I am the journeyer from the valley of the dead Sega consoles. With the blessings of Sega Saturn, the gaming system of destruction, I am the Scout of Silence… Sailor Saturn.

  • 5 Posts
  • 297 Comments
Joined 1 year ago
cake
Cake day: June 29th, 2023

help-circle









  • I’ve been slightly unhappy at my job lately as it’s been getting less cool and more bureaucratic and stressful over time; so I’ve been idly browsing job postings. But so many of them are about AI it’s kinda discouraging.

    Take Microsoft for example, a big company that surely does lots of interesting stuff. They currently have 17 job postings for experienced programmers in California. 12 of them mention AI in the description. That’s 70%. And the only cool position asks for a bazillion years of kernel experience (almost tempted to go for that anyway though).

    Ugh guess it’s maybe not the best time to switch jobs. Really I should just go self employed what could possibly go wrong?




  • OK I might have been a little too harsh, but the security requirements of a browser are higher than pretty much any other piece of software except perhaps for operating system code, emails, or text messages. As a serious player in the browser space it is not optional to get the basic security model / architecture right. This isn’t a matter of a bug slipping through (which can happen to anyone), but the system being designed wrong. Hopefully this company has learned their lesson, treats it with the care it deserves going forward, and bring some diversity to the browser market.

    Anyway that said let’s look at how this was a colossal bug:

    1. The browser required an account hosted on a cloud to use. This is a central point of failure, and cloud is overrated, so should be opt-in.
    2. The browser allowed arbitrary script injection into any webpage based on this cloud account. This is a central point of failure, and goes directly against browser security model so should be opt-in.
    3. The developers did not recognize how dangerous the above was, so perhaps did not treat the back-end with the paranoia it deserved.

    Compare Firefox I have an extension that allows for arbitrary CSS injection, but this extension isn’t cloud based. So this class of vulnerability isn’t possible in the first place, and also it is an extension I opted into and can enable selectively on specific sites instead of globally.