6 ms·
Just ran checksec on Pale Moon's Linux binary distribution - their binaries are built with no mitigations whatsoever. ASLR disabled, no stack canaries, no forti
by lima 7y ago
Just ran checksec on Pale Moon's Linux binary distribution - their binaries are built with no mitigations whatsoever. ASLR disabled, no stack canaries, no fortify.
This whole project appears to be a security disaster and nobody should use it.
- q3k 7y agoThey're generally pretty unprofessional. https://github.com/jasperla/openbsd-wip/issues/86 https://github.com/jasperla/openbsd-wip/issues/86
- drusepth 7y agoThis read was amazing, and I would fully recommend it for someone self-isolating with a hot cup of coffee who wants a jolly read about how not to communicate with others.
- oefrha 7y agoI feel for the OpenBSD developer who apparently expected the project lead to be a reasonable grown-up, but ended up slapped in the face.
- cultus 7y agoyikes. That's about the most insane exchange I've seen on Github.
- lsaferite 7y agoThat exchange borders on unbelievable for me. How any project could be so tone deaf is beyond comprehension. And the initial message from the PM project is more than enough to set anyone off.
- stickfigure 7y agoThis issue is now officially resolved. There will be no Pale Moon browser, official or not. The port has been removed. Farewell, petulant children. Beautiful response.
- lonelappde 7y agoPetulance is independent of age.
- tya99 7y agoThen there's this one from privacytools.io where they disregard criticism as "Fake News" https://github.com/privacytoolsIO/privacytools.io/issues/375#issuecomment-454704963 https://github.com/privacytoolsIO/privacytools.io/issues/375... and get all upset at people for "shitting on them". (Note mattatobin is also one of their devs).
- superkuh 7y agoThe real security disaster on the modern web is commercial groups taking over setting standards and turning the web browser into an OS with all the security problems that entails.
- lima 7y agoThe opposite is the case - web applications are one of the best things to happen, security-wise, in a long time. Web applications are fully isolated and sandboxed, have fine-grained permissions, are easy to inspect, and the runtime is built with a modern threat model. ChromeOS is probably the most secure desktop OS for this reason. I want my browser to expose more functionality to web apps, because it means that I have to run less random unsandboxed code on my underlying OS.
- ticviking 7y agoI'd like it more if my underlying OS provided these features instead of running an OS on my OS.
- lima 7y agoWe need both - some kinds of applications need direct hardware access. But the kernel attack surface is huge, even with seccomp and friends. An app on my smartphone or - much worse - an Electron app "sandboxed" in a flatpak on my desktop has access to far wider range of dangerous APIs than a web application. What's wrong with a browser as a high-level OS?
- ticviking 7y agoIt's mostly the layering that bothers me. I don't mind Chrome OS and love my chromebook. Some of this is aesthetic so I don't really expect to change minds, but if we lived in the world of "Life and Death of Javascript" and booted to some kind of Web OS I'd be annoyed at the loss of low level hackibility and get over it. Booting to Linux, then booting a browser to get to a normal app that doesn't need network connectivity "feels" wrong.
- laurent123456 7y agoWhy was it used at all if it's basically an old fork of Firefox? Just curious as I've never heard of it before.
- eropple 7y ago"Customization." It retains the older, Firefox ~25-ish UI. They've since upgraded the backend to Firefox 52, which is still Really Old. And they've got a lot of culty behavior around their community, if that's your bag. If you absolutely must have an XUL-based Firefox derivative: 1) you don't, 2) stop, and 3) don't use this one if you don't listen to #1 or #2.
- LordLestat 7y agoCustomization is no crime. Simplicity and minimalism is way worse... You think that this is what power-users would accept? Why use people Vivaldi, Otter, Seamonkey for example? Because they WANT features. People HAVE THE RIGHT to demand THAT. Rather selfish opinion of yours, to deny power users rights! Is this a democracy or leftist fascist dictatorship? BC that is how the leftist fascists argue.... NO features which simple users do NOT understand as that would violate their safe space! Honestly...
- eropple 7y agoYes, I have seen your frothing Reddit posts, you don't have to repeat them here. "Leftist fascist"--can I give you a bit of free advice? If you have to modify "fascist", everyone and their dog knows it's because you have to modify your slur to make the mirror a little more palatable. Maybe find some new ones. But I reject the square-peg premise you're trying to jam into that round hole anyway, as it's not a democracy, either. Your choices impact your neighbors without their consent. It's not about fucking over power users or whatever the weird little epistemic enclosure you come from wants to insist it is, it's about addressing technical debt both in terms of performance and security--and the latter matters quite a lot in terms of not enabling people who think they're power users to 1) blow their own leg off, and 2) blow the legs off the people next to them. That's why those "leftist fascist" evil scary Firefox people decided "hey, let's patch some of these up." Customization, in and of itself, is fine (modulo the combinatoric explosion that leads to security holes). Few enough people would disagree with that, though I understand that the aforementioned epistemic closure holds as axiomatic that everybody just hates the tweaker types. On the other hand, customization at the expense of competent security development, which is what you get with Pale Moon, is not. And seeing as how there certainly doesn't seem to be much in the way of developer competence, to the point where "don't use the stuff that upstream has working just fine because we can't figure it out" is a legitimate attempt at "discussion", it ought to be dumpstered. Somehow, this "power user" (god, I hate that term) gets by just fine with poor, benighted Firefox--having switched to it from Chrome/Safari after Quantum because it finally felt as pleasant to use as back in The Day. Clearly, though, that just makes me a radical-left SJW hater or something. But that's fine. Modern Firefox is heckin' great.
- smnthermes 7y ago> their binaries are built with no mitigations whatsoever. ASLR disabled, no stack canaries, no fortify. Provide evidence.
- lima 7y agoAnyone can easily verify this by downloading the binaries, and running checksec themselves. Here's the output: $ sha256sum palemoon-bin 0b7f4ad73fc671e20bfb2366aa9d9ad81e82a3c8f63acde7f37063e73fda2141 palemoon-bin $ checksec --file=./palemoon-bin --output=json --extended | jq { "./palemoon-bin": { "relro": "partial", "canary": "no", "nx": "yes", "pie": "no", "clangcfi": "no", "safestack": "no", "rpath": "no", "runpath": "no", "symbols": "no", "fortify_source": "no", "fortified": "0", "fortify-able": "15" } } Notably, the binary has not been compiled with -fPIE and -fstack-protector, which disables two very basic exploit mitigations - ASLR and stack canaries. Any self-respecting Linux distribution enables these compiler flags by default nowadays. -D_FORTIFY_SOURCE is also missing, unlike Chrome or Firefox. A modern browser uses dozens of custom binary exploitation mitigations in addition to this. Mitigations and sandboxing are the difference between an exploit a CTF player can write on an afternoon, and a multi-month expert-level endeavour.