4 ms·

In the common scenario of a single user, on a single user machine, running programs under his uid, the benefit is basically zero. If such a user wants to run u

In the common scenario of a single user, on a single user machine, running programs under his uid, the benefit is basically zero. If such a user wants to run untrusted programs, he'd use a virtual machine anyway. So, I think it's very easy to overstate the benefit, and your comment did just that.

pcwalton 4y ago
Scenario: evil.com wants to take advantage of a use-after-free in some DOM API to install a keylogger. Before X11 isolation, it can: (1) get RCE in content process; (2) send events to your GNOME Shell to open a terminal; (3) send keyboard events to the terminal to download the keylogger, start it, and add it to some config file that makes it start automatically on future logins. After X11 isolation, it will: (1) get RCE in content process; (2) get stopped because it can't send keyboard/mouse events to other applications anymore.
- throwaway_58291 4y ago
  By the probability of this risk scenario (visit evil.com, be the victim of a successful RCE, with a particular method of privilege escalation that somehow gets all the right details to work) it sure looks to me like you overstated the expected benefit (negative loss). I do concede that our utility functions may differ, if you actually believe it and not just inflating the importance of this issue. Also I may have a bias in that I disable JavaScript by default, so the probability of such a risk is much lower. I tried to not make that assumption though, in judging the expected loss.
  - pcwalton 4y ago
    You are vastly overstating the difficulty of pivoting X11 access to complete system compromise with the "somehow gets all the right details to work" phrase. It's trivial. People have literally gotten killed because of this type of attack. Yes, hostile nation-states probably don't care enough about you personally, but there are people for whom this is a life-and-death matter. The one thing that reduces the impact of this is that it's Firefox on Linux, which is a niche browser on a niche OS, but desktop Linux Firefox is a product that Mozilla officially ships, which means that it's Mozilla's responsibility to protect its users.
    - throwaway_58291 4y ago
      > It's hard to overstate how much of a benefit this is in terms of security for those on Linux. I assumed you talked about "those on Linux", not "those on Linux who have non-negligible probability of being targeted by hostile nation-states". It's often difficult to step back and re-evaluate initial claims, and we sometimes choose to use tactics like zooming in on improbable contexts to justify them. But I think it's healthy to face criticism that may snap us out of it, so I'm writing this comment. But it's late now, so I will not be able to follow up anymore. P.S. I don't have GNOME installed :)
    - heavyset_go 4y ago
      Nation states aren't the only threat. There are billion dollar organized crime and fraud networks that have the means to both collect, and successfully weaponize, such RCEs.
  - heavyset_go 4y ago
    It's been a bit since I've looked, but browser RCEs are particularly expensive and coveted. They're a potential vector for 1-click soft/hard roots in homebrew and hacking communities, and of course, 1-click RCEs are invaluable to anyone who has the resources to obtain them and victims to exploit.
    - throwaway_58291 4y ago
      I take this to mean that you think they are rare, confirming a part of my assessment on the probability of risk. Since I cannot reply to your other comment, I will respond here. What proportion of Firefox-Linux users do you think are victims of such RCE attacks?
      - staticassertion 4y ago
        Good point, why even bother pushing out patches?
      - potatoz2 4y ago
        They are definitely rare, but once they exist they can spread like wildfire because people (usually correctly) trust browsers to sandbox websites. Put another way, browsers run untrusted programs day in and day out on virtually all sorts of otherwise trusted devices (including enterprise devices) so the impact is gigantic.
- Fnoord 4y ago
  Isn't it a better idea to simply use Wayland?
  - pcwalton 4y ago
    The best idea would be to use Wayland in addition to these new Firefox process isolation features. That provides multiple layers of defense against possible sandbox escapes and exploitable bugs in the Wayland server.
Gigachad 4y ago
>If such a user wants to run untrusted programs, he'd use a virtual machine anyway. In your imaginary world. Real users don't know what a VM is and expect their system to be able to run untrusted programs without exposing all of their data. Which they are able to do on most modern systems.
- throwaway_58291 4y ago
  We are talking about users of the Linux operating system. Many of them do know what a VM is. If they don't, or if they expect to be able to run untrusted programs willy nilly, then the benefit of Firefox doing this is, again, basically zero. As I cannot reply to your reply, I will write the response here. By using Wayland, surely the direct benefit of this change to you is zero...
  - Gigachad 4y ago
    I use Linux and I don't audit the source and dependencies of every single program I use or run things in VMs. I do expect wherever possible that programs run in a sandbox with the most limited set of permissions. I have been running almost everything in Flatpak on Wayland and it seems to clearly be the future.
lozenge 4y ago
Well, end user, all your files may be held for crypto ransom, but at least the machine is untouched! Very High Security!
chlorion 4y ago
Wat I don't think you actually understand what's going on here. The untrusted programs in this case would be javascript and other exploitable things that firefox interprets every time you visit a webpage. Unless you run firefox itself under a different UID or inside of a VM you are effected by this, regardless of whether you are running other "untrusted" software or not. Maybe you are thinking that using X11 as an attack vector requires a "bad" program running in addition to firefox? If so, that is not the case, any program that is running on X11 that can execute commands or read and write files could be used for this purpose. A terminal emulator is a pretty good example of such a program.
- taviso 4y ago
  Even if firefox was running under a different UID, they would still have to grant it access to the X server via xhost/xauth or whatever. They have certainly misunderstood the attack. Claiming this has zero utility is effectively saying sandboxing is useless, which is just plain wrong. Congratulations to Mozilla for getting this shipped!

pcwalton 4y ago

Scenario: evil.com wants to take advantage of a use-after-free in some DOM API to install a keylogger. Before X11 isolation, it can: (1) get RCE in content process; (2) send events to your GNOME Shell to open a terminal; (3) send keyboard events to the terminal to download the keylogger, start it, and add it to some config file that makes it start automatically on future logins. After X11 isolation, it will: (1) get RCE in content process; (2) get stopped because it can't send keyboard/mouse events to other applications anymore.

throwaway_58291 4y ago
By the probability of this risk scenario (visit evil.com, be the victim of a successful RCE, with a particular method of privilege escalation that somehow gets all the right details to work) it sure looks to me like you overstated the expected benefit (negative loss). I do concede that our utility functions may differ, if you actually believe it and not just inflating the importance of this issue. Also I may have a bias in that I disable JavaScript by default, so the probability of such a risk is much lower. I tried to not make that assumption though, in judging the expected loss.
- pcwalton 4y ago
  You are vastly overstating the difficulty of pivoting X11 access to complete system compromise with the "somehow gets all the right details to work" phrase. It's trivial. People have literally gotten killed because of this type of attack. Yes, hostile nation-states probably don't care enough about you personally, but there are people for whom this is a life-and-death matter. The one thing that reduces the impact of this is that it's Firefox on Linux, which is a niche browser on a niche OS, but desktop Linux Firefox is a product that Mozilla officially ships, which means that it's Mozilla's responsibility to protect its users.
  - throwaway_58291 4y ago
    > It's hard to overstate how much of a benefit this is in terms of security for those on Linux. I assumed you talked about "those on Linux", not "those on Linux who have non-negligible probability of being targeted by hostile nation-states". It's often difficult to step back and re-evaluate initial claims, and we sometimes choose to use tactics like zooming in on improbable contexts to justify them. But I think it's healthy to face criticism that may snap us out of it, so I'm writing this comment. But it's late now, so I will not be able to follow up anymore. P.S. I don't have GNOME installed :)
  - heavyset_go 4y ago
    Nation states aren't the only threat. There are billion dollar organized crime and fraud networks that have the means to both collect, and successfully weaponize, such RCEs.
- heavyset_go 4y ago
  It's been a bit since I've looked, but browser RCEs are particularly expensive and coveted. They're a potential vector for 1-click soft/hard roots in homebrew and hacking communities, and of course, 1-click RCEs are invaluable to anyone who has the resources to obtain them and victims to exploit.
  - throwaway_58291 4y ago
    I take this to mean that you think they are rare, confirming a part of my assessment on the probability of risk. Since I cannot reply to your other comment, I will respond here. What proportion of Firefox-Linux users do you think are victims of such RCE attacks?
    - staticassertion 4y ago
      Good point, why even bother pushing out patches?
    - potatoz2 4y ago
      They are definitely rare, but once they exist they can spread like wildfire because people (usually correctly) trust browsers to sandbox websites. Put another way, browsers run untrusted programs day in and day out on virtually all sorts of otherwise trusted devices (including enterprise devices) so the impact is gigantic.
Fnoord 4y ago
Isn't it a better idea to simply use Wayland?
- pcwalton 4y ago
  The best idea would be to use Wayland in addition to these new Firefox process isolation features. That provides multiple layers of defense against possible sandbox escapes and exploitable bugs in the Wayland server.

Gigachad 4y ago

>If such a user wants to run untrusted programs, he'd use a virtual machine anyway. In your imaginary world. Real users don't know what a VM is and expect their system to be able to run untrusted programs without exposing all of their data. Which they are able to do on most modern systems.

throwaway_58291 4y ago
We are talking about users of the Linux operating system. Many of them do know what a VM is. If they don't, or if they expect to be able to run untrusted programs willy nilly, then the benefit of Firefox doing this is, again, basically zero. As I cannot reply to your reply, I will write the response here. By using Wayland, surely the direct benefit of this change to you is zero...
- Gigachad 4y ago
  I use Linux and I don't audit the source and dependencies of every single program I use or run things in VMs. I do expect wherever possible that programs run in a sandbox with the most limited set of permissions. I have been running almost everything in Flatpak on Wayland and it seems to clearly be the future.

lozenge 4y ago

Well, end user, all your files may be held for crypto ransom, but at least the machine is untouched! Very High Security!

chlorion 4y ago

Wat I don't think you actually understand what's going on here. The untrusted programs in this case would be javascript and other exploitable things that firefox interprets every time you visit a webpage. Unless you run firefox itself under a different UID or inside of a VM you are effected by this, regardless of whether you are running other "untrusted" software or not. Maybe you are thinking that using X11 as an attack vector requires a "bad" program running in addition to firefox? If so, that is not the case, any program that is running on X11 that can execute commands or read and write files could be used for this purpose. A terminal emulator is a pretty good example of such a program.

taviso 4y ago
Even if firefox was running under a different UID, they would still have to grant it access to the X server via xhost/xauth or whatever. They have certainly misunderstood the attack. Claiming this has zero utility is effectively saying sandboxing is useless, which is just plain wrong. Congratulations to Mozilla for getting this shipped!