Oh-boy...
Might need to be off Twitter while @fugueish and @justinschuh *ahem* digest this press release.
Might need to be off Twitter while @fugueish and @justinschuh *ahem* digest this press release.
https://twitter.com/iblametom/status/1446084927057977344
Big reveal: it's Chromium!
But secure?
But secure?
/me checks their website
*surely* they must be a description of how this thing improves sandboxing, allocators, control-flow hardening...something?
Hrmmm.
talon-sec.com/blog/
*surely* they must be a description of how this thing improves sandboxing, allocators, control-flow hardening...something?
Hrmmm.
talon-sec.com/blog/
Looking forward to a fuller technical description of the hardening they apply. There's legit stuff you can do! The tradeoffs are complex.
Like, you can turn off JITs! It'd be cool to see a security-focused browser go all the way with this approach.
microsoftedge.github.io/edgevr/posts/S…
And maybe you can early adopt MiraclePtr?
docs.google.com/document/d/e/2…
microsoftedge.github.io/edgevr/posts/S…
And maybe you can early adopt MiraclePtr?
docs.google.com/document/d/e/2…
...but the scale of investment needed to move the needle in ways that aren't being moved by others already?
In a codebase this vast?
With no published details?
In a codebase this vast?
With no published details?
You could do *really* aggressive stuff like saying "we don't run on boxes without CFI/CET"...I'd love to see someone go there.
Need the details.
Need the details.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
