justinschuh

17 ms·

91.
by justinschuh 13y ago
I asked for the bug ID so that I could verify it was triaged properly, not because the report isn't public. Some reports (like security bugs) are initially private, as is typical in any open source project. However, security bug report
92.
by justinschuh 13y ago
I can assure you that Google takes VRP reports very seriously. Two members of Google security (f- and adobkin) have provided context elsewhere in this thread on the bug described in the post. As for the Chrome report you mention, if you pro
93.
by justinschuh 13y ago
I appreciate your frustration, but I think you may be misunderstanding the security impact of browsers allowing top navigation. Either way, an exploit can still be launched from within the nested browsing context (be it a plugin or HTML fra
94.
by justinschuh 13y ago
Agreed. I don't think people appreciate that running a bounty program is not an easy task. The vast majority of the reports you get are invalid, and you have to actively search for the signal in the noise. Mistakes happen, but the corr
95.
by justinschuh 13y ago
It's complicated. Modern frame navigation evolved a few years ago out of this work: http://www.adambarth.com/papers/2009/barth-jackson-mitchell-... Those changes represented a pretty dramatic improvement and
96.
by justinschuh 13y ago
I'm sorry, but I really do understand your argument. You're claiming that the same novice who can't install a simple application or or follow three steps to reveal a password on the page will be capable of drilling down throu
97.
by justinschuh 13y ago
It matters that you don't seem to understand the threat model here. You think your passwords are protected somehow in other applications, but they're simply not. The fact is that they're still trivially recoverable, and if th
98.
by justinschuh 13y ago
I appreciate how this appears to a novice, but we've literally spent years evaluating it and have quite a bit of data to inform our position. And while you're certainly well intentioned, what you're proposing is that that we
99.
by justinschuh 13y ago
> Yes, but by your reasoning, surely obfuscating passwords when inputted into websites is also pointless, yet you do do this in Chrome, which is inconsistent with your reasoning. Passwords are normally masked to prevent shoulder surfing,
100.
by justinschuh 13y ago
Soft boundaries within the user account do nothing to protect you from exactly those scenarios either. Your protection is to lock your OS user account.
101.
by justinschuh 13y ago
I'm the Chrome browser security tech lead, so it might help if I explain our reasoning here. The only strong permission boundary for your password storage is the OS user account. So, Chrome uses whatever encrypted storage the system pr
102.
by justinschuh 13y ago
> It certainly seems relevant, because Dartium has cross-VM leaks. Sorry, I must have looked at the wrong message, because reading it now, that's not at all the context I was responding to. However, that message was so late in the t
103.
by justinschuh 13y ago
> I'm referring to Filip Pizlo's message regarding the cross-heap GC issues that were raised on webkit-dev (which is part of the thread you linked): I assume no one replied because the argument was a broad generalization that w
104.
by justinschuh 13y ago
You are very, very confused and your comment is wholly untrue. Dart uses the normal binding layer (with refcounted object handles) in their Dartium branch, and the patch to add support to WebKit/Blink is quite tractable, both prior to
105.
by justinschuh 13y ago
It's an IR that currently is compatible with JS, but that's not necessarily the case longterm. And I personally don't see how it can retain that property while adding some of the things the platform needs (e.g. thread support
106.
by justinschuh 13y ago
Thanks, that's a bit of helpful context. I appreciate that it's too early to say where exactly asm.js will go. I'm just afraid of private APIs or other divergence from JavaScript in order to mainstream asm.js. Sorry if that a
107.
by justinschuh 13y ago
To be clear, I really do think those of you working on asm.js have the best of intentions and really want to make something that works for the Web. However, I expect that supporting existing codebases and commonly used APIs is going to mean
108.
by justinschuh 13y ago
I'm sorry if I'm coming across negatively. It's not my intent. And please don't presume that my concerns about asm.js are in any way tied to projects that other people in Google/Chrome work on, or that I'm enti
109.
by justinschuh 13y ago
Note that I framed it as "not exactly honest" rather than saying it's an overt lie. Because I don't consider it an overt lie, but it's hard not to read it as a bit equivocal to claim that asm.js as just JavaScript.
110.
by justinschuh 13y ago
My statement was correct. It's not JavaScript, which is why you use a keyword to switch to a different compiler mode. It's a clever hack to use an equivalent subset of JavaScript as an IR (accepting a few polyfills). However, it&#
111.
by justinschuh 13y ago
No, it's an IR that happens to have an identical representation in JavaScript. But that clever hack gets muddy already with things like Math.imul. And it's going to diverge far more given the demand for e.g. threading, sync primit
112.
by justinschuh 13y ago
You missed the context. The point is that people are still free to go to the Guardian on their home computers and exercise their own judgment in what they read. However, the Army is taking proactive steps to avoid a mess of work cleaning up
113.
by justinschuh 13y ago
> Saving themselves work, okay. Saving the taxpayer money. nah.. it's not like it's actually their money. Thanks for being upfront with your bigotry. So, I know that there's no point in wasting time on trying to have an ho
114.
by justinschuh 13y ago
> Why a secret leaked to the public and available to all is still treated as a secret is confusing. This is standard OpSec. You neither confirm nor deny the leak because it's entirely possible that the information itself is a plant
115.
by justinschuh 13y ago
It's not petty. Given the laws surrounding classification they're just trying to save themselves a giant mess of pointless work and a tremendous amount of money on reprovisioning systems.
116.
by justinschuh 13y ago
Nope. It's no different than your employer having an Internet filter at work to prevent you from engaging in activities that are unproductive or expose them to liability. You can still do whatever you want on your own computer and your
117.
by justinschuh 13y ago
Then read the original article linked in the first paragraph. It's not that they're trying to pretend the documents weren't leaked. It's that systems are all classified to handle information at a given level, and if you
118.
by justinschuh 13y ago
You do realize how the last one of these Greenwald articles from the Guardian played out, right? Another reporter actually had to write a piece walking back every one of the accusations concerning PRISM. And yet, given Greenwald's prov
119.
by justinschuh 13y ago
Thank you. I wish more of the commentary on this subject was like yours. It's a refreshing to see someone who can disagree with a position but accept that it is still legal if the courts have upheld it.
120.
by justinschuh 13y ago
I don't know what was ambiguous about "except in the rare case that you have a FISA order." I'm dubious of the metadata thing (a bit less knowing that it is not part of the collection and A&P pipeline), but the fact

More ›