10 ms·

> We publish this report today, because the maximum embargo period of 90 days we offer has been exceeded. Most of the issues mentioned in this report are curren

by p-e-w 3y ago

> We publish this report today, because the maximum embargo period of 90 days we offer has been exceeded. Most of the issues mentioned in this report are currently not addressed by upstream, as is outlined in more detail below. > [...] > 2023-05-04: We privately shared the findings with security@...illa.org, offering coordinated disclosure according to the openSUSE disclosure policy. > Until 2023-06-12: There has been a lack of communication by upstream. Relevant questions about the disclosure process remained unanswered, there was no formal reply to our report and no wishes have been expressed about how to continue the coordinated disclosure, or what the next steps would be. > 2023-06-12: We learned that the embargo over this issue was violated by upstream via a GitHub PR [3] and, inspired by that, our community packager followed suit via another GitHub PR [5]. What a complete clusterfuck. It's unbelievable that in 2023, a company of Mozilla's stature appears to have no proper processes in place for handling serious security vulnerabilities even when they are being reported to them (for free!) by cooperative third parties. This taints the image of the entire product in my view.

TylerE 3y ago
In my eyes, at least, Mozilla has been tainted since the Pocket fiasco, if not before. That's when they made it obvious they'd sell their users off for a buck.
- p-e-w 3y ago
  Pocket is crapware, and I don't want it in my browser, and the way they forced it upon me left a bad aftertaste, but I still don't see how it constitutes "selling out their users". Pocket is actually owned by Mozilla. It's not like the data is going elsewhere or something.
  - Knee_Pain 3y ago
    The funny thing is that even though it's a Mozilla product now and even though it's somehow "integrated" in the browser, I still have to log into it separately regardless of the fact that I am already logged with with Firefox Sync
    - p-e-w 3y ago
      And that's more than six years after the acquisition. This was very poorly handled for sure.
      - AshamedCaptain 3y ago
        My wild guess is that they could not do a SSO with Pocket and Firefox Sync until they got rid of all the other authentication providers/methods that Pocket supported, a change which people like me would complain about.
        benterix 3y ago
        > My wild guess is that they could not do a SSO with Pocket and Firefox Sync until they got rid of all the other authentication providers/methods that Pocket supported Why? Technically, it shouldn't be impossible - one shouldn't exclude the other.
        mariusor 3y ago
        JavaScript that the Kobo can't execute for example. The browser/web view on Kobos is very very limited.
        internetter 3y ago
        Actually as a kobo owner I've always wondered what JavaScript it can execute, what styles it can render, ect. Always seemed wildly inconsistent. Any idea?
        mariusor 3y ago
        I suspect that very little, if any can be executed. No hard data nor first hand knowledge on that though.
      - deleted 3y ago
        [deleted]
  - anonymous_sorry 3y ago
    I was a Pocket user from before they were bought, so I wouldn't call it crapware personally. Isn't it just a way to sync a reading list across browsers, and have those pages pre-cached on a mobile device for reading when you have no connection? I'm interested in what people find objectionable about it. The strongest argument I've heard is that it's not core browser functionality, it was fine before Mozilla bought them, and therefore it's just a distraction/bloat for Firefox. Which is definitely arguable, but probably not a reason to write off the biggest independent browser.
    - spencerflem 3y ago
      As a Firefox appreciator, it's just not something I ever really wanted to use and it got a pretty prominent place in the UI when it came out. Has similar vibes to when windows added the weather forecast to the awesome bar. Imo the people making a big deal out of it are using it to justify why they're OK sticking with chrome (best case), or have a partisan political reason to hate Mozilla because of their ESG / DEI positions (ughhhhhh)
      - AshamedCaptain 3y ago
        I was a Pocket user basically since it launched (I was looking for an AvantGo replacement, so imagine that), and I still don't understand Mozilla's purchase or very heavy-handed advertisement of it.
        dralley 3y ago
        Simple: it's profitable. One of the few profitable side ventures they have. HN loves to simultaneously criticize Mozilla for 1) being utterly financially dependent on Google 2) putting resources into anything except Firefox 3) doing anything that smells like monetizing Firefox Spoiler alert: They can't avoid 1 without doing 2 or 3. It is what it is.
    - internetter 3y ago
      I'm bothered that it's still not open source, despite promises when it was first announced (it's been 6 years!)
- twelvechairs 3y ago
  What's the alternative though? All the others have already sold their users off ...
  - memefrog 3y ago
    The alternative is Mozilla not doing so.
  - TylerE 3y ago
    They're all effectively the same on that point, so I use the one who's interface I prefer, and which performs best on my hardware. Firefox is neither.
    - spencerflem 3y ago
      I cannot believe how much Hacker News equivocates: A browser made by an Ad Tech company that aims to lock down and control the web. And a browser made by a nonprofit that occasionally makes a minor mistep. You cannot seriously compare the remote attestation DRM, manifest v3 changes, to, what ? the Mr. Robot ad that was tacky? the pocket integration that's pointless and annoying but otherwise harmless? Seriously, y'alls double standards are insane and focuses so much towards how bad it was that Brendan Eich got kicked out that it comes off as extremely political
      - TylerE 3y ago
        I honestly don’t give an fuck about drm or attestatuon. There are only so many things one can find time to care about, and neither makes my list.
        spencerflem 3y ago
        Yeah, I'd understand not caring. That's a pretty common and reasonable take, though I'd hope a tech website like this would be more pro-privacy. But actively caring about browser companies, and choosing Chrome because Mozilla "sold out" when they added pocket is a pretty wild take imo.
- memefrog 3y ago
  [flagged]
  - monooso 3y ago
    Given how much flak Brave (and by extension Eich) gets on HN, it's somewhat ironic that you identify his departure as the moment when Mozilla abandoned its traditional values.
    - memefrog 3y ago
      HN is obviously, by its very nature, representative primarily of silicon valley.
      - TylerE 3y ago
        Much less so than 10 years ago, when 2/3rds of the posts were about either combination itself or companies taking part in the accelerator. This is VASTKY more popular and diverse now.
        p-e-w 3y ago
        Diverse in nationalities and backgrounds, yes. Diverse in viewpoints, not so much. The Overton window is quite narrow on HN, and I have the distinct impression it is narrowing further. Though I do admit that within that window, discourse is very lively, to the extent that a casual observer can easily be fooled into believing this is a place for free exchange of ideas.
        ekianjo 3y ago
        > This is VASTKY more popular and diverse now. How do you measure diversity on HN?
        TylerE 3y ago
        Looking at the amount of traffic coming from Non-US IPs would be a start. It was incredibly US centric back in the day.
lucideer 3y ago
> > 2023-06-12: We learned that the embargo over this issue was violated by upstream via a GitHub PR [3] To add further context, that PR violating the embargo: - removes authentication entirely instead of fixing it - discusses it as if they've discovered the CVE independently, even though it had seemingly been reported to them just 1 month prior. It may be that they did discover it independently, but the timing seems odd for a bug that existed for 3 years. - discusses it in an extremely casual way, as if the vuln is not severe. Honestly I don't know enough about the vectors here to know what type of CVSS it might end up with. --- Edit: Based on @AAchen's HN comment, it seems compromise requires local shell, so not an incredibly high severity it would seem. Still curious to see what NVD come out with.
- Dayshine 3y ago
  > Still curious to see what NVD come out with 9.8 It's always 9.8. To be fair, this is an application, so the score might be more grounded in reality. The CVEs I encounter as a developer are always insane and generally massive overreach from security to product design. It's not a vulnerability against all downstream libraries and applications that using some obviously unsafe C++ call might cause a DoS due to poor performance.
  - arghwhat 3y ago
    NVD scores and bug classifications are completely useless, as they are often entirely misclassified. My favorite being that they slap the "network" attack vector on things which are not at all network related or exploitable.
  - lucideer 3y ago
    CVSS is a poor metric because (by its own definition / admission) its got a very narrow intent: it doesn't really deal with exploitability in any meaningful way (like e.g. the shell access required here). There is a lot of ongoing discourse on its limitations, but its all in relatively early stages & imo its better to have something than nothing (especially when the maintainers of that "something" are aware of its limitations & actively working on better processes). If you have 10 security bugs, 3 are genuinely high severity and 9 get assigned high severity by NVD, then at least you've managed to deprioritise one of them. It's something (unironiccally). This is a pretty decent overview https://www.first.org/epss/model https://www.first.org/epss/model
littlestymaar 3y ago
> What a complete clusterfuck. It's unbelievable that in 2023, a company of Mozilla's stature appears to have no proper processes in place for handling serious security vulnerabilities even when they are being reported to them (for free!) by cooperative third parties. While I agree with your sentiment here, it's not exceptionnal at all and I've seen security researcher complaining about the same thing comming from at least Intel, Cisco and Google[1]! And I wouldn't be suprised if you could find example if that regarding Apple and Microsoft as well. [1] and for Google it was just one month ago: https://matan-h.com/google-has-a-secret-browser-hidden-inside-the-settings/ https://matan-h.com/google-has-a-secret-browser-hidden-insid...
mcpackieh 3y ago
This is what happens when lawyer/MBA executives fire technical workers to take those salaries for themselves. Mozilla, like fish, is rotting from the head.
- b59831 3y ago
  [dead]

by p-e-w 3y ago

TylerE 3y ago

In my eyes, at least, Mozilla has been tainted since the Pocket fiasco, if not before. That's when they made it obvious they'd sell their users off for a buck.

p-e-w 3y ago
Pocket is crapware, and I don't want it in my browser, and the way they forced it upon me left a bad aftertaste, but I still don't see how it constitutes "selling out their users". Pocket is actually owned by Mozilla. It's not like the data is going elsewhere or something.
- Knee_Pain 3y ago
  The funny thing is that even though it's a Mozilla product now and even though it's somehow "integrated" in the browser, I still have to log into it separately regardless of the fact that I am already logged with with Firefox Sync
  - p-e-w 3y ago
    And that's more than six years after the acquisition. This was very poorly handled for sure.
    - AshamedCaptain 3y ago
      My wild guess is that they could not do a SSO with Pocket and Firefox Sync until they got rid of all the other authentication providers/methods that Pocket supported, a change which people like me would complain about.
      - benterix 3y ago
        > My wild guess is that they could not do a SSO with Pocket and Firefox Sync until they got rid of all the other authentication providers/methods that Pocket supported Why? Technically, it shouldn't be impossible - one shouldn't exclude the other.
        mariusor 3y ago
        JavaScript that the Kobo can't execute for example. The browser/web view on Kobos is very very limited.
        internetter 3y ago
        Actually as a kobo owner I've always wondered what JavaScript it can execute, what styles it can render, ect. Always seemed wildly inconsistent. Any idea?
        mariusor 3y ago
        I suspect that very little, if any can be executed. No hard data nor first hand knowledge on that though.
    - deleted 3y ago
      [deleted]
- anonymous_sorry 3y ago
  I was a Pocket user from before they were bought, so I wouldn't call it crapware personally. Isn't it just a way to sync a reading list across browsers, and have those pages pre-cached on a mobile device for reading when you have no connection? I'm interested in what people find objectionable about it. The strongest argument I've heard is that it's not core browser functionality, it was fine before Mozilla bought them, and therefore it's just a distraction/bloat for Firefox. Which is definitely arguable, but probably not a reason to write off the biggest independent browser.
  - spencerflem 3y ago
    As a Firefox appreciator, it's just not something I ever really wanted to use and it got a pretty prominent place in the UI when it came out. Has similar vibes to when windows added the weather forecast to the awesome bar. Imo the people making a big deal out of it are using it to justify why they're OK sticking with chrome (best case), or have a partisan political reason to hate Mozilla because of their ESG / DEI positions (ughhhhhh)
    - AshamedCaptain 3y ago
      I was a Pocket user basically since it launched (I was looking for an AvantGo replacement, so imagine that), and I still don't understand Mozilla's purchase or very heavy-handed advertisement of it.
      - dralley 3y ago
        Simple: it's profitable. One of the few profitable side ventures they have. HN loves to simultaneously criticize Mozilla for 1) being utterly financially dependent on Google 2) putting resources into anything except Firefox 3) doing anything that smells like monetizing Firefox Spoiler alert: They can't avoid 1 without doing 2 or 3. It is what it is.
  - internetter 3y ago
    I'm bothered that it's still not open source, despite promises when it was first announced (it's been 6 years!)
twelvechairs 3y ago
What's the alternative though? All the others have already sold their users off ...
- memefrog 3y ago
  The alternative is Mozilla not doing so.
- TylerE 3y ago
  They're all effectively the same on that point, so I use the one who's interface I prefer, and which performs best on my hardware. Firefox is neither.
  - spencerflem 3y ago
    I cannot believe how much Hacker News equivocates: A browser made by an Ad Tech company that aims to lock down and control the web. And a browser made by a nonprofit that occasionally makes a minor mistep. You cannot seriously compare the remote attestation DRM, manifest v3 changes, to, what ? the Mr. Robot ad that was tacky? the pocket integration that's pointless and annoying but otherwise harmless? Seriously, y'alls double standards are insane and focuses so much towards how bad it was that Brendan Eich got kicked out that it comes off as extremely political
    - TylerE 3y ago
      I honestly don’t give an fuck about drm or attestatuon. There are only so many things one can find time to care about, and neither makes my list.
      - spencerflem 3y ago
        Yeah, I'd understand not caring. That's a pretty common and reasonable take, though I'd hope a tech website like this would be more pro-privacy. But actively caring about browser companies, and choosing Chrome because Mozilla "sold out" when they added pocket is a pretty wild take imo.
memefrog 3y ago
[flagged]
- monooso 3y ago
  Given how much flak Brave (and by extension Eich) gets on HN, it's somewhat ironic that you identify his departure as the moment when Mozilla abandoned its traditional values.
  - memefrog 3y ago
    HN is obviously, by its very nature, representative primarily of silicon valley.
    - TylerE 3y ago
      Much less so than 10 years ago, when 2/3rds of the posts were about either combination itself or companies taking part in the accelerator. This is VASTKY more popular and diverse now.
      - p-e-w 3y ago
        Diverse in nationalities and backgrounds, yes. Diverse in viewpoints, not so much. The Overton window is quite narrow on HN, and I have the distinct impression it is narrowing further. Though I do admit that within that window, discourse is very lively, to the extent that a casual observer can easily be fooled into believing this is a place for free exchange of ideas.
      - ekianjo 3y ago
        > This is VASTKY more popular and diverse now. How do you measure diversity on HN?
        TylerE 3y ago
        Looking at the amount of traffic coming from Non-US IPs would be a start. It was incredibly US centric back in the day.

lucideer 3y ago

> > 2023-06-12: We learned that the embargo over this issue was violated by upstream via a GitHub PR [3] To add further context, that PR violating the embargo: - removes authentication entirely instead of fixing it - discusses it as if they've discovered the CVE independently, even though it had seemingly been reported to them just 1 month prior. It may be that they did discover it independently, but the timing seems odd for a bug that existed for 3 years. - discusses it in an extremely casual way, as if the vuln is not severe. Honestly I don't know enough about the vectors here to know what type of CVSS it might end up with. --- Edit: Based on @AAchen's HN comment, it seems compromise requires local shell, so not an incredibly high severity it would seem. Still curious to see what NVD come out with.

Dayshine 3y ago
> Still curious to see what NVD come out with 9.8 It's always 9.8. To be fair, this is an application, so the score might be more grounded in reality. The CVEs I encounter as a developer are always insane and generally massive overreach from security to product design. It's not a vulnerability against all downstream libraries and applications that using some obviously unsafe C++ call might cause a DoS due to poor performance.
- arghwhat 3y ago
  NVD scores and bug classifications are completely useless, as they are often entirely misclassified. My favorite being that they slap the "network" attack vector on things which are not at all network related or exploitable.
- lucideer 3y ago
  CVSS is a poor metric because (by its own definition / admission) its got a very narrow intent: it doesn't really deal with exploitability in any meaningful way (like e.g. the shell access required here). There is a lot of ongoing discourse on its limitations, but its all in relatively early stages & imo its better to have something than nothing (especially when the maintainers of that "something" are aware of its limitations & actively working on better processes). If you have 10 security bugs, 3 are genuinely high severity and 9 get assigned high severity by NVD, then at least you've managed to deprioritise one of them. It's something (unironiccally). This is a pretty decent overview https://www.first.org/epss/model https://www.first.org/epss/model

littlestymaar 3y ago

> What a complete clusterfuck. It's unbelievable that in 2023, a company of Mozilla's stature appears to have no proper processes in place for handling serious security vulnerabilities even when they are being reported to them (for free!) by cooperative third parties. While I agree with your sentiment here, it's not exceptionnal at all and I've seen security researcher complaining about the same thing comming from at least Intel, Cisco and Google[1]! And I wouldn't be suprised if you could find example if that regarding Apple and Microsoft as well. [1] and for Google it was just one month ago: https://matan-h.com/google-has-a-secret-browser-hidden-inside-the-settings/ https://matan-h.com/google-has-a-secret-browser-hidden-insid...

mcpackieh 3y ago

This is what happens when lawyer/MBA executives fire technical workers to take those salaries for themselves. Mozilla, like fish, is rotting from the head.

b59831 3y ago
[dead]