5 ms·

> In order for a project to be accepted to OSS-Fuzz, it needs to have a large user base and/or be critical to Global IT infrastructure Let's see - Firefox and/

by mtgx 10y ago

> In order for a project to be accepted to OSS-Fuzz, it needs to have a large user base and/or be critical to Global IT infrastructure Let's see - Firefox and/or the Tor browser? I imagine Google wouldn't be too happy about doing free security research for Firefox, but it seems to fit the bill quite well for the goals and mission of the Core Infrastructure Initiative organization.

orf 10y ago
Why wouldn't they be happy? Google's a diverse company, it's not like every department/team has an unwritten goal to push Chrome at the expense of everything else.
- ronjouch 10y ago
  > "it's not like every department/team has an unwritten goal to push Chrome at the expense of everything else." It often feels like it, yes. Could it be that you don't see it because you are already using Chrome? I use Edge on my Windows gaming machine (for minimal maintenance, I install drivers, Steam, and that's pretty much it) and configured Edge to clean everything including cookies on exit, like a permanent stateless Private Mode available for the occasional search. End result: many Google apps (Search, Maps, YouTube, and probably many others) constantly display huge "Get Chrome" banners, that end up not only painful for the user experience, but contain plain lies: "A more modern, faster browser" says one, whereas Edge/Firefox/Chrome are now objectively in the same ballpark. This constant soliciting across vast swaths of the web by one dominant actor controlling the end-to-end experience is abusive.
  - orf 10y ago
    I use Firefox and I agree with you, I don't like the "Use Chrome" banners that I see when using IE (i dont get them with ff). However, baring that, is there anything else they've done? IIRC they still pay Mozilla for making Google the default homepage
    - ronjouch 10y ago
      > "IIRC they still pay Mozilla for making Google the default homepage" True. > "is there anything else they've done?" Nah, and frankly that's just irrational in-my-head ranting, their behavior is entirely expected rational behavior. Google is a data junkie which critically all-caps NEEDS as much data as possible about us, in order to machine-learn our lives from head to toe so that it can make money helping companies sell us more stuff. Of course Apple isn't bothering us to use Safari when browsing apple.com, it doesn't care as long as you buy Macs. Of course Microsoft neither, it doesn't care as long as you use their platforms. But Google is different, it needs your data to operate, and so it will do whatever it takes to get its data fix, including bullying. </rant> EDIT+OFFTOPIC: cool article on your blog about AFL, thanks for sharing it :)
      - jlongster 10y ago
        >> "IIRC they still pay Mozilla for making Google the default homepage" > True. Not true. Mozilla switched to Yahoo a few years back; Google doesn't give them any money. And it's not the default homepage, it's the default search engine (the default homepage always starts out `about:home`).
        ronjouch 10y ago
        Eh I guess you're right, as you're mozillian and as I remembered Yahoo too. But can you help me understand this: I was unsure whether today's Mozilla deal was with Yahoo or Google, so I double-checked before asserting True. And running firefox with a fresh new profile, I confirm all search sources (awesome bar, in-chrome search box, about:home in-content search box) default to querying Google, not Yahoo. Is it new to be back to Google? Or maybe it's specific to Nightly builds? (53.0a1 2016-12-01) -- EDIT no, same behavior under 50.0.2 stable. And it's not the OS either, I tried Ubuntu and Windows --. Any idea why, then?
        kbrosnan 10y ago
        Yahoo is only the default for users in North America. Bidau for China and Yandex for Russia. In most other cases Google is the default as their search service produces good results for the user. https://blog.mozilla.org/blog/2014/11/19/promoting-choice-and-innovation-on-the-web/ https://blog.mozilla.org/blog/2014/11/19/promoting-choice-an...
  - jdormit 10y ago
    On the other hand, I use Chrome on my Windows machine - the constant dialogs that pop up over the Edge shortcut whenever I load up Chrome telling me how great Edge is are really tiresome.
    - Twirrim 10y ago
      Odd. I use Firefox and haven't once seen those.
    - ronjouch 10y ago
      Ouch, that sucks. Haven't heard about those and haven't seen them yet.
    - ocdtrekkie 10y ago
      This is pretty much solely in retaliation for the incredibly annoying "Get Chrome" behavior Google has been engaging in heavily for years. Beyond privacy issues, just avoiding these incessant banners makes it worth avoiding Google websites.
    - kevin_thibedeau 10y ago
      On my work machine I have to use IE for some internal sites that arbitrarily block FF and Chrome. At least once a week IE10 opens a second tab on startup pitching the wonders of IE11 to me and offering to install it immediately.
      - ronjouch 10y ago
        That's different. MS wants you to upgrade to at least IE11 (or Edge) because IE10 is no longer supported [1], and keeping using it is dangerous. (But maybe you cannot upgrade because of !@#$% corporate policies.) [1] https://en.wikipedia.org/wiki/Internet_Explorer_10 https://en.wikipedia.org/wiki/Internet_Explorer_10 says "On January 12, 2016, support ended for IE10 on Windows operating systems capable of running Internet Explorer 11, due to new support policies dictating that only the newest version of IE available for a supported version of Windows will be supported. IE10 will only be supported on Windows Server 2012 and Windows Embedded 8 Standard."
DannyBee 10y ago
Kostya would be quite happy to have firefox using it :)
hannob 10y ago
Google actually did and does a whole lot to support firefox security. There's a lot of collaboration in the security space, e.g. Firefox and Chrome security teams heavily collaborate on fixing the TLS/CA ecosystem. Also the interest is very often shared, because a whole pile of libraries are used by both browsers: freetype, libjpeg-turbo, libpng, giflib, expat, webrtc, opus, ...
dgacmu 10y ago
I think that represents a fundamental misunderstanding of Google's incentives. (disclaimer: I'm typing this from Google, but it's purely my own opinion.) (And wishing my experiment would finish running faster.) Google's biggest revenue stream is ads. It has many others, but that's the big one. Ads are seen by people who use Google search, and who browse many ad-supported websites. Google also has a lot of users of its services, e.g., gmail, who have accounts. Some also entrust valuable data to Google. Google therefore has a great deal of incentive to make sure that: (a) Nobody messes with the ability of general users to browse the Internet safely (preserving ad revenue); and (b) It's very hard to compromise users computers and gain access to their Google/gmail/whatever accounts (reducing support costs and keeping users happy), or destroy their data, or exfiltrate it. Even if the compromise was the user's computer, it's still a very bad experience. Project zero is a pretty good example of this incentive structure in action. (such as fuzzing for windows font bugs: https://googleprojectzero.blogspot.com/2016/07/a-year-of-windows-kernel-font-fuzzing-2.html https://googleprojectzero.blogspot.com/2016/07/a-year-of-win... ). With fuzzing itself, as DannyBee alluded to below, one of the leads of a lot of this infrastructure, Kostya Serebryany, is also personally passionate about seeing it be taken up to make the software of the world better. I've seen this in action - he convinced me to use libFuzzer to improve TensorFlow's robustness, and mentioned that he was doing so in part so I'd take that experience back to Carnegie Mellon and spread the word. :) (and it worked - https://github.com/tensorflow/tensorflow/commit/7231d01fcb2cd9ef9ffbfea03b724892c8a4026e https://github.com/tensorflow/tensorflow/commit/7231d01fcb2c... for example).
- ocdtrekkie 10y ago
  One could argue, especially considering some of the disclosure situations surrounding Project Zero that have occurred, that it exists more to shame competitors than improve the world. :) To my knowledge, only like once have I heard the words "Project Zero" in relation to a flaw in Google software. But as Google definitely does do security testing on competitors' products such as Windows, it definitely goes to show that Google would be more than happy to test for security flaws in Firefox. And regardless of Google's motives, finding security flaws does, in the end, make a more secure Internet for everybody.

by mtgx 10y ago

orf 10y ago

Why wouldn't they be happy? Google's a diverse company, it's not like every department/team has an unwritten goal to push Chrome at the expense of everything else.

ronjouch 10y ago
> "it's not like every department/team has an unwritten goal to push Chrome at the expense of everything else." It often feels like it, yes. Could it be that you don't see it because you are already using Chrome? I use Edge on my Windows gaming machine (for minimal maintenance, I install drivers, Steam, and that's pretty much it) and configured Edge to clean everything including cookies on exit, like a permanent stateless Private Mode available for the occasional search. End result: many Google apps (Search, Maps, YouTube, and probably many others) constantly display huge "Get Chrome" banners, that end up not only painful for the user experience, but contain plain lies: "A more modern, faster browser" says one, whereas Edge/Firefox/Chrome are now objectively in the same ballpark. This constant soliciting across vast swaths of the web by one dominant actor controlling the end-to-end experience is abusive.
- orf 10y ago
  I use Firefox and I agree with you, I don't like the "Use Chrome" banners that I see when using IE (i dont get them with ff). However, baring that, is there anything else they've done? IIRC they still pay Mozilla for making Google the default homepage
  - ronjouch 10y ago
    > "IIRC they still pay Mozilla for making Google the default homepage" True. > "is there anything else they've done?" Nah, and frankly that's just irrational in-my-head ranting, their behavior is entirely expected rational behavior. Google is a data junkie which critically all-caps NEEDS as much data as possible about us, in order to machine-learn our lives from head to toe so that it can make money helping companies sell us more stuff. Of course Apple isn't bothering us to use Safari when browsing apple.com, it doesn't care as long as you buy Macs. Of course Microsoft neither, it doesn't care as long as you use their platforms. But Google is different, it needs your data to operate, and so it will do whatever it takes to get its data fix, including bullying. </rant> EDIT+OFFTOPIC: cool article on your blog about AFL, thanks for sharing it :)
    - jlongster 10y ago
      >> "IIRC they still pay Mozilla for making Google the default homepage" > True. Not true. Mozilla switched to Yahoo a few years back; Google doesn't give them any money. And it's not the default homepage, it's the default search engine (the default homepage always starts out `about:home`).
      - ronjouch 10y ago
        Eh I guess you're right, as you're mozillian and as I remembered Yahoo too. But can you help me understand this: I was unsure whether today's Mozilla deal was with Yahoo or Google, so I double-checked before asserting True. And running firefox with a fresh new profile, I confirm all search sources (awesome bar, in-chrome search box, about:home in-content search box) default to querying Google, not Yahoo. Is it new to be back to Google? Or maybe it's specific to Nightly builds? (53.0a1 2016-12-01) -- EDIT no, same behavior under 50.0.2 stable. And it's not the OS either, I tried Ubuntu and Windows --. Any idea why, then?
        kbrosnan 10y ago
        Yahoo is only the default for users in North America. Bidau for China and Yandex for Russia. In most other cases Google is the default as their search service produces good results for the user. https://blog.mozilla.org/blog/2014/11/19/promoting-choice-and-innovation-on-the-web/ https://blog.mozilla.org/blog/2014/11/19/promoting-choice-an...
- jdormit 10y ago
  On the other hand, I use Chrome on my Windows machine - the constant dialogs that pop up over the Edge shortcut whenever I load up Chrome telling me how great Edge is are really tiresome.
  - Twirrim 10y ago
    Odd. I use Firefox and haven't once seen those.
  - ronjouch 10y ago
    Ouch, that sucks. Haven't heard about those and haven't seen them yet.
  - ocdtrekkie 10y ago
    This is pretty much solely in retaliation for the incredibly annoying "Get Chrome" behavior Google has been engaging in heavily for years. Beyond privacy issues, just avoiding these incessant banners makes it worth avoiding Google websites.
  - kevin_thibedeau 10y ago
    On my work machine I have to use IE for some internal sites that arbitrarily block FF and Chrome. At least once a week IE10 opens a second tab on startup pitching the wonders of IE11 to me and offering to install it immediately.
    - ronjouch 10y ago
      That's different. MS wants you to upgrade to at least IE11 (or Edge) because IE10 is no longer supported [1], and keeping using it is dangerous. (But maybe you cannot upgrade because of !@#$% corporate policies.) [1] https://en.wikipedia.org/wiki/Internet_Explorer_10 https://en.wikipedia.org/wiki/Internet_Explorer_10 says "On January 12, 2016, support ended for IE10 on Windows operating systems capable of running Internet Explorer 11, due to new support policies dictating that only the newest version of IE available for a supported version of Windows will be supported. IE10 will only be supported on Windows Server 2012 and Windows Embedded 8 Standard."

DannyBee 10y ago

Kostya would be quite happy to have firefox using it :)

hannob 10y ago

Google actually did and does a whole lot to support firefox security. There's a lot of collaboration in the security space, e.g. Firefox and Chrome security teams heavily collaborate on fixing the TLS/CA ecosystem. Also the interest is very often shared, because a whole pile of libraries are used by both browsers: freetype, libjpeg-turbo, libpng, giflib, expat, webrtc, opus, ...

dgacmu 10y ago

I think that represents a fundamental misunderstanding of Google's incentives. (disclaimer: I'm typing this from Google, but it's purely my own opinion.) (And wishing my experiment would finish running faster.) Google's biggest revenue stream is ads. It has many others, but that's the big one. Ads are seen by people who use Google search, and who browse many ad-supported websites. Google also has a lot of users of its services, e.g., gmail, who have accounts. Some also entrust valuable data to Google. Google therefore has a great deal of incentive to make sure that: (a) Nobody messes with the ability of general users to browse the Internet safely (preserving ad revenue); and (b) It's very hard to compromise users computers and gain access to their Google/gmail/whatever accounts (reducing support costs and keeping users happy), or destroy their data, or exfiltrate it. Even if the compromise was the user's computer, it's still a very bad experience. Project zero is a pretty good example of this incentive structure in action. (such as fuzzing for windows font bugs: https://googleprojectzero.blogspot.com/2016/07/a-year-of-windows-kernel-font-fuzzing-2.html https://googleprojectzero.blogspot.com/2016/07/a-year-of-win... ). With fuzzing itself, as DannyBee alluded to below, one of the leads of a lot of this infrastructure, Kostya Serebryany, is also personally passionate about seeing it be taken up to make the software of the world better. I've seen this in action - he convinced me to use libFuzzer to improve TensorFlow's robustness, and mentioned that he was doing so in part so I'd take that experience back to Carnegie Mellon and spread the word. :) (and it worked - https://github.com/tensorflow/tensorflow/commit/7231d01fcb2cd9ef9ffbfea03b724892c8a4026e https://github.com/tensorflow/tensorflow/commit/7231d01fcb2c... for example).

ocdtrekkie 10y ago
One could argue, especially considering some of the disclosure situations surrounding Project Zero that have occurred, that it exists more to shame competitors than improve the world. :) To my knowledge, only like once have I heard the words "Project Zero" in relation to a flaw in Google software. But as Google definitely does do security testing on competitors' products such as Windows, it definitely goes to show that Google would be more than happy to test for security flaws in Firefox. And regardless of Google's motives, finding security flaws does, in the end, make a more secure Internet for everybody.