ASLR], one of the fundamental safety features in their compilation.” Firefox has had mandatory ASLR since 2012. After m

by gcp 10y ago

Firefox, by contrast, “had turned off [ASLR], one of the fundamental safety features in their compilation.” Firefox has had mandatory ASLR since 2012. After more investigation, this appears to be about Mac OS X specifically (which isn't pointed out anywhere in the article) where the Firefox executable doesn't have the PIE bit set. But note that the Firefox executable does almost nothing, and all web rendering stuff is in a huge dynlib, which is loaded with ASLR.

gsnedders 10y ago
As far as I'm aware, base Firefox has had ASLR for much longer—just extensions (because they can run arbitrary code) could disable it by loading DLLs that don't support ASLR. (DLLs because Windows was the last platform that changed to mandatory ASLR.)
- gcp 10y ago
  Right, so it would actually have been hard to mess that up. The only platform where Firefox has limited ASLR is Linux, where PIE is disabled, due to issues with some desktop managers not detecting PIE executables are executable. So the default builds disable it for maximum compatibility. Distros like Debian and Fedora have fixed the bug on their side though, and just ship PIE Firefox executables. The graph mentions Safari, so you'd think Mac OS X. But AFAIK the ASLR implementation just works on Mac OS X? So I have no idea what the graph is supposed to mean.
  - glandium 10y ago
    For completeness, Distros didn't actually fix the issue, they have much less to care about it: When you install a distro package, you get the application icon in your desktop environment. You don't when you download a firefox tarball, and unpack it.
616c 10y ago
If Dan Walsh says it's complicated to run a MAC system against browsers specifically and desktop software generally, you have to worry. http://danwalsh.livejournal.com/72697.html http://danwalsh.livejournal.com/72697.html I know it is debunked lower in the thread (so long as you do not load suspicious extensions, as explained), but sandboxing browsers seems prudent, and sadly why I am afraid maybe even Qubes is not enough anymore! Haha.
- gcp 10y ago
  ASLR and MAC are unrelated - I don't get your comment.
  - 616c 10y ago
    Securing an application that merges so many functions of a computer is conceptually a lot more complicated than it appears. He starts with a CVE and is routinely asked but why no SELinux. Conversely, he does not get into the fun part, a JIT, which must make ASLR all kinds of fun. I was aware it is an apple and oranges comparison, but it all kind of sucks with something as complicated as a browser.
glandium 10y ago
And it is worth noting that the reason PIE is not enabled on Firefox on Mac OS X is because PIE executables are not supported on OS X 10.6, and Firefox still runs on OS X 10.6. Which won't be true in Firefox 49, due to release in 6 weeks, and that has PIE enabled (by the simple fact that MACOSX_DEPLOYMENT_VERSION was changed to 10.7 (the toolchain defaults to building PIE in that case), https://bugzilla.mozilla.org/show_bug.cgi?id=1269790 https://bugzilla.mozilla.org/show_bug.cgi?id=1269790).
glandium 10y ago
The article also doesn't say where the difference between Chrome and Safari on ASLR subscore comes from, or how Firefox does better on the Stack Guards subscore than Chrome (which I'm very surprised about, although maybe that includes the JS stacks as well?).

by gcp 10y ago

gsnedders 10y ago

As far as I'm aware, base Firefox has had ASLR for much longer—just extensions (because they can run arbitrary code) could disable it by loading DLLs that don't support ASLR. (DLLs because Windows was the last platform that changed to mandatory ASLR.)

gcp 10y ago
Right, so it would actually have been hard to mess that up. The only platform where Firefox has limited ASLR is Linux, where PIE is disabled, due to issues with some desktop managers not detecting PIE executables are executable. So the default builds disable it for maximum compatibility. Distros like Debian and Fedora have fixed the bug on their side though, and just ship PIE Firefox executables. The graph mentions Safari, so you'd think Mac OS X. But AFAIK the ASLR implementation just works on Mac OS X? So I have no idea what the graph is supposed to mean.
- glandium 10y ago
  For completeness, Distros didn't actually fix the issue, they have much less to care about it: When you install a distro package, you get the application icon in your desktop environment. You don't when you download a firefox tarball, and unpack it.

616c 10y ago

If Dan Walsh says it's complicated to run a MAC system against browsers specifically and desktop software generally, you have to worry. http://danwalsh.livejournal.com/72697.html http://danwalsh.livejournal.com/72697.html I know it is debunked lower in the thread (so long as you do not load suspicious extensions, as explained), but sandboxing browsers seems prudent, and sadly why I am afraid maybe even Qubes is not enough anymore! Haha.

gcp 10y ago
ASLR and MAC are unrelated - I don't get your comment.
- 616c 10y ago
  Securing an application that merges so many functions of a computer is conceptually a lot more complicated than it appears. He starts with a CVE and is routinely asked but why no SELinux. Conversely, he does not get into the fun part, a JIT, which must make ASLR all kinds of fun. I was aware it is an apple and oranges comparison, but it all kind of sucks with something as complicated as a browser.

glandium 10y ago

And it is worth noting that the reason PIE is not enabled on Firefox on Mac OS X is because PIE executables are not supported on OS X 10.6, and Firefox still runs on OS X 10.6. Which won't be true in Firefox 49, due to release in 6 weeks, and that has PIE enabled (by the simple fact that MACOSX_DEPLOYMENT_VERSION was changed to 10.7 (the toolchain defaults to building PIE in that case), https://bugzilla.mozilla.org/show_bug.cgi?id=1269790 https://bugzilla.mozilla.org/show_bug.cgi?id=1269790).

glandium 10y ago

The article also doesn't say where the difference between Chrome and Safari on ASLR subscore comes from, or how Firefox does better on the Stack Guards subscore than Chrome (which I'm very surprised about, although maybe that includes the JS stacks as well?).