3 ms·

Chromium likely has plenty of "dormant" bugs - bugs that exist in the source code, but consistently compile to safe (or unreachable) machine code, more or less

Chromium likely has plenty of "dormant" bugs - bugs that exist in the source code, but consistently compile to safe (or unreachable) machine code, more or less due to good luck. This project messes with optimisation flags, which have a good chance of "waking up" those bugs (If you've ever had code work at -O1 but not at -O3, you know what I'm talking about). The same goes for compiler bugs, too. The real Chromium is aggressively fuzz tested, but this project is almost certainly not, or at least, not to the same extent. Turning on features like JPEG-XL also increases attack surface.

Const-me 2y ago
OTOH, the original Chromium is so popular that the motivation of finding these bugs is very high. I think zero-day RCE bugs can be sold for tons of money on the black market. However, the motivation to find similar bugs in Thorium is very low, too few users. And because the project messes with compiler flags, there’s chance at least some of the Chromium bugs don’t apply to the fork, because the machine code is different. Or maybe they apply but require adjustments to the exploit, which most attackers won’t do because too few users of the fork.
- resource_waste 2y ago
  This is one of the interesting parts about owning obscure phones. I cannot imagine having anything important on an iPhone since there is a huge demand to find a bug in the hardware/OS layer. (And we've seen this live in the wild with multiple 0 click exploits) Meanwhile obscure phones could only be targeted by Pegasus by: 1. Go to a website and download an app 2. Change your settings to allow this app to install 3. Change another setting to allow this app to install. I mean... not really elite hackers, I had to do this for my own Android app.
mmebane 2y ago
It also usually only gets one release per upstream major version (and sometimes not even that), meaning a lot of Chromium security fixes can take several weeks to show up in a Thorium release. I appreciate the author's effort, but it's definitely riskier than normal Chrome/Chromium.

Const-me 2y ago

OTOH, the original Chromium is so popular that the motivation of finding these bugs is very high. I think zero-day RCE bugs can be sold for tons of money on the black market. However, the motivation to find similar bugs in Thorium is very low, too few users. And because the project messes with compiler flags, there’s chance at least some of the Chromium bugs don’t apply to the fork, because the machine code is different. Or maybe they apply but require adjustments to the exploit, which most attackers won’t do because too few users of the fork.

resource_waste 2y ago
This is one of the interesting parts about owning obscure phones. I cannot imagine having anything important on an iPhone since there is a huge demand to find a bug in the hardware/OS layer. (And we've seen this live in the wild with multiple 0 click exploits) Meanwhile obscure phones could only be targeted by Pegasus by: 1. Go to a website and download an app 2. Change your settings to allow this app to install 3. Change another setting to allow this app to install. I mean... not really elite hackers, I had to do this for my own Android app.

mmebane 2y ago

It also usually only gets one release per upstream major version (and sometimes not even that), meaning a lot of Chromium security fixes can take several weeks to show up in a Thorium release. I appreciate the author's effort, but it's definitely riskier than normal Chrome/Chromium.