Slashdot Mirror

← Back to Stories (view on slashdot.org)

Microsoft Chastises Google Over Chrome Security (pcmag.com)

Posted by EditorDavid on from the no-you dept.

An anonymous reader quotes PCMag: In a Wednesday blog post, Redmond examined Google's browser security and took the opportunity to throw some shade at Chrome's security philosophy, while also touting the benefits of its own Edge browser. The post, written by Microsoft security team member Jordan Rabet, noted that Google's Chrome browser uses "sandboxing" and isolation techniques designed to contain any malicious code. Nevertheless, Microsoft still managed to find a security hole in Chrome that could be used to execute malicious code on the browser.

The bug involved a Javascript engine in Chrome. Microsoft notified Google about the problem, which was patched last month. The company even received a $7,500 reward for finding the flaw. However, Microsoft made sure to point out that its own Edge browser was protected from the same kind of security threat. It also criticized Google for the way it handled the patching process. Prior to the patch's official rollout, the source code for the fix was made public on GitHub, a software collaboration site that hosts computer code. That meant attentive hackers could have learned about the vulnerability before the patch was pushed out to customers, Microsoft claimed. "In this specific case, the stable channel of Chrome remained vulnerable for nearly a month," the blog post said. "That is more than enough time for an attacker to exploit it."
In the past Google has also disclosed vulnerabilities found in Microsoft products -- including Edge.

67 of 111 comments (clear)

  1. Really? by Anonymous Coward · · Score: 5, Insightful

    Do we point out Microsoft's long and illustrious history of ignoring critical security flaws now or...

    Do we just point out Chrome isn't crashing computers with their security updates, thus training their users to turn off automatic updates?

    I know, I know, its not the same thing exactly. But you know what they say about people in glass houses.

    1. Re:Really? by dreamchaser · · Score: 4, Insightful

      I would actually prefer that the major players all try to keep each other honest.

    2. Re:Really? by Billly+Gates · · Score: 1, Troll

      You do know IE 6 came out almost 17 years ago right?

      --
      http://saveie6.com/
    3. Re:Really? by rtb61 · · Score: 2

      How about I can uninstall chrome and gain privacy from google but I can not uninstall wildly privacy invasive elements of Windows 10 and I can not stop M$ installing what ever software they want to unless I never connect a Windows 10 computer to the internet, literally impossible and I can stop Google from install software on my computer. Google my claim a right to my privacy but M$ actually claims a right to my privacy, my PC and my internet connection, well, if I am stupid enough to run Windows 10.

      You can not secure Windows 10 form the worst bastards of the lot M$.

      --
      Chaos - everything, everywhere, everywhen
    4. Re:Really? by geekmux · · Score: 3, Insightful

      I would actually prefer that the major players all try to keep each other honest.

      Being honest is one thing, which I do appreciate.

      That said, Microsoft doesn't have the right to bash a garage-band IoT maker about security flaws response.

    5. Re:Really? by thegarbz · · Score: 1

      Do we just point out Chrome isn't crashing computers with their security updates, thus training their users to turn off automatic updates?

      Huh? You can turn off security updates in Chrome and Windows?

    6. Re:Really? by GrumpySteen · · Score: 2

      You do know that the person you replied to didn't mention IE 6, right?

    7. Re:Really? by dreamchaser · · Score: 5, Insightful

      I would actually prefer that the major players all try to keep each other honest.

      Being honest is one thing, which I do appreciate.

      That said, Microsoft doesn't have the right to bash a garage-band IoT maker about security flaws response.

      Everyone, from the lone user to a mega-corporation, has the right to call out security flaws on anyone who exposes others to risk.

    8. Re:Really? by geekmux · · Score: 2

      Microsoft sucked at security before, they don't now...

      Given Microsoft Telemetry, I really don't see products as any more secure, even when the masses exchange privacy for a free upgrade.

    9. Re:Really? by Bing+Tsher+E · · Score: 1

      Do you have a cite for that, and not just drive-by FUD?

    10. Re:Really? by geekmux · · Score: 1

      I would actually prefer that the major players all try to keep each other honest.

      Being honest is one thing, which I do appreciate.

      That said, Microsoft doesn't have the right to bash a garage-band IoT maker about security flaws response.

      Everyone, from the lone user to a mega-corporation, has the right to call out security flaws on anyone who exposes others to risk.

      I was more intending to highlight the fucking irony of Microsoft doing so. As others have said, those in glass houses...

    11. Re:Really? by Dutch+Gun · · Score: 3, Insightful

      Agreed. In addition, I'd definitely recommend reading the original Microsoft blog post. It's actually not nearly so flame-bait-ish as the breathless headlines and summary imply. It's a fascinating piece of technical detective work, and I think that, while they obviously use this as good propaganda to promote their own technology, the issues they presented seem fair to me.

      They also gave Google kudos where that was deserved, but that doesn't make for very good headlines. For instance:

      This kind of attack drives our commitment to keep on making our products secure on all fronts. With Microsoft Edge, we continue to both improve the isolation technology and to make arbitrary code execution difficult to achieve in the first place. For their part, Google is working on a site isolation feature which, once complete, should make Chrome more resilient to this kind of RCE attack by guaranteeing that any given renderer process can only ever interact with a single origin. A highly experimental version of this site isolation feature can be enabled by users through the chrome://flags interface.

      And consider this:

      Servicing security fixes is an important part of the process and, to Google’s credit, their turnaround was impressive: the bug fix was committed just four days after the initial report, and the fixed build was released three days after that. However, it’s important to note that the source code for the fix was made available publicly on Github before being pushed to customers. Although the fix for this issue does not immediately give away the underlying vulnerability, other cases can be less subtle.

      Note that they don't actually blame open source. That would be foolish, as they're embracing it more and more themselves.

      Some Microsoft Edge components, such as Chakra, are also open source. Because we believe that it’s important to ship fixes to customers before making them public knowledge, we only update the Chakra git repository after the patch has shipped.

      --
      Irony: Agile development has too much intertia to be abandoned now.
    12. Re:Really? by Trax3001BBS · · Score: 1

      Why it hasn't been exploited yet, I don't know. But since day one the Windows Firewall lets traffic pass without notification.
      This link claims it's for Windows Product Activation https://support.microsoft.com/... and always open. When first released it was known to pass any with a license held by microsoft.

      Takes me Autoruns, and gpedit to disable the Windows firewall and defender.

    13. Re:Really? by epine · · Score: 1

      They also gave Google kudos where that was deserved, but that doesn't make for very good headlines.

      Empirically, one can only conclude that nerds like headlines and summaries that suck moonshite, it's what gives our puny, breathless existence meaning and purpose.

      I tend to judge by the worse thing a person or organization won't fix. Unicode is beyond annoying, but the weedy quality of story summaries here (not all of them, but a sizeable proportion) is far and away the worst thing Slashdot won't fix.

      Yet Slashdot persists in running under the banner of "news for nerds" so I was ultimate forced to concede my prior conception of a nerd as being someone who hews too close to material factuality for his or her social betterment as a false idol.

      Material factuality remains a stretch aspiration.

    14. Re:Really? by pthisis · · Score: 2

      Yes. The real problem is that Microsoft is advocating for slow-rolling disclosure of security vulnerabilities by hiding patches until the stable release comes out. That's fine, it's not an insane stance, but they're presenting it as though that's obvious and noncontroversial and that there are no drawbacks to their methodology and no advantages to Google's full disclosure policy. That's where they're being disingenuous--full disclosure vs. slow disclosure is one of the more hotly debated topics in security circles, and Microsoft knows it (or should).

      If they want to advocate for slow disclosure, they should at least acknowledge that they're taking one side of a controversial topic about which a lot of serious security people disagree, not pretend that Google is just doing something recklessly idiotic and should clearly do things the Microsoft way.

      Bruce Schneier summarizes the counterargument here: https://www.schneier.com/essay...

      On the surface slow-rolling things seems like a good idea--why show the attackers the breach before you've repaired the wall? The problem with that line of thinking is that it presumes that you're the only one who's found the breach, and that attackers aren't already exploiting it. That's generally naÃve, you have no way of knowing whether a vulnerability is being actively exploited or not.

      By disclosing fully, you make it possible for people to protect themselves or to make judgements about how serious the issue is for them. You also make companies take security more seriously in the future, which hopefully leads to greater global security even if the local impact is muddier.

      There are obvious trade-offs the other way, as well. But Microsoft
      pretending that full disclosure is inherently bad for security is duplicitous.

      --
      rage, rage against the dying of the light
    15. Re:Really? by hcs_$reboot · · Score: 1

      You do know IE 6 came out almost 17 years ago right?

      More importantly, how long did developers and businesses had to suffer from this garbage browser?

      --
      Slashdot, fix the reply notifications... You won't get away with it...
    16. Re:Really? by Billly+Gates · · Score: 1, Informative

      Did they stop having security flaws with IE 7? 8? Edge? Office? Sharepoint? Exchange? Skype? (continue listing all of Microsofts products...)

      You want to talk ignorance and then act like there hasn't been ample evidence of bugs from Microsoft Products in the last 16 years...

      Ok how many exploits have been found in Chrome, Firefox, Linux, or any other product not from Microsoft? So far Chrome has 9 pages worth!

      It's not reported here because we love Linux and Google is cool and we hate Microsoft. I do say this not as a troll but fact with the audience and who selects stories here. My point is most complex software has flaws. Stuff written in C/C++ has lots too as bounds checking and code execution around a buffer overflow were common and both Windows and Unix historically had these problems. Though by default the C libraries in both platforms now prevent this or try to mitigate.

      Microsoft has a security buddy now for each product which analyzes and gives project managers security details which is how how Microsoft products changed after the 2005 memo. It's why Vista got those annoying UAC prompts and why later webpages made for IE 6 started to have trouble rendering in later versions.

      --
      http://saveie6.com/
    17. Re:Really? by Billly+Gates · · Score: 1

      You do know IE 6 came out almost 17 years ago right?

      More importantly, how long did developers and businesses had to suffer from this garbage browser?

      My last employer still used IE 6 heavily. Actually our customers did. 1/3 of our enterprise customers still in 2017 still standardized and developed for IE 6 as the code was written between 1999 - 2004 when it had 95% marketshare and we all logically thought no changes would ever be made again since Microsoft set the standards which was common at the time.

      Due to technical debt and the importance of the apps it is impossible to ever upgrade. THey waited until 2014 to leave XP behind due to IE 6 and decided to have us host Citrix running unpatched Windows Server 2003 to keep their critical apps going.

      It was a pain at around 2015 when UPS stopped supported IE 6 as our agents were screaming to install Chrome (total HIPPA violation). After threatening us all with job termination we installed Chrome without telling the client secretly to keep our jobs since our call flow REQUIRED our agents to check in with UPS on deliveries ... face to palm.

      I left the company a few months later as I would be fired anyway by the auditors for installing Chrome and the customer/managers would deny they told me to install it so it's on me etc. What is also scary is the other client that used IE 6 processed credit cards and social security numbers.

      We have a problem which Equifax is just now showing. It is non technical MBA types bossing IT around and outsourcing who compromise security and of course whose jobs are always secure.

      --
      http://saveie6.com/
    18. Re:Really? by tlhIngan · · Score: 1

      Unicode is beyond annoying

      /. has supported Unicode for over a decade now (it was implemented as part of Slashdot.jp, for obvious reasons).

      The problem has always been people who do nothing but use Unicode to abuse the site layout - there's a lot of Unicode codepoints out there and a lot of them have side effects that allow you to easily mess up websites. It's a sure sign of "Unicode is so easy let's add it" and then two days later the comment area is rendered useless because all the trolls abuse it.

      And besides screwing up site layouts using the various text flow codepoints (e.g., RTL override) they can also add all the various character adornments that can render a single sentence into a huge block of black. And since most Unicode renderers do not properly handle hundreds of adornments, you end up with a black blob int he middle of the webpage. /. took the easy way out and added a character whitelist - which only includes the ASCII table set. In theory they could add more characters to the whitelist as well, but they haven't.

    19. Re:Really? by KingBenny · · Score: 1

      nope, i would call this "healthy competition" as long as it results in the bug getting patched, just keep 'em hacking at each other

      --
      Free speech was meant to be free for all... how can anyone grow up in a nanny state ?
  2. Of course by phantomfive · · Score: 2

    Good has some really good programmers, and so does Microsoft. In the past they were even more impressive.

    But both of them are now process driven companies, primarily focused on not overturning the boat, and the result is code that follows process. As long as process is followed, you don't have to worry about whether you did a good job or not. Just go home at the end of the day. That is the mentality of the vast majority of mediocre programmers at both companies.

    --
    "First they came for the slanderers and i said nothing."
    1. Re:Of course by swillden · · Score: 1

      Good has some really good programmers, and so does Microsoft. In the past they were even more impressive. But both of them are now process driven companies, primarily focused on not overturning the boat, and the result is code that follows process. As long as process is followed, you don't have to worry about whether you did a good job or not. Just go home at the end of the day. That is the mentality of the vast majority of mediocre programmers at both companies.

      Cite?

      --
      Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
    2. Re:Of course by phantomfive · · Score: 1

      Which part exactly do you disagree with?

      --
      "First they came for the slanderers and i said nothing."
    3. Re:Of course by hcs_$reboot · · Score: 1

      In the past they were even more impressive

      One of them, yes (hint: not MS)

      --
      Slashdot, fix the reply notifications... You won't get away with it...
    4. Re:Of course by swillden · · Score: 1

      Which part exactly do you disagree with?

      I didn't say I disagreed (or agreed), I just asked for substantiation of your claims. Are you speaking from personal experience, having worked at Microsoft and Google? Are you relaying information from friends who work there? Do you have some other sort of basis for your claim?

      --
      Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
    5. Re:Of course by phantomfive · · Score: 1

      You'll have to narrow it down a bit more, I'm not going to give you a citation for every sentence in my post. If there's something I said that seems particularly unlikely, let me know, and I will either give some evidence to support it, give it a disclaimer, or outright retract it.

      --
      "First they came for the slanderers and i said nothing."
    6. Re:Of course by swillden · · Score: 1

      You'll have to narrow it down a bit more, I'm not going to give you a citation for every sentence in my post. If there's something I said that seems particularly unlikely, let me know, and I will either give some evidence to support it, give it a disclaimer, or outright retract it.

      There wasn't that much in the post in question. But, here:

      But both of them are now process driven companies, primarily focused on not overturning the boat, and the result is code that follows process.

      And

      As long as process is followed, you don't have to worry about whether you did a good job or not. Just go home at the end of the day.

      And

      That is the mentality of the vast majority of mediocre programmers at both companies.

      --
      Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
    7. Re:Of course by phantomfive · · Score: 1

      But both of them are now process driven companies, primarily focused on not overturning the boat, and the result is code that follows process.

      I see evidence of this in a lot of different places. For Microsoft, there is this, and from what I've heard from people who worked there, it's basically like that all over Microsoft. Similarly, you can see the results in their products (that link shows an example of their processes entering the product in an obvious way). Similarly, at Google, I've talked to people who work there, and it seems about the same. Again you can see it in the output of their product (they must have some good people on the search team, though).

      Honestly though, looking at the turnover these two company (check out their turnover rate) you have to focus on process, because you need them to be able to replace engineers when they leave.

      As long as process is followed, you don't have to worry about whether you did a good job or not. Just go home at the end of the day

      This isn't an assertion about Microsoft or Google, it's a description of how process driven companies are in general. This has been my experience both observing and being a part of them.

      That is the mentality of the vast majority of mediocre programmers at both companies

      This is what I get from talking to people who've worked there. Note that not everyone is a mediocre programmer.

      --
      "First they came for the slanderers and i said nothing."
  3. Pot criticises kettle by cyber-vandal · · Score: 1

    Says it has poor cleanliness standards.

    1. Re:Pot criticises kettle by Billly+Gates · · Score: 4, Informative

      IE 6 was made 17 years ago.

      Disclaimer I am using Chrome so I am not drinking the coolaid.

      MS changed to being secure in 2004 with the famous Bill Gates memo. IE 8 matched Chrome 1.0 with kernel level sandboxing in %appdata/lowrights and per threading process since 2009. Firefox just matched IE 8's security this year which is why I dumped it for Chrome in 2011 after the 4.0 fiasco.

      IE 9 started the change to standards with hardware acceleration and IE 11/Edge are fully 100% W3C compliant. Infact I think IE 10 is W3C compliant too and no longer sucked but was a bit behind Chrome and Firefox at the time.

      Anyway I welcome the rapid improvement to security and standards compliance for both. Where Edge sucks is it is more of a mobile browser than a desktop and had issues crashing during the initial Windows 10 build 204100 release 2015. But that is my take.

      --
      http://saveie6.com/
    2. Re:Pot criticises kettle by drinkypoo · · Score: 2

      MS changed to being all spyware, all the time with Windows 10.

      An OS which spies on you is the diametric opposite of security.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    3. Re:Pot criticises kettle by wjcofkc · · Score: 1

      "Disclaimer I am using Chrome so I am not drinking the coolaid."

      Just what do you think coolaid is?

      Disclaimer, I do not use Chrome since I don't like coolaid, but I have had the chance to use Edge extensively over the past year and found it favorable in every respect. Although Edge is not my primary browser, so I would really like you to elaborate on, "Where Edge sucks is it is more of a mobile browser than a desktop..." As I have no idea what you are talking about.

      --
      Brought to you by Carl's Junior.
    4. Re:Pot criticises kettle by hcs_$reboot · · Score: 1

      Well, ok, but MS could have pushed way more to get rid of that IE6 insanity earlier and make it more standard (and secure), even during the XP era.

      --
      Slashdot, fix the reply notifications... You won't get away with it...
  4. In other news by Anonymous Coward · · Score: 1

    Local high school basketball coach criticizes NFL team for its poor tackling form on Sunday.

    While I agree with them, it should be noted that Edge is not even in the same league as Chrome.

  5. month long release wait? by jarkus4 · · Score: 2, Interesting

    Bugs happen. What has me worried is a month long waiting time between security fix in public facing repository and release. This pretty much asks for exploitation even by not very skilled "hackers" as interested parties have lots of time to prepare viable exploit based on provided regression tests.

  6. Damn Google! by thegarbz · · Score: 3, Funny

    I don't know of any other company that has a monthly release cycle for security updates, even for zero day bugs! Google you are evil, you should be like Micros... oh.

    1. Re:Damn Google! by thomst · · Score: 1

      thegarbz quipped:

      I don't know of any other company that has a monthly release cycle for security updates, even for zero day bugs! Google you are evil, you should be like Micros... oh.

      Mod parent +1 Funny, please ...

      --
      Check out my novel.
    2. Re:Damn Google! by thegarbz · · Score: 1

      Mod parent +1 Funny, please ...

      I appreciate the support. I have to admit it did not occur to me that a moderator may not have a sense of humour and may need instructions.

    3. Re:Damn Google! by thomst · · Score: 1

      I requested:

      Mod parent +1 Funny, please ...

      Prompting thegarbz to respond:

      I appreciate the support. I have to admit it did not occur to me that a moderator may not have a sense of humour and may need instructions.

      In my experience, most people do not, in fact, possess an actual sense of humor. That's why laugh tracks exist.

      You're welcome, btw - and I'm gratified to see that some moderators have followed my advice, regardless of whether they required it or not ...

      --
      Check out my novel.
  7. People who live in glass houses... by ledow · · Score: 1

    People who live in glass houses...

    1. Re:People who live in glass houses... by Opportunist · · Score: 1

      ...shouldn't parade around in clothing made for emperors.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
  8. I hope they enter a pissing contest... by aepervius · · Score: 4, Insightful

    ...Trying to outdo each other at finding browser vulnerabilities. Outcome : both browser become more secure.

    --
    C. Sagan : A demon haunted world:
    http://www.amazon.com/gp/product/0345409469/
    visit randi.org
  9. Did they just blame open source? by Ayano · · Score: 2

    I mean.. seriously?

    --
    I don't read AC
  10. *Cough* Pwn2Own *Cough* by mentil · · Score: 2

    Well this was covered recently

    --
    Corruption is convincing someone that the selfless ideal is the same as their selfish ideal.
    1. Re:*Cough* Pwn2Own *Cough* by hcs_$reboot · · Score: 1

      Fortunately MS doesn't reward bugs the same way Google does, or they would bankrupt quick

      --
      Slashdot, fix the reply notifications... You won't get away with it...
  11. Re:The failure of open source security by Anonymous Coward · · Score: 3, Insightful

    In a professional setting, updates are tested on a test server to make sure they don't break anything before they are applied to production servers. And the moment they are applied is planned carefully. Auto update is irrelevant there, what is relevant is that Euqifax didn't handle their environment like a professional should.

  12. Microsoft oversells their CFI mitigations by roca · · Score: 2

    I wrote about this:
    http://robert.ocallahan.org/20...
    Summary: In practice, attackers can leverage arbitrary-write bugs to produce the same-origin violations Microsoft warns about without requiring RCE, completely bypassing the CFI mitigations Microsoft is touting here.

  13. Please donate to MS by hcs_$reboot · · Score: 1

    Microsoft desperately needs money. They are left to find bugs in Chrome to get the $1,000 award

    --
    Slashdot, fix the reply notifications... You won't get away with it...
    1. Re:Please donate to MS by Dutch+Gun · · Score: 1

      Joking aside, I thought people might like to know the actual numbers and result:

      We responsibly disclosed the vulnerability that we discovered along with a reliable RCE exploit to Google on September 14, 2017. The vulnerability was assigned CVE-2017-5121, and the report was awarded a $7,500 bug bounty by Google. Along with other bugs our team reported but didn’t exploit, the total bounty amount we were awarded was $15,837. Google matched this amount and donated $30,000 to Denise Louie Education Center, our chosen organization in Seattle. The bug tracker item for the vulnerability described in this article is still private at time of writing.

      It appears these companies don't pay each other directly, but donate to company-chosen charities. And in Google's case, it looks like it matched those donations, in effect paying double. So, I guess good on both of them for that.

      --
      Irony: Agile development has too much intertia to be abandoned now.
    2. Re:Please donate to MS by hcs_$reboot · · Score: 1

      It appears these companies don't pay each other directly, but donate to company-chosen charities. And in Google's case, it looks like it matched those donations, in effect paying double. So, I guess good on both of them for that.

      The magic of operations made public.

      --
      Slashdot, fix the reply notifications... You won't get away with it...
  14. Blame Chrome for Windows defects .. by najajomo · · Score: 2, Insightful

    "we set out to examine Google’s Chrome web browser .. is having a strong sandboxing model sufficient to make a browser secure?" Jordan Rabet Microsoft Offensive Security Research team

    That's a bit rich coming from Microsoft. Security resides in the Operating not in the Browser. Chrome wouldn't need sandboxing if the underlying Operating System did its job. That is isolate one processes memory from the other. Something the WinTEL platform seem unable to do despite numerous iterations of the x86 processor.

    I love how the original "research" article tried to spin defects in the underlying Operating System into, it's somehow the fault of sandboxing in Chrome. Sandboxing, OSR, RCE, CFG, ACG, LPAC, WDAG, all designed to protect the underlying Operating System from the browser. Microsoft, the company that fights malware with self-serving adverts masquerading as technical research.

    1. Re:Blame Chrome for Windows defects .. by drinkypoo · · Score: 1

      Chrome wouldn't need sandboxing if the underlying Operating System did its job. That is isolate one processes memory from the other. Something the WinTEL platform seem unable to do despite numerous iterations of the x86 processor.

      Except you still have all the same kinds of flaws in other operating systems, too, which is why Chrome is also sandboxed on other platforms, e.g. Linux. It's not just Windows. The techniques vary, but no mainstream OS is designed for security first. That would impinge upon performance. Microsoft literally decided to go the other direction in NT4, specifically in the name of graphics performance.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    2. Re:Blame Chrome for Windows defects .. by najajomo · · Score: 1

      @Anonymous Coward: "So you are ok with an attacker reading or writing anywhere you can on the system once he finds an exploitable bug in the rendering- or javascript engine of a browser? I'm not."

      How did you manage to read that into what I actually wrote. If the Operating System did this one thing: isolate process memory from each other then we wouldn't need SANDBOXING, OSR, RCE, CFG, ACG, LPAC or WDAG. What just occurred to me is when and if Microsoft disclosed such mitigations to the Chrome developers or did they keep it to themselves to give EDGE an edge up on their competitors.

    3. Re:Blame Chrome for Windows defects .. by najajomo · · Score: 1

      @Anonymous Coward: "Without sandboxing, the attacker's code can read, delete or modify your documents and downloads and it doesn't need access to other processes to do so".

      Why do you persist in willfully sowing confusion here. Isolating process memory means exactly that, therefore the browser don't need sandboxing and cannot access external data. At least if the browser wasn't running under Windows. Where presumably EDGE is so welded to the OS that a bug can lead to total compromise of the System. A bug in the browser that can lead to System compromise is a defect in the Operating System. And don't presume to lecture the moderators on what is acceptable here on slashdot.

  15. Re:The failure of open source security by najajomo · · Score: 2

    Anonymous Coward: 'Was demonstrated once more by the Equifax mega breach.'

    The Equifax mega breach demonstrated what happens when a company with an annual turnover of US$ 3.1 billion, uses software on an Internet facing machine without testing it for security vulnerabilities. In fact they didn't even have a patch strategy in place or even know who was responsible for implementing such patches.

  16. *stab from the band* *laughter in the audience* by Qbertino · · Score: 1

    *Bill Maher enters the stage, waits for cheering to calm down*

    Bill - "Good evening ladies and gentlemen, as we've just heard from the tech community,
    Microsoft Chastises Google over Security ..."

    *laughter errupts* ...

    --
    We suffer more in our imagination than in reality. - Seneca
  17. Re:The failure of open source security by I'm+New+Around+Here · · Score: 1

    That sounds reasonable but tend to not work out for non-trivial systems. It's better to always update, even in production, and detect failures and mitigate them.

    You've had experience mitigating boot failures on 50,000 PCs, while every minute of downtime is costing the company many thousands of dollars?

    --
    If you think I voted for Trump because of this post, you're wrong. I voted for Dr. Jill Stein of the Green Party. Again.
  18. Pop the champagne! by Opportunist · · Score: 1

    We found something that's insecure in Chrome that Edge isn't susceptible to!

    Hey, that's reason to celebrate, and use the good champagne. It's not like it happens often.

    --
    We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
  19. Can I block ads and javascript in Edge by Gojira+Shipi-Taro · · Score: 1

    ...as easily as I do in Chrome?

    No?

    Then fuck off with that.

    --
    "Oh my God. This is terrible. This is the end of my Presidency. I'm fucked."; ~ Donald J. Trump
  20. Re: The failure of open source security by q_e_t · · Score: 1

    That sounds reasonable but tend to not work out for non-trivial systems. It's better to always update, even in production, and detect failures and mitigate them.

    You've had experience mitigating boot failures on 50,000 PCs, while every minute of downtime is costing the company many thousands of dollars?

    No, because I release/stage updates to a small pilot group first the first night(s) and only roll them out to the masses if the pilot group(s) have no issues or only when those issues are resolved.

    I suppose your "ignore problems and then blame any/everyone else" for not properly managing your infrastructure style works for you too.

    Ahh... not auto-updates, then.

  21. Re:liking the new MS by hcs_$reboot · · Score: 1

    I'm guessing it's Nadella's changes.

    Don't want to be tough on Ballmer, but that's a fact.

    --
    Slashdot, fix the reply notifications... You won't get away with it...
  22. Quotable by Neo-Rio-101 · · Score: 1

    "He who is without sin cast the first .... something or other"

    --
    READY.
    PRINT ""+-0
  23. Re: The failure of open source security by I'm+New+Around+Here · · Score: 1

    It does seem like he is claiming both side of that issue.

    --
    If you think I voted for Trump because of this post, you're wrong. I voted for Dr. Jill Stein of the Green Party. Again.
  24. OK, fine, where can I download Edge for Linux? by molarmass192 · · Score: 1

    ... yeah, that's what I thought. They can't fully secure a browser on 1 platform but they're going to call out a browser that runs on no less than 5 platforms? Amateurs.

    https://www.cvedetails.com/vul...

    --

    Good people do not need laws to tell them to act responsibly, while bad people will find a way around the laws-Plato
  25. Please dont say throw some shade by irrational_design · · Score: 1

    Unless you are a teenager, please don't use the slang "throwing shade". It just makes you sound like a old person, desperately trying to appear cool by talking like a teenager.

  26. Ironic, Don't you think? by AlejandroTejadaC · · Score: 1

    This article brings me the first laugh of this day. Ironic, Don't you think?

  27. Re: The failure of open source security by q_e_t · · Score: 1

    Automated updates does not mean that every single host applies the update at the same time though.

    If you are testing on a subset, then deciding whether or not these then are applied to a wider set of machines, I am hard pressed to see how that is an auto-update and not a traditional test and release methodology.