Hacker News Reader

Comment by pennybanks | Hacker News Reader

what would be some security concerns in a situation like this? genuine question

Patches introducing buffer overflows, or weakening existing security through ignorance or negligence.

Remote code execution + local privilege escalation to own your device. Just last week on the RCE front: https://thehackernews.com/2024/05/new-chrome-zero-day-vulner...

right makes sense, ty

Is there such a thing as a 'stable' browser that will never have these flaws. (I'm afraid to use the word Stable since Debian-family corrupted the meaning)

I really don't need push notifications going to my desktop. HTML, CSS... ughhhh javascript...

So if covering javascript is too hard, maybe a HTML/CSS browser, and anytime you need javascript, you open a chrome session.

Chromium likely has plenty of "dormant" bugs - bugs that exist in the source code, but consistently compile to safe (or unreachable) machine code, more or less due to good luck.

This project messes with optimisation flags, which have a good chance of "waking up" those bugs (If you've ever had code work at -O1 but not at -O3, you know what I'm talking about). The same goes for compiler bugs, too. The real Chromium is aggressively fuzz tested, but this project is almost certainly not, or at least, not to the same extent.

Turning on features like JPEG-XL also increases attack surface.

OTOH, the original Chromium is so popular that the motivation of finding these bugs is very high. I think zero-day RCE bugs can be sold for tons of money on the black market.

However, the motivation to find similar bugs in Thorium is very low, too few users. And because the project messes with compiler flags, there’s chance at least some of the Chromium bugs don’t apply to the fork, because the machine code is different. Or maybe they apply but require adjustments to the exploit, which most attackers won’t do because too few users of the fork.

This is one of the interesting parts about owning obscure phones.

I cannot imagine having anything important on an iPhone since there is a huge demand to find a bug in the hardware/OS layer. (And we've seen this live in the wild with multiple 0 click exploits)

Meanwhile obscure phones could only be targeted by Pegasus by:

1. Go to a website and download an app 2. Change your settings to allow this app to install 3. Change another setting to allow this app to install.

I mean... not really elite hackers, I had to do this for my own Android app.

It also usually only gets one release per upstream major version (and sometimes not even that), meaning a lot of Chromium security fixes can take several weeks to show up in a Thorium release. I appreciate the author's effort, but it's definitely riskier than normal Chrome/Chromium.

Stealing bank account sessions

Reply on news.ycombinator.com