• 6 Posts
  • 150 Comments
Joined 6 months ago
cake
Cake day: March 12th, 2024

help-circle












  • Its still the same extension, same source code, same logic, just less capable

    the same… but not the same… ??

    I think the technologies are quite different.

    uBOL is entirely declarative, meaning there is no need for a permanent uBOL process for the filtering to occur, and CSS/JS injection-based content filtering is performed reliably by the browser itself rather than by the extension. This means that uBOL itself does not consume CPU/memory resources while content blocking is ongoing – uBOL’s service worker process is required only when you interact with the popup panel or the option pages.

    Are you claiming non-lite does the same, plus more?

    You say it’s the same source code, but it’s a different source code repository. non-lite, lite.




  • the most relevant:

    To take advantage of the vulnerability, a hacker has to already possess access to a computer’s kernel, the core of its operating system.

    For systems with certain faulty configurations in how a computer maker implemented AMD’s security feature known as Platform Secure Boot—which the researchers warn encompasses the large majority of the systems they tested—a malware infection installed via Sinkclose could be harder yet to detect or remediate, they say, surviving even a reinstallation of the operating system.

    For users seeking to protect themselves, Nissim and Okupski say that for Windows machines—likely the vast majority of affected systems—they expect patches for Sinkclose to be integrated into updates shared by computer makers with Microsoft, who will roll them into future operating system updates.


  • notably

    Windows is not impacted by this issue.

    quoting the main, critical part:

    1. Under public domain (.com), the browser sent the request to 0.0.0.0.
    2. The dummy server is listening on 127.0.0.1 (only on the loopback interface, not on all network interfaces).
    3. The server on localhost receives the request, processes it, and sends the response.
    4. The browser blocks the response content from propagating to Javascript due to CORS.

    This means public websites can access any open port on your host, without the ability to see the response.