Google Experiment Tests Top 5 Browsers, Finds Safari Riddled With Security Bugs (bleepingcomputer.com) 105
An anonymous reader writes from a report via Bleeping Computer: The Project Zero team at Google has created a new tool for testing browser DOM engines and has unleashed it on today's top five browsers, finding most bugs in Apple's Safari. Results showed that Safari had by far the worst DOM engine, with 17 new bugs discovered after Fratric's test. Second was Edge with 6, then IE and Firefox with 4, and last was Chrome with only 2 new issues. The tests were carried out with a new fuzzing tool created by Google engineers named Domato, also open-sourced on GitHub. This is the third fuzzing tool Google creates and releases into open-source after OSS-Fuzz and syzkaller. Researchers focused on testing DOM engines for vulnerabilities because they expect them to be the next target for browser exploitation after Flash reaches end-of-life in 2020.
Simple Fix (Score:1)
Turn off javascript and related scripting shit.
Re: (Score:1)
Turn off javascript and related scripting shit.
It's not that simple. Try using Google without JS. There are tons of other sites with the same problem.
Re: (Score:2, Informative)
It's not that simple. Try using Google without JS.
Actually, google search works ok without javascript. Google mail still has a basic lite mode too. The rest of google won't work without javascript.
There are tons of other sites with the same problem.
Yes, and they are badly written. Compare to amazon - it works with any browser, with or without javascript, because amazon knows you won't buy if their website won't work in the customer's browser.
Re: (Score:1)
There is still another fight to take.
Cross site scripting.
If I go to one page I don't really mind that much if that page has to run some scripts to work.
What I don't see a reason for is for that page to pull in scripts from third party sources that I may or may not trust.
Most pages works fine without them, but those who don't should be considered broken.
Re: (Score:2)
Re: (Score:1)
Javascript is running the internet.
Re: (Score:2)
Re: (Score:2)
"Try using Google without JS"
Proof that Google engineers are shit at real coding.
Hey, Google Engineers, before you do your mass downvote moderation, try explaining why your stuff is so shit in the first place.
Re:Simple Fix (Score:4, Interesting)
It's gotten to the point I do banking on a distro I run off a thumb drive on my laptop. It's designed for security from the ground up and that is the only thing I use it for. As to surfing the web and everything else I don't worry too much and just use the standard Ubuntu on the hard drive.
Re: (Score:2)
Re: (Score:2)
It's plenty secure. Most of the people I know that get hit are the ones using an Android phone of all things. Hackers are lazy too and they tend to hit the low hanging fruit.
Re: (Score:1)
Yeah, real simple. Can't be vulnerable on something you can't use. Why not shut down your computer and lock it in a safe while you're at it.
Are you angry because you're a 'Web Developer' and people might not be able to run your 'code'?
What an impartial study! (Score:3, Funny)
Google finds their own browser is best. News at 11.
Re: (Score:3, Funny)
Apple's reply was that while Safari was not the first, it was the best-looking one.
Re: What an impartial study! (Score:1)
I am shocked!
Next up google disables other browsers from accessing google.com search results, "for your safety".
Re:What an impartial study! (Score:4, Insightful)
Re:What an impartial study! (Score:5, Informative)
Re:What an impartial study! (Score:5, Interesting)
Fuzzers [wikipedia.org] are pretty impartial, and I don't find it hard to believe that the Chromium/Chrome team is the best at security.
Also, I know a couple of people on the Project Zero team, and they treat Google absolutely different from anyone else. They attack everything, regardless of origin, with equal gusto and skill and have a strict, no-exceptions-ever 90-day public disclosure policy. I work on Android and Project Zero has even 0day'd us a couple of times, publishing existing vulns in Android that we haven't gotten fixed within the 90 day window.
It's interesting working with PZ team members directly because even though they're Google employees, they are not subject to the standard employee NDA. More than one time I've had one of them stop me mid-sentence to remind me that they are not allowed to hear non-public information... and that if I tell them anyway they are not obligated to keep it secret.
Project Zero is employed by Google, but that means nothing to them. And, strangely enough, Google is totally fine with that.
Re: (Score:3)
they treat Google absolutely no different
Gah. I reorganized that sentence and in the process lost the most important word.
Re: (Score:2)
Fuzzers [wikipedia.org] are pretty impartial, and I don't find it hard to believe that the Chromium/Chrome team is the best at security.
Does the test actually test Browser "Security" (Whatever that means)? I thought it was testing how well the Browser-Under-Test was implementing the Document Object Model (or, at least, Google's interpretation of same)?
Re: (Score:2)
Of course not! That would be evil, the very thing we all know Google does not do.
Re: (Score:2)
What would Mandy Rice-Davies say??
Re: (Score:1)
Who would even run Safari in the first place? On my phone and tablet I have Chrome, Firefox, and Opera (not the 'mini' skin) installed and use them all.
Is there a corporation that forces people to run Safari?
Re: (Score:1)
Your scatological interests aside, did you have anything to add to the discussion?
Re:no surprise about safari (Score:5, Informative)
Apple. On iOS, all browsers (even Chrome) are actually running Safari's rendering engine, with the exception of browsers that run all the JavaScript server-side. The reason for this is that Apple won't let apps run non-Apple JavaScript engines out of concerns about security. (The irony here is not lost on me.)
Re: (Score:2)
That's not entirely accurate. You could always run JavaScript with JavaScriptCore. What you could not do was use downloaded, interpreted code to significantly change the functionality of the app. For an app like a web browser, the website's content is not part of the app's functionality, so you could use JavaScriptCor
Re: (Score:2)
Apple. On iOS, all browsers (even Chrome) are actually running Safari's rendering engine, with the exception of browsers that run all the JavaScript server-side. The reason for this is that Apple won't let apps run non-Apple JavaScript engines out of concerns about security. (The irony here is not lost on me.)
I think that restriction may be loosening. There is a hint that the latest Firefox for iOS is not running WebKit.
But I might have misconstrued what I read yesterday.
Re: (Score:2)
People using Keychain Access to look after the passwords.
Safari fills them in so a user can log in to many different web sites and forums.
https://en.wikipedia.org/wiki/... [wikipedia.org]
I take it we're all supposed to know... (Score:2)
Re:I take it we're all supposed to know... (Score:5, Funny)
Re: (Score:2)
Re: (Score:2)
Ah thanks, that's my password, but I can never remember it.
Re:I take it we're all supposed to know... (Score:5, Informative)
DOM = Document Object Model
The DOM engine is what is responsible for parsing HTML/CSS, converting it into a tree, and then rendering the tree to the client area in the browser. It's essentially the core of the browser and presents a programmatic API along with JavaScript. It may also be used to render UI elements. For example, all of Chrome's plugins use HTML/CSS to create the menus you see in the options and menu screens.
Re: (Score:2)
Re: (Score:2)
Yes and no. HTML has a lot of non-XMLisms that require special handling in the engine. I think the common strategy is to use a set of recommendations for transforming HTML errors into valid trees which are equivalent to well-formed XML. In memory there is no difference between the two because they are both trees. Technically JSON, YAML, S-expressions, and various other hierarchical serialization formats are also equivalent. In fact, I'm curious why Google hasn't replaced HTML with JSON at this point.
Re: (Score:2)
Now you see what the web monkeys feel like when Slashdot posts articles about security or networking.
Re: (Score:2)
Are web monkeys different from spider monkeys?
Not suprising (Score:3, Informative)
Safari is Apple's IE 6 of this decade. It hasn't been updated in a long time and they can no longer piggy back both Google and Konqueror for new code since Chrome forked -webkit with -blink.
I worked for a famous software supporting their cloud software. Safari was the one browser which always had trouble with even drag and dropping files. Something rudimentary in the HTML 5 standard. Even IE 9 from 2011 can easily support this.
Sometimes Safari would work. Sometimes it would not and the Apple users always get mad at us for some reason never blaming their shitty browser.
Re: (Score:1)
Safari crashes a lot, has no modern features of any note, and essentially is no better functionally than Netscape 2.0.
I use Safari exclusively and I can tell you you are completely full of shit.
Re: (Score:1)
I worked for Apple and I can tell you that you're completely full of shit. Idiots sending in their laptops because the web browser wouldn't work with a website. Good day you apologist shill fuckwit.
Re: Not suprising (Score:5, Informative)
Re: Not suprising (Score:2)
Re: (Score:1)
Apple users always get mad at us for some reason never blaming their shitty browser.
... They are Apple users for a reason
Re: (Score:1, Insightful)
Re: (Score:1)
Did Apple blow it's troll budget in the week after the latest iGadget announcement, and you're the level of troll they can afford now?
Tim! Don't scrimp on your 'evangelism' budget. Where are the top tier trolls you usually deploy on any Apple topics?
Re: (Score:1)
You're a bassoon [wikipedia.org]?
Re: (Score:1)
How are any of your posts moderated over zero? Safari was last updated a couple days ago. There was even a Slashdot post last week that discussed how some advertising firms were upset because the latest Safari blocks cookies that track users across multiple sites.
Re: (Score:2)
How are any of your posts moderated over zero? Safari was last updated a couple days ago. There was even a Slashdot post last week that discussed how some advertising firms were upset because the latest Safari blocks cookies that track users across multiple sites.
Yep which is why even Microsoft scores higher than safari [html5test.com] and until recently scored on par with IE!
Re: (Score:3, Insightful)
Safari in High Siera score 457. Safari loses 11 points as it doesn't support Ogg, WebM. 11 points lost because they don't support something that isn't useful (unless you have a 4k screen and want to watch new 4k youtube vids). WebP and JPEG-XR add in another 2 useless points missing.
This is the problem with html5test. It includes so many features which are of no interest to the majority of people. WebVR? How the fuck is this relevant to how good a browser is?
html5test is setup to make Chrome look be
Man oh man (Score:3)
I can't believe so many of you are such zealots when it comes to your web browser of choice.
On the same subject (Score:2)
Google testers could find no security bugs whatsoever in Chrome. "It's a fucking rock," said one tester.
Safari bugs already fixed! (Score:2)
It looks like all of the Safari bugs were fixed earlier this year...
Odd report (Score:1)
So, it is interesting that they do not mention versions that they used of any of these browsers, unless I missed that detail. They only mention 'currently released'
But much more odd "Instead of fuzzing Safari directly, which would require Apple hardware, we instead used WebKitGTK+ which we could run on internal (Linux-based) infrastructure". Google does not have a Mac, anywhere?
So they did not run this as a user would, or in fact a proper OS X Safari release build at all. Ok, seems legit...
This from the com
Ford Test Shows Chevy Has Most Safety Issues (Score:2)
...and Chrysler has the second most. Ford had none.
Film at eleven.