Skip Navigation

Kangae_Hishiryo

@ Kangae_Hishiryo @scribe.disroot.org

Posts
5
Comments
128
Joined
5 mo. ago

[ Cisheterosexual | Cisgender | He/Him | 24 yo | ES/EN | Venezuelan | ADHD, autism and bipolar disorder | agnostic atheist ]

I'm just a random weeb. I love anime, dubstep, science, philosophy, logic and tech all along.

PS: English isn't my native language, so sorry if I mispell some things, please kindly point it to me.

  • Google Has Removed Manifest V2 Extensions From the Chrome Web Store, Including uBlock Origin

    Jump

  • Handing third-party extensions blanket permissions to inspect and modify live plaintext traffic across all tabs creates a massive MITM exfiltration surface. Moving rule matching to declarativeNetRequest enforces least privilege by executing filters in the native engine without exposing sensitive network payloads to extension code.

    You're doing a false equivalence here.

    It's not about blanket permission vs. almost no permissions.

    You can have granular ACLs (which are being hindered by MV3), or OCap/CapSec, or even other security and permissions approaches.

    They're or incompetent or malevolous, these are the only two options left when you think a bit about it.

  • Google Has Removed Manifest V2 Extensions From the Chrome Web Store, Including uBlock Origin

    Jump

  • webRequestBlocking is not deleted in MV3. The synchronous blocking engine still exists in Chromium. If an extension is installed via local policy or the Windows Registry (ExtensionInstallForcelist), full programmatic webRequestBlocking executes in Manifest V3 just as it did in MV2.

    It is in practice.

    Not all users are able to do that (local policy install), as not all users are (or have to be) that tech savvy. That's an exclusionary barrier towards inclusion and accesibility of security and sovereignity features.

  • Google Has Removed Manifest V2 Extensions From the Chrome Web Store, Including uBlock Origin

    Jump

  • Not all users are able to do that, as not all users are (or have to be) that tech savvy. That's an exclusionary barrier towards inclusion and accesibility of security and sovereignity features.

  • Google Has Removed Manifest V2 Extensions From the Chrome Web Store, Including uBlock Origin

    Jump

  • Blaming process isolation and IPC for memory bugs like Use-After-Free and dangling pointers fundamentally confuses language-level C++ problems with OS containment architecture. Memory corruption exists across all C++ engines (Gecko, WebKit, Blink); isolation is what prevents those bugs from compromising the host OS.

    Yeah, but they instead greatly compromise the browser, and the problem is that these are not as likely to happen in MV2 (i.e., Firefox).

    Why? Simple:

    1. You have a long operation running inside an extension.
    2. Your system (or the browser itselfs) suspends or even kills the associated Service Worker.
    3. A new one has to be created.
    4. If the previous memory chunk goes unreferenced, then you have a double free and/or an UAF.
    5. If the previous memory chunk doesn't get unreferenced, then you get a dangling pointer.
    6. Either way you get a race condition if it's something concurrent.

    The problem is, if an attacker and/or a malicious process do compromise that unreferenced or unallocated memory, then any and all sandboxing will be esentially irrelevant and thus vulnerated, vulnerating not only the browser (something that itself can compromise sensible information), but even the OS.

    Then you have the zombie processes because the current memory model in V8 causes SWs to forcedly stop before they can do any cleanup.

    MV3 is not about security at all, is about more control over your own computer and about more control over the network (that way they can let more trackers, zero-days, ads, malvertisers and even malware to pass because browser-level blockers and firewalls won't be able to block them).

    Edit: MV3 is a perfect example of inverse tivoization.

  • Google Has Removed Manifest V2 Extensions From the Chrome Web Store, Including uBlock Origin

    Jump

  • No, they're intrinsically less secure.

    They generate memory issues (use-after-free, dangling pointers, double free(), zombie processes, uncomplete teardown, GC failures or abrupt stops, race conditions, etc.) because of their shitty isolation, and their poor service-workers and IPC architecture.

    What's worse, they greatly limit the network APIs needed to active defense (DNR instead of webRequest).

  • do not feed the trolls

    Jump

  • Yeah, but you can at least make other people less prone to fall for their bullshit

    There are vulnerable people that might fall for their stupidity, so at least we must deny their nonsense so that fewer people fall for it.

  • do not feed the trolls

    Jump

  • Yeah.

    There are vulnerable people that might fall for their bullshit, so at least we must deny their nonsense so that fewer people fall for it.

  • do not feed the trolls

    Jump

  • You wouldn't say that if you actually knew that most echo chambers are like the Incels, the neonazis or the pro-MAGA.

  • Debian developer Antoine Le Gonidec resigns after option allowing corporate LLM use without disclosure wins vote

    Jump

  • There are ways to enforce it. Yeah, you won't be able to make everyone follow the rule, but it's the same with any law and any public policy and they're still valuable. You don't make campaigns against DUI because you expect everyone to stop doing it, as that's a nirvana fallacy, you make them because you expect them to reduce DUI.

  • Locked

    hmm

    Jump

  • Torturing them is the only sane thing to do :)

  • Why so serious bro

    Jump

  • Lol lol

  • You wouldn't download furniture

    Jump

  • Damn, that's why we need aitables in their place

  • You wouldn't download furniture

    Jump

  • And if so... Dawg with nftables 💀

  • Skip today's Windows 11 update: it breaks cursor styling, resets wallpaper, and more

    Jump

  • Quit Windows today *

  • I hear they're filled with gold coins.

    Jump

  • This has nothing to do with it, but I have read "The butteries are for sure" because I was walking while listening. I'm so cooked fr 💀

  • Relatable

    Jump

  • I really desire that older case designs (I mean, those with ports in the front part) become back.

  • 😈😈 Muahahhahaaa

    Jump

  • Never believe in anything, gotcha

  • The Forest | Poorly Drawn Lines

    Jump

  • I know several dumb people, and they're all my different personalities.

  • We ignored the signs.

    Jump

  • I'm fan of dubstep so I relate to you

  • Removed

    The fact that you can’t run through Windows setup w/o internet and an online account is absolute bullshit

    Jump

  • That's the worst part!