5 ms·

Any reason P0 doesn't seem to direct some time and energy towards finding zero days in Firefox? Are they mandated to only investigate codebases of interest to G

Any reason P0 doesn't seem to direct some time and energy towards finding zero days in Firefox? Are they mandated to only investigate codebases of interest to Google?

asdfasgasdgasdg 7y ago
Hah. That's so the opposite of the usual complaint! Normally people complain that P0 never does write-ups on Google stuff. Maybe there are concerns about the PR aspects of releasing info about FF vulns?
- whoopdedo 7y ago
  Compare this to the recent report about Samsung's kernel patches. It's not Project Zero in the headlines but "Google accuses Samsung of making inappropriate changes to Android."
- tptacek 7y ago
  I think people are overthinking this, and P0 just writes about whatever cool shit comes up in their work, as and when they are able to write about it given embargoes and their workload.
kingkilr 7y ago
(Former Firefox Security Engineer) I suspect it's because Firefox exploits have looked the same for the last several years -- there has not been a lot of novelty required to implement an exploit, given an arbitrary read/write primitive. P0 does report vulnerabilities to Firefox though, and they obviously get fixed, they're just not particularly interesting to exploit.
- arkadiyt 7y ago
  Perhaps that'll change once Project Fission lands in the stable release
- saagarjha 7y ago
  > I suspect it's because Firefox exploits have looked the same for the last several years -- there has not been a lot of novelty required to implement an exploit, given an arbitrary read/write primitive. Surely other browsers do not differ from this significantly?
  - tedunangst 7y ago
    An arbitrary write primitive in the chrome render process hasn't been game over for quite some time.
    - saagarjha 7y ago
      I mean, is it on Firefox?
      - tedunangst 7y ago
        Until a year ago(?), yes.
mmxmb 7y ago
They do find zero days in Firefox. The most recent that comes to mind: https://www.mozilla.org/en-US/security/advisories/mfsa2019-18/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-1...

Any reason P0 doesn't seem to direct some time and energy towards finding zero days in Firefox? Are they mandated to only investigate codebases of interest to Google?

asdfasgasdgasdg 7y ago

Hah. That's so the opposite of the usual complaint! Normally people complain that P0 never does write-ups on Google stuff. Maybe there are concerns about the PR aspects of releasing info about FF vulns?

whoopdedo 7y ago
Compare this to the recent report about Samsung's kernel patches. It's not Project Zero in the headlines but "Google accuses Samsung of making inappropriate changes to Android."
tptacek 7y ago
I think people are overthinking this, and P0 just writes about whatever cool shit comes up in their work, as and when they are able to write about it given embargoes and their workload.

kingkilr 7y ago

(Former Firefox Security Engineer) I suspect it's because Firefox exploits have looked the same for the last several years -- there has not been a lot of novelty required to implement an exploit, given an arbitrary read/write primitive. P0 does report vulnerabilities to Firefox though, and they obviously get fixed, they're just not particularly interesting to exploit.

arkadiyt 7y ago
Perhaps that'll change once Project Fission lands in the stable release
saagarjha 7y ago
> I suspect it's because Firefox exploits have looked the same for the last several years -- there has not been a lot of novelty required to implement an exploit, given an arbitrary read/write primitive. Surely other browsers do not differ from this significantly?
- tedunangst 7y ago
  An arbitrary write primitive in the chrome render process hasn't been game over for quite some time.
  - saagarjha 7y ago
    I mean, is it on Firefox?
    - tedunangst 7y ago
      Until a year ago(?), yes.

mmxmb 7y ago

They do find zero days in Firefox. The most recent that comes to mind: https://www.mozilla.org/en-US/security/advisories/mfsa2019-18/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-1...