Slashdot Mirror
Google Experiment Tests Top 5 Browsers, Finds Safari Riddled With Security Bugs (bleepingcomputer.com)
An anonymous reader writes from a report via Bleeping Computer: The Project Zero team at Google has created a new tool for testing browser DOM engines and has unleashed it on today's top five browsers, finding most bugs in Apple's Safari. Results showed that Safari had by far the worst DOM engine, with 17 new bugs discovered after Fratric's test. Second was Edge with 6, then IE and Firefox with 4, and last was Chrome with only 2 new issues. The tests were carried out with a new fuzzing tool created by Google engineers named Domato, also open-sourced on GitHub. This is the third fuzzing tool Google creates and releases into open-source after OSS-Fuzz and syzkaller. Researchers focused on testing DOM engines for vulnerabilities because they expect them to be the next target for browser exploitation after Flash reaches end-of-life in 2020.
Google finds their own browser is best. News at 11.
Turn off javascript and related scripting shit.
It's not that simple. Try using Google without JS. There are tons of other sites with the same problem.
what a DOM engine is.
Safari is Apple's IE 6 of this decade. It hasn't been updated in a long time and they can no longer piggy back both Google and Konqueror for new code since Chrome forked -webkit with -blink.
I worked for a famous software supporting their cloud software. Safari was the one browser which always had trouble with even drag and dropping files. Something rudimentary in the HTML 5 standard. Even IE 9 from 2011 can easily support this.
Sometimes Safari would work. Sometimes it would not and the Apple users always get mad at us for some reason never blaming their shitty browser.
http://saveie6.com/
It's gotten to the point I do banking on a distro I run off a thumb drive on my laptop. It's designed for security from the ground up and that is the only thing I use it for. As to surfing the web and everything else I don't worry too much and just use the standard Ubuntu on the hard drive.
It's not that simple. Try using Google without JS.
Actually, google search works ok without javascript. Google mail still has a basic lite mode too. The rest of google won't work without javascript.
There are tons of other sites with the same problem.
Yes, and they are badly written. Compare to amazon - it works with any browser, with or without javascript, because amazon knows you won't buy if their website won't work in the customer's browser.
Yeah, real simple. Can't be vulnerable on something you can't use. Why not shut down your computer and lock it in a safe while you're at it.
Are you angry because you're a 'Web Developer' and people might not be able to run your 'code'?
Who would even run Safari in the first place? On my phone and tablet I have Chrome, Firefox, and Opera (not the 'mini' skin) installed and use them all.
Is there a corporation that forces people to run Safari?
Apple. On iOS, all browsers (even Chrome) are actually running Safari's rendering engine, with the exception of browsers that run all the JavaScript server-side. The reason for this is that Apple won't let apps run non-Apple JavaScript engines out of concerns about security. (The irony here is not lost on me.)
Check out my sci-fi/humor trilogy at PatriotsBooks.
Your scatological interests aside, did you have anything to add to the discussion?
"Try using Google without JS"
Proof that Google engineers are shit at real coding.
Hey, Google Engineers, before you do your mass downvote moderation, try explaining why your stuff is so shit in the first place.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
Javascript is ruining the internet, IMO.
Yea and Intel's ME is there to fuck that over.
You don't do your banking on a thinkpad x60 or libreboot'd thinkpad? What are you, a pleb?
Re "Who would even run Safari in the first place?"
People using Keychain Access to look after the passwords.
Safari fills them in so a user can log in to many different web sites and forums.
https://en.wikipedia.org/wiki/...
Domestic spying is now "Benign Information Gathering"
I can't believe so many of you are such zealots when it comes to your web browser of choice.
#DeleteChrome
It's plenty secure. Most of the people I know that get hit are the ones using an Android phone of all things. Hackers are lazy too and they tend to hit the low hanging fruit.
There is still another fight to take.
Cross site scripting.
If I go to one page I don't really mind that much if that page has to run some scripts to work.
What I don't see a reason for is for that page to pull in scripts from third party sources that I may or may not trust.
Most pages works fine without them, but those who don't should be considered broken.
Google testers could find no security bugs whatsoever in Chrome. "It's a fucking rock," said one tester.
It looks like all of the Safari bugs were fixed earlier this year...
I print, therefore I am.
So, it is interesting that they do not mention versions that they used of any of these browsers, unless I missed that detail. They only mention 'currently released'
But much more odd "Instead of fuzzing Safari directly, which would require Apple hardware, we instead used WebKitGTK+ which we could run on internal (Linux-based) infrastructure". Google does not have a Mac, anywhere?
So they did not run this as a user would, or in fact a proper OS X Safari release build at all. Ok, seems legit...
This from the company that gets hurt the most by Safari beginning to block tracking of users through advertising blocking mechanisms. Maybe they were looking at ways to bypass that?
...and Chrysler has the second most. Ford had none.
Film at eleven.
Apple. On iOS, all browsers (even Chrome) are actually running Safari's rendering engine, with the exception of browsers that run all the JavaScript server-side. The reason for this is that Apple won't let apps run non-Apple JavaScript engines out of concerns about security. (The irony here is not lost on me.)
I think that restriction may be loosening. There is a hint that the latest Firefox for iOS is not running WebKit.
But I might have misconstrued what I read yesterday.
Also, if they were testing it on the "top five browsers", why was Firefox included in the list? That's barely a blip in the market any more, and will be even less so after November.
That's not entirely accurate. You could always run JavaScript with JavaScriptCore. What you could not do was use downloaded, interpreted code to significantly change the functionality of the app. For an app like a web browser, the website's content is not part of the app's functionality, so you could use JavaScriptCore. One could reasonably argue that if you could find a way to transpile games into JavaScript and run them in WebKit, you could even have something like a game emulator, though AFAIK that theory has never been tested.
Either way, the main purpose was to ensure that an app could be properly reviewed before making it available on the store. If an app changes its functionality dramatically after the fact, that makes a proper review impossible. And reviewing arbitrary interpreters isn't particularly practical, either.
That's not really true. The reason they don't allow it is because JavaScript engines typically use JIT compiling to create native binary code and run it at a decent speed. Unless you want the third-party engines to be as slow as UIWebView's JavaScript interpreter (which doesn't use JIT compiling), Apple would need to allow select third-party apps to run unsigned code, which does, in fact, significantly increase the potential for all sorts of exploits (including jailbreaks).
iOS allows unsigned code to run only within a special, highly privileged execution context. Initially, only Safari ran in such a context. Many years later, their out-of-process execution/IPC became fast enough and transparent enough to make WKWebView practical, at which point they were able to relax that restriction somewhat and allow third-party apps to run JavaScript code. It is possible that Apple could eventually be convinced to allow third-party browsers to do JIT compiling and run unsigned code in such a context (within an entirely separate sandbox with no filesystem access), but it will be a long, uphill battle.
The question is not whether there's a security benefit from that limitation, but rather whether the security damage caused by a JavaScript interpreter monoculture exceeds the security benefit from not having random interpreters with the ability to run arbitrary code.
Check out my sci-fi/humor trilogy at PatriotsBooks.
Javascript is running the internet.