Comment by p-e-w | Hacker News Reader

Comment by p-e-w | Hacker News Reader

Parent Full thread

> We publish this report today, because the maximum embargo period of 90 days we offer has been exceeded. Most of the issues mentioned in this report are currently not addressed by upstream, as is outlined in more detail below.

> [...]

> 2023-05-04: We privately shared the findings with security@...illa.org, offering coordinated disclosure according to the openSUSE disclosure policy.

> Until 2023-06-12: There has been a lack of communication by upstream. Relevant questions about the disclosure process remained unanswered, there was no formal reply to our report and no wishes have been expressed about how to continue the coordinated disclosure, or what the next steps would be.

> 2023-06-12: We learned that the embargo over this issue was violated by upstream via a GitHub PR [3] and, inspired by that, our community packager followed suit via another GitHub PR [5].

What a complete clusterfuck. It's unbelievable that in 2023, a company of Mozilla's stature appears to have no proper processes in place for handling serious security vulnerabilities even when they are being reported to them (for free!) by cooperative third parties.

This taints the image of the entire product in my view.

> > 2023-06-12: We learned that the embargo over this issue was violated by upstream via a GitHub PR [3]

To add further context, that PR violating the embargo:

- removes authentication entirely instead of fixing it

- discusses it as if they've discovered the CVE independently, even though it had seemingly been reported to them just 1 month prior. It may be that they did discover it independently, but the timing seems odd for a bug that existed for 3 years.

- discusses it in an extremely casual way, as if the vuln is not severe. Honestly I don't know enough about the vectors here to know what type of CVSS it might end up with.

---

Edit: Based on @AAchen's HN comment, it seems compromise requires local shell, so not an incredibly high severity it would seem. Still curious to see what NVD come out with.

> Still curious to see what NVD come out with

9.8

It's always 9.8.

To be fair, this is an application, so the score might be more grounded in reality. The CVEs I encounter as a developer are always insane and generally massive overreach from security to product design. It's not a vulnerability against all downstream libraries and applications that using some obviously unsafe C++ call might cause a DoS due to poor performance.

CVSS is a poor metric because (by its own definition / admission) its got a very narrow intent: it doesn't really deal with exploitability in any meaningful way (like e.g. the shell access required here). There is a lot of ongoing discourse on its limitations, but its all in relatively early stages & imo its better to have something than nothing (especially when the maintainers of that "something" are aware of its limitations & actively working on better processes).

If you have 10 security bugs, 3 are genuinely high severity and 9 get assigned high severity by NVD, then at least you've managed to deprioritise one of them. It's something (unironiccally).

This is a pretty decent overview https://www.first.org/epss/model

CVSS is really just used to stack-rank issues and decide how to handle them. Orgs get a list of CVEs, they sort them by score to decide which ones to handle first. From there someone removed from the actual process comes up with deadlines such as "All critical issues, defined as 9.0 or above, must be handled in 30 days." If they are reasonable there is additional language around "or best efforts must be made to resolve or mitigate the issue." If not, gghfdd.

On a side note, CVSS v4.0 arrived around 2023-01 and is.. maybe(?) better: https://www.first.org/cvss/v4-0/

Okay so almost useless, not entirely useless

A solid starting point for a very difficult problem

NVD scores and bug classifications are completely useless, as they are often entirely misclassified. My favorite being that they slap the "network" attack vector on things which are not at all network related or exploitable.

> What a complete clusterfuck. It's unbelievable that in 2023, a company of Mozilla's stature appears to have no proper processes in place for handling serious security vulnerabilities even when they are being reported to them (for free!) by cooperative third parties.

While I agree with your sentiment here, it's not exceptionnal at all and I've seen security researcher complaining about the same thing comming from at least Intel, Cisco and Google[1]! And I wouldn't be suprised if you could find example if that regarding Apple and Microsoft as well.

[1] and for Google it was just one month ago: https://matan-h.com/google-has-a-secret-browser-hidden-insid...

In my eyes, at least, Mozilla has been tainted since the Pocket fiasco, if not before. That's when they made it obvious they'd sell their users off for a buck.

Pocket is crapware, and I don't want it in my browser, and the way they forced it upon me left a bad aftertaste, but I still don't see how it constitutes "selling out their users". Pocket is actually owned by Mozilla. It's not like the data is going elsewhere or something.

I was a Pocket user from before they were bought, so I wouldn't call it crapware personally.

Isn't it just a way to sync a reading list across browsers, and have those pages pre-cached on a mobile device for reading when you have no connection?

I'm interested in what people find objectionable about it.

The strongest argument I've heard is that it's not core browser functionality, it was fine before Mozilla bought them, and therefore it's just a distraction/bloat for Firefox. Which is definitely arguable, but probably not a reason to write off the biggest independent browser.

As a Firefox appreciator, it's just not something I ever really wanted to use and it got a pretty prominent place in the UI when it came out. Has similar vibes to when windows added the weather forecast to the awesome bar.

Imo the people making a big deal out of it are using it to justify why they're OK sticking with chrome (best case), or have a partisan political reason to hate Mozilla because of their ESG / DEI positions (ughhhhhh)

I was a Pocket user basically since it launched (I was looking for an AvantGo replacement, so imagine that), and I still don't understand Mozilla's purchase or very heavy-handed advertisement of it.

Simple: it's profitable. One of the few profitable side ventures they have.

HN loves to simultaneously criticize Mozilla for

1) being utterly financially dependent on Google

2) putting resources into anything except Firefox

3) doing anything that smells like monetizing Firefox

Spoiler alert: They can't avoid 1 without doing 2 or 3. It is what it is.

I'm bothered that it's still not open source, despite promises when it was first announced (it's been 6 years!)

> Isn't it just a way to sync a reading list across browsers, and have those pages pre-cached on a mobile device for reading when you have no connection?

Basically, and I’ve been using it for that since before the acquisition, although recently the Android version had removed the option to cache full versions (only reader mode remains), which has enough of an impact on my usage that I’m planning to migrate away.

Still, there’s a lot of things that seem very misaligned with Mozilla’s mission: the huge dark-pattern tracking banner, the non-open-source nature, the huge dark-pattern tracking banner, the default homepage with weird US-politics-related recommendations that has replaced the actual list, the huge dark-pattern tracking banner, the recommended links inserted at the end of each article as an engagement-driven manipulation, and have I mentioned the huge dark-pattern tracking banner with the accompanying tracking. This would be an expected amount of evil assholery from a random SV startup, but from Mozilla it does feel like a point to add to the betrayal tally (hello EME/Widevine),

The funny thing is that even though it's a Mozilla product now and even though it's somehow "integrated" in the browser, I still have to log into it separately regardless of the fact that I am already logged with with Firefox Sync

Funny that you mentioned that, they're switching quite soon: https://support.mozilla.org/en-US/kb/pocket-firefox-account-...

I was using Pocket when they announced the start of the transition a while back and their flow to migrate bookmarks to the Firefox account just didn't work, I ended up with an empty account – maybe because I was using a different email address for my Firefox account than for my Pocket account but it made me stop using Pocket altogether, really annoying.

And that's more than six years after the acquisition. This was very poorly handled for sure.

My wild guess is that they could not do a SSO with Pocket and Firefox Sync until they got rid of all the other authentication providers/methods that Pocket supported, a change which people like me would complain about.

> My wild guess is that they could not do a SSO with Pocket and Firefox Sync until they got rid of all the other authentication providers/methods that Pocket supported

Why? Technically, it shouldn't be impossible - one shouldn't exclude the other.

JavaScript that the Kobo can't execute for example. The browser/web view on Kobos is very very limited.

Actually as a kobo owner I've always wondered what JavaScript it can execute, what styles it can render, ect. Always seemed wildly inconsistent. Any idea?

I suspect that very little, if any can be executed. No hard data nor first hand knowledge on that though.

What's the alternative though? All the others have already sold their users off ...

I use LibreWolf.

Free, up to date and does not send neither money nor data to Mozilla.

But personally I don't care so much about privacy extremism:

The day another more liberal organization forks it again, adds Google search for some easy cash and start fixing the extension API etc I am probably going to recommend that.

I already dial back some extreme measure(s), nuking my sessions whenever I close the browser comes to mind.

Also of course I will not use Google myself, but it seems to be the way for browser developers to make a living so I'll allow whoever takes care of the future of Firefox to do the same.

> If you own an Apple Silicon powered MacBook the relative builds are refered to as aarch64, they are cross-compiled and we did not test them before release.

> It is possible that Apple Silicon users see their recently downloaded LibreWolf flagged as broken or unsafe by the OS. This happens because we do not notarize the macOS version of the browser: we don't have a paid Apple Developer license and we don't want to support this signing mechanism that is put behind a paywall without providing significant gains.

Eeerm... no, thank you.

Will reconsider if it appears in openSUSE Tumbleweed repos after passing a security review from the openSUSE team ;)

They're all effectively the same on that point, so I use the one who's interface I prefer, and which performs best on my hardware. Firefox is neither.

I cannot believe how much Hacker News equivocates:

A browser made by an Ad Tech company that aims to lock down and control the web.

And a browser made by a nonprofit that occasionally makes a minor mistep.

You cannot seriously compare the remote attestation DRM, manifest v3 changes, to, what ? the Mr. Robot ad that was tacky? the pocket integration that's pointless and annoying but otherwise harmless?

Seriously, y'alls double standards are insane and focuses so much towards how bad it was that Brendan Eich got kicked out that it comes off as extremely political

Firefox is NOT made by a nonprofit, that's the problem. It's made by a for profit corporation using the shell of a noprofit to claim legitimacy. This for proffit Mozilla Corp is primarily funded by an ad tech company and has itself dabbled in ads multiple times, contrary to the interests of the userbase that the nonprofit should be looking out for. These aren't minor misteps but repeated deliberate decisions to ignore user preferences.

The Mozilla Corporation is a for profit company completely owned by the nonprofit the Mozilla Foundation. Originally there was just the nonprofit, but that caused tax issues with the money generated from the search deal, and after paying a few million to the IRS they switched to the current setup.

I don't think it's fair to claim the nonprofit side only exists to "claim legitimacy." All of their revenue goes back into the corporation or the foundation.

I agree with boomboomsubban above.

This a very common arrangement used by charities to enable a commercial process that funds the charity. For example, high street charity shops may be part of the commercial sub-entity so that their accounts are processed like a normal company, but 100% of their profits become donations to fund the parent charity's activities, called the charitable purpose(s).

If they didn't separate into a parent charity with a commercial sub-entity, all of the activities of the sub-entity would be subject to charity auditing, accounting and purpose rules, which in practice would make it difficult to run a shop competitively, or alternatively the parent could not have charity status and the shop profit would be subject to tax instead of all being directed to the audited, charitable purpose(s).

In Mozilla's case, if it was a tax-exempt non-profit without a commercial sub-entity giving 100% of profits to its parent, it would not be able to take Google funding as a trade in exchange for making Google the default search engine without losing its tax-exempt status, and it might not be able to pay its software engineers a competitive market rate, even if it needs to do that to compete. It would be able to take donations (not as a trade in exchange for something, just as a donation), but that wouldn't be enough to develop a competitive browser.

> In Mozilla's case, if it was a tax-exempt non-profit without a commercial sub-entity giving 100% of profits to its parent, it would not be able to take Google funding as a trade in exchange for making Google the default search engine without losing its tax-exempt status, and it might not be able to pay its software engineers a competitive market rate, even if it needs to do that to compete.

That doesn't sound like a bad thing. Googles funding is not a boon but a shackle that holds FF back. Same for developers that expect SV market rates - those will be developers that are used to user-hostile software developement practiced in other SV companies.

> It would be able to take donations (not as a trade in exchange for something, just as a donation), but that wouldn't be enough to develop a competitive browser.

How do you know? Individual donations are also far from the only possible way to fund a real charity.

Look - I cant claim that there weren't repeated and deliberate bad decisions, and I can't claim that being funded mainly by google gives the best incentives.

But it is really a nonprofit in that (like the sibling says) the corp is fully owned by a nonprofit, not public shareholders.

And its not like google doesn't get anything out of their $. They get set as the default engine. Apple gets paid hundreds of billions by google for this. So its not like Google is paying Firefox for control over it's development.

Like, seriously, they're not perfect but its a pretty wide jump in behavior between it and chrome

Non-profit status and being publicly traded are orthogonal. There are tons of for-profit companies that aren’t publicly traded.

the point is - the corporation is fully owned and controlled by a nonprofit so it is essentially a part of the nonprofit. if you don't see this as a meaningful difference, I don't know how to help ya.

I honestly don’t give an fuck about drm or attestatuon. There are only so many things one can find time to care about, and neither makes my list.

Yeah, I'd understand not caring. That's a pretty common and reasonable take, though I'd hope a tech website like this would be more pro-privacy.

But actively caring about browser companies, and choosing Chrome because Mozilla "sold out" when they added pocket is a pretty wild take imo.

Privacy… eh. I care… somewhat. I’ll do things I personally consider reasonable, but I think that, say, the people who completely clear browser state every 5 minutes are barmy (and also probably much more exposed than they think they are - the very act of trying to not Leak anything makes them stand out, if anything).

Yeah that's a pretty reasonable take tbh. I do all that, but I'm fully aware its silly and probably counterproductive.

& hey, if you prefer Chrome because you find it more usable or performant that's a perfectly good reason

I'm mostly upset at the people in this thread (presumably not you) who seem to be against Firefox for ideological reasons which seems completely backwards to me

Pretty reasonable to support the erosion of privacy and foster a "I have nothing to hide, and if you act like you do you're probably guilty lmao" culture along with an Orwellian monopolistic grip on the foremost medium of information exchange of this and probably the next century because of your personal apathy. :) #justreasonablethings

Hey, I'm pretty big into privacy myself. Firefox all the way, 100%. Totally feel you that it's awful.

As much as I'd love it though, I don't think it's reasonably to expect everyone else to care as much as we do. There's plenty of other issues that matter too that I'm glad other people are out there caring about on my behalf. Eg. I know being vegan is better but its a big annoying change and I haven't been able to do it yet.

I'm mostly concerned with all the rhetroic here that's trying to paint firefox as unsympathetic when they are clearly the people fighting on our side. If you don't personally care enough to switch to FF, or use Graphene OS, or run Linux etc. I get that, but pleeease don't also try to discourage other people too, y'know?

(& ofc the real solution is through policy and getting an American version of GDPR/California Privacy act, getting courts to stop the NSA etc. Being preachy online is counterproductive to getting broad support and the mission overall imo)

I already get pop ups from my insurance company (a major one I might add) that FF is not a supported browser when I log into their website. I assume that one day I'll be told to use Edge or Chrome and not allowed to log in at all.

I'm not a privacy fanatic and I don't really care if my browser supports proprietary DRM so that I'm able to watch shows on streaming platforms. However, I see a lot of potential for the remote attestation mechanism proposed by Google to give companies an easy way to enforce "We support this set of browsers on this set of operating systems" and effectively cut off support for Linux and browsers that aren't popular Chromium variants. That doesn't mean I can't go and switch companies but that requires a lot of effort on my part to do so.

It's worse than selling users off. Pocket was integrated for free and Mozilla later bought Pocket. In essence Mozilla paid to sell it's users. (And I liked "read it later" the extension that saved an offline copy of the website. And was later renamed Pocket and removed that ability).

Same with that hidden spyware ad/extension (distributed using channels reserved for delivering 0day bugfixes). Mozilla shit on it's users without even getting paid for it.

> It's worse than selling users off. Pocket was integrated for free and Mozilla later bought Pocket. In essence Mozilla paid to sell it's users.

Maybe I have reading comprehension issues, because it seems to me like it isn't worse than selling users off. Mozilla sold its users... to itself. That's really bad, right?

The alternative is Mozilla not doing so.

You either use Firefox, Edge (fork of Chrome), or Chrome today. Serious companies and the average person only use Chrome or Edge. Anyone serious about privacy is using Tor. Hipsters acting like they're serious about privacy are compiling Firefox or Chromium from source.

"Selling users off" only matters to anyone trying to push some unheard of and less-secure forks of Chrome or Firefox. Nobody notable code-reviews theses browsers, you're at the mercy at some random person or small group to play catch-up with upstream browsers, and you're ultimately still locked into somebody else's decisions.

I use Firefox because double-clicking code one-liners from my wiki doesn't add a newline when pasted into Terminals on Linux, which I use on desktop for the challenge of it. Windows Terminal on Windows doesn't have this issue from any browser and I'm free to use Edge or Chrome there.

This is what happens when lawyer/MBA executives fire technical workers to take those salaries for themselves. Mozilla, like fish, is rotting from the head.

Reply on news.ycombinator.com