4 ms·
RomCom exploits Firefox and Windows zero days in the wild
- galangalalgol 2y ago[flagged]
- oguz-ismail 2y ago[flagged]
- do_not_redeem 2y agoHis name is galangalalgol. Fashionable, visionary leader of the rust evangelism strike force. And don't you forget it. (Read in the voice of Tribore Menendez)
- galangalalgol 2y agoOk that is pretty funny. It is the first time anyone has used any of those adjectives about me even in satire. Didn't mention rust though. I like it a lot, but it is just one tool. F*, agda etc all probably have a more fundamental part to play than rust does. Rust is just the one we can use at scale.
- dmitrygr 2y ago> If you add new code to a sw project in c or c++ that should be a solid case for negligence when your customers sue for losses. Sure, as long as you are ok being similarly sued next time you install or use windows, macos, or linux on some box you administer. Those are all written in C. I guess you're OS-less until you write one in something safe. Ditto for web browsers and bootloaders.
- galangalalgol 2y agoWasn't the first cut at windows me written in c#, maybe we can start there. The servo browser on redox isn't even completely free of c I think.
- qskousen 2y agoWindows ME was the worst Windows though.
- edm0nd 2y agoHard agree. Windows 98SE SP2 was the best
- do_not_redeem 2y agoVista was the worst in my book. And Vista was actually the real turning point when C# started to infect Windows.
- gpm 2y agoServo relies on firefox's JS runtime spidermonkey, written in C++.
- ekr____ 2y agoMoreover, a significant fraction of JS vulnerabilities are logic errors in the JIT, so even if the JIT itself is memory safe, that doesn't make the resulting code free of vulnerabilities.
- smitelli 2y agoWindows ME was just Win98SE in an ugly sweater. Mostly C/C++ with some assembly peppered in.
- xahrepap 2y agoMaybe you’re thinking of this? https://en.m.wikipedia.org/wiki/Singularity_(operating_system) https://en.m.wikipedia.org/wiki/Singularity_(operating_syste...
- njtransit 2y agoIt’s not negligent it use an unsafe OS if no safer options exist. It is negligent to use an unsafe language when safe alternatives exist.
- gigel82 2y agoVisual programming like Scratch is safer than Rust so it's negligent if we don't all use Scratch next. Also, everyone should pee sitting down by law because some are known to pee to on their pants otherwise. /s
- lmm 2y ago> next time you install or use windows, macos, or linux on some box you administer. I don't administer other people's boxes, I provide them with programs written in safe languages (as a bootable unikernel if they want). If they choose to run them on a buggy OS that's on them.
- ClassyJacket 2y agoI exaggerate alot but even by my standards this is ridiculous hyperbole. Rust just isn't supported on alot of platforms and libraries.
- galangalalgol 2y agoI didn't mention rust. If you were targeting something that only has a c compiler and it is critical infrastructure, f* could prove correctness and then generate c from that as an ir. A lot of safety crtical stuff uses a DSL to generate c that humans don't touch afterwards.
- throw16180339 2y ago[flagged]
- tux3 2y agoThe headline is about Firefox on Windows for a good reason: that's where the regular users are. If you want Rust on Nonstop, a niche proprietary platform, your large financial company is welcome to invest in it.
- steveklabnik 2y agoFun fact, there has been some investigation into Rust for Nonstop, but it’s just not feasible. Like a lot of software. I hear they tried to port gcc multiple times and failed too…
- lmm 2y ago> AIX, i/OS, z/OS, Nonstop OS, OpenVMS, or Stratus VOS A list of which Firefox runs on precisely none.
- jiggawatts 2y agoAren't most of these servers operating systems anyway, with no GUI desktops?
- hulitu 2y agoAFAIK X windows runs on AIX and VMS.
- jiggawatts 2y agoSure, but does anyone do that, anywhere in the world?
- lmm 2y agoI do run X on OpenVMS occasionally, as it happens. But there's not really anything to do there.
- deleted 2y ago[deleted]
- elphinstone 2y agoGood on Mozilla for the rapid response.
- userbinator 2y agoJavaScript file containing the exploit Another reason to turn off JS by default.