Hacker News Reader

Comment by Santosh83 | Hacker News Reader

Any reason P0 doesn't seem to direct some time and energy towards finding zero days in Firefox? Are they mandated to only investigate codebases of interest to Google?

View on HN

(Former Firefox Security Engineer)

I suspect it's because Firefox exploits have looked the same for the last several years -- there has not been a lot of novelty required to implement an exploit, given an arbitrary read/write primitive.

P0 does report vulnerabilities to Firefox though, and they obviously get fixed, they're just not particularly interesting to exploit.

Perhaps that'll change once Project Fission lands in the stable release

> I suspect it's because Firefox exploits have looked the same for the last several years -- there has not been a lot of novelty required to implement an exploit, given an arbitrary read/write primitive.

Surely other browsers do not differ from this significantly?

An arbitrary write primitive in the chrome render process hasn't been game over for quite some time.

I mean, is it on Firefox?

Until a year ago(?), yes.

They do find zero days in Firefox. The most recent that comes to mind: https://www.mozilla.org/en-US/security/advisories/mfsa2019-1...

Hah. That's so the opposite of the usual complaint! Normally people complain that P0 never does write-ups on Google stuff. Maybe there are concerns about the PR aspects of releasing info about FF vulns?

Compare this to the recent report about Samsung's kernel patches. It's not Project Zero in the headlines but "Google accuses Samsung of making inappropriate changes to Android."

I think people are overthinking this, and P0 just writes about whatever cool shit comes up in their work, as and when they are able to write about it given embargoes and their workload.

Reply on news.ycombinator.com