7 ms·
A Year in Review of 0-days Exploited In-the-Wild in 2022
- canucyc 3y ago[dead]
- technion 3y agoMicrosoft Exchange being listed alongside entire operating systems with comparable numbers of ITW vulnerabilities is somewhat something I relate to after running such systems.
- deleted 3y ago[deleted]
- ptx 3y ago> The Android security team then decided that they considered the issue a “Won’t Fix” because it was “device-specific”. However, Android Security referred the issue to ARM. [...] While ARM had released the fixed driver version in October 2022, the vulnerability was not fixed by Android until April 2023 What's going on there? If bug is in Android's source repo, where it has to be fixed and released by the Android team, it seems like a valid bug in Android. Marking it "Won't Fix" seems inappropriate since they did eventually fix it.
- CountHackulus 3y agoPage doesn't seem to load at all on Firefox.
- jonathanstrange 3y agoIt loads a page with a large heading and no content in my Firefox. I'll just assume an empty page is Google's take on security in general.
- jeroenhd 3y agoIt works fine for me on Android
- ungamedplayer 3y agoGoog must not. E acknowledging other browsers anymore.
- notamy 3y agoIt seems fine on my machine -- albeit a hair slow. Do you have JS enabled? I think it's required.
- badRNG 3y agoSame issue, doesn't load on vanilla Firefox.
- j16sdiz 3y agoIt loads on Firefox on my Samsung phone.
- woodruffw 3y agoLoads for me just fine on Firefox 116, on Linux.
- TacticalCoder 3y agoDoesn't load for me (FF on Linux).
- cpeterso 3y agoAre you using an ad blocker? Maybe try disabling your add-ons and reloading. The site loads fine for me in Firefox 117 (Nightly) on macOS.
- tgv 3y agoDoesn't load for me (115, macOS), but I do have uBlock Origin, which blocks two domains and some "3rd party" scripts. Google will always be Google, and I'm not going to unblock those.
- consumer451 3y agoSame for me, it appears that this URL is being blocked by FF. Is that was is causing the issue? https://2542116.fls.doubleclick.net/activityi;src=2542116;type=gblog;cat=googl0;ord=ord=2843658524275.7886 https://2542116.fls.doubleclick.net/activityi;src=2542116;ty...?
- technion 3y agouBlock on Edge blocks that same URL and the page works fine without it.
- jefftk 3y agoI see that URL being blocked but the site still loads. I just tested this on v114, v115, and nightly (117.0a1 (2023-07-31) (64-bit)) and couldn't reproduce. On nightly, I tried setting Enhanced Tracking Protection to strict and installing uBlock Origin, and still couldn't get it to show a blank screen. (MacOS 13.4.1)
- consumer451 3y agoI see the issue on 115.03 on Windows and MacOS. https://i.imgur.com/XLfgy3K.png https://i.imgur.com/XLfgy3K.png
- jefftk 3y agoDo you see any failing network requests in devtools, other than the doubleclick one?
- consumer451 3y agoNo, I do not, FF on Win10: https://i.imgur.com/KfSAp57.png https://i.imgur.com/KfSAp57.png I should add that on Safari, the content part of the page does take a long time to load or render.
- consumer451 3y agoI believe that I see you in the web-bugs issue, so to add more info, here is a safari screenshot with the crazy slow load time. I am getting 52Mbps from fast.com at the moment, rest of the web is snappy. In chrome it takes ~9.25s to finish rendering which is still slow compared to other sites imo. Safari (MacOS 11.4 on late 2012 Mac Mini): https://i.imgur.com/iNo50sU.png https://i.imgur.com/iNo50sU.png
- saagarjha 3y agoTook a while to load in mobile Safari as well, but it did eventually when I waited a while. Interestingly it works almost immediately in desktop Safari?
- asplake 3y agoLoaded fine first time for me
- muizelaar 3y agohttps://github.com/webcompat/web-bugs/issues/125193 https://github.com/webcompat/web-bugs/issues/125193
- mccr8 3y agoFWIW, I filed a bug a few days ago for the issue I was seeing. A profile showed that Firefox was spending all of its time evaluating a regex. Which is weird because Chrome uses the same regex engine. https://bugzilla.mozilla.org/show_bug.cgi?id=1845775 https://bugzilla.mozilla.org/show_bug.cgi?id=1845775
- brobinson 3y agoHere's a mirror: https://archive.is/U8YTo https://archive.is/U8YTo
- loeg 3y ago> These gaps between upstream vendors and downstream manufacturers allow n-days - vulnerabilities that are publicly known - to function as 0-days because no patch is readily available to the user and their only defense is to stop using the device. While these gaps exist in most upstream/downstream relationships, they are more prevalent and longer in Android. Ouch. Maybe acknowledging it means that they can act on improving that ecosystem with their downstreams?
- mminer237 3y agoIt's not even just downstream vendors. Google itself only supports its devices for three years. I bought a Pixel 4a on release in 2020 and next month will be my last security update. https://support.google.com/nexus/answer/4457705 https://support.google.com/nexus/answer/4457705 Can you imagine if Apple or Microsoft stopped making OS updates for CPUs more than three years old?
- IAmLiterallyAB 3y agoThey've bumped it up to 5 years for Pixel 6 and later https://support.google.com/pixelphone/answer/4457705#zippy=%2Cpixel-later https://support.google.com/pixelphone/answer/4457705#zippy=%...
- doubled112 3y agoI was annoyed when the announced 1st gen Ryzen isn't supported in Windows 11.
- needusername 3y agoYou can’t expect part time open source contributors to work for free for you. Instead volunteer to take over maintenance by reviewing PRs and traiging user bug reports.
- superlupo 3y agoBut you still get security fixes for Windows 10 for years to come
- vinay_ys 3y agoThis url gave me https certificate error.
- totetsu 3y agoits interesting to see all the "Subject Alt Names" signed in that cert. https://tfhub.dev/google/bird-vocalization-classifier/3 https://tfhub.dev/google/bird-vocalization-classifier/3 is neat