Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by semenko | Hacker News Reader

Full thread

semenko·

The Chrome Release blog says it's fixed: http://googlechromereleases.blogspot.com/2012/03/chrome-stab...

And that the SVN commit history is available: http://build.chromium.org/f/chromium/perf/dashboard/ui/chang...

But I don't see any commit that look even remotely related to this exploit. What's up?

View on HN

The commits are all there, the fixes just might not look completely obvious. We (chromium) commit all fixes to the chromium repository before pushing them to users, always.

Do you guys ever do write-ups about the bugs? I would be interested in reading that.

I don't think we do that as a general habit, but that may happen in this case.

My wild-arsed guess is: http://src.chromium.org/viewvc/chrome/branches/963/src/conte...

-- a change to kUnreachableWebDataURL

Well... They would hopefully be smarter than committing the fix to the public SVN.

By committing the fix, they would effectively be releasing a step-by-step guide on how to exploit the vulnerability.

But it's still an open source project -- perhaps the commits are more evident in their git repo? http://git.chromium.org/gitweb/

Certainly if you build Chromium from git/SVN now, the bug is fixed.

I just find it a little strange that their changelog / list of commits in each version is not true.

If it's a flash problem, I don't think Chromium has flash at all.

As the original article points out, this is not a flash related issue.

Reply on news.ycombinator.com