- Dillo-dev - lists.mailman3.com

Re: [Dillo-dev] Dillo 0.7.3 delayed...

by Jorge Arellano Cid

On Wed, 9 Jul 2003, Kelson Vibber wrote: > It looks like dillo.auriga.wearlab.de is still referenced in several places > in CVS (at least a few hours ago). > dillorc > doc/Dillo.txt > src/prefs.h > > The second one probably doesn't matter much, but the first and third mean > that the default home page is still pointing to the old site. Thanks a lot Kelson! I just made the changes and commited. Jorge.- PS: I almost forgot to sync with dillo package maintainers (.rpm .deb .tgz).

July 10, 2003

Re: [Dillo-dev] Suggestion & patch for browser identification (user-agent)

by Phil Pennock

On 2003-07-09 at 08:55 -0700, Kelson Vibber wrote: > However, it seems to me that it would be just as trivial to put several > malicious images on a single page, each targeting a different system. It's > not as if multiple images on a page - or even multiple broken images - > would raise much suspicion. No, because the first one that overflows the buffer will either crash the browser or successfully exploit the issue. People tend to notice when their browser crashes ;^) -- or at least, I do which is another reason why I like Dillo. :^) My boss too is a convert because of the simplicity, stability and speed, only resorting to other browsers when necessary. So it's an all-or-nothing attack -- unless you happen to know that on one platform the browser loads images in one order and on another platform it loads them in reverse order, in which case you can conceivably get two attack opportunities for the price of one. You don't see a broken image link if the browser has already been compromised or crashed. Hence a user-agent saying "I'm this version of this browser running on this OS on this hardware platform" is, uhm, interesting. Knowing Netscape 4.76 tells the attacker which security holes you're vulnerable to; knowing the other details says which exploit is likely to work. Many types of shellcode can to some extent successfully handle different builds using different locations. But hey, it's trivial to find the place in the code to make such changes in Dillo, so anyone who's bothered by the issue can do something about it. So don't let people like me stop you from doing this -- I just ask that people consider the issues before doing something just because every other browser does it. -- 2001: Blogging invented. Promises to change the way people bore strangers with banal anecdotes about their pets. <http://www.thelemon.net/issues/timeline.php>

July 9, 2003

Re: [Dillo-dev] # users (OT)

by Kelson Vibber

At 06:33 AM 7/9/2003, JoeHill wrote: >linux seaq <linux(a)seaq.com.co> uttered: > > Hi, i wonder how many of us (dillo's users) exists already? > >42 So *that's* the question! Kelson Vibber www.hyperborea.org

July 9, 2003

Re: [Dillo-dev] Suggestion & patch for browser identification (user-agent)

by Kelson Vibber

At 06:41 AM 7/9/2003, Diego Sáenz wrote: >I agree with this. Only one detail about the path: what about use >autoconfig to fill a define with the system and plataform instead to add >code? I thought about that, but it's a matter of accuracy where systems are compatible, but named differently. The only sure example I can think of is Intel-style processors - you can compile a program on an i386 and run it on an i686, for instance, or the other way around if you don't use Pentium-specific optimizations. If the various *BSDs are binary-compatible, that would be another case (i.e. if you can compile on FreeBSD and run on OpenBSD), but I don't know if that's possible. Kelson Vibber www.hyperborea.org

July 9, 2003

Re: [Dillo-dev] Suggestion & patch for browser identification (user-agent)

by Kelson Vibber

At 06:15 AM 7/9/2003, Phil Pennock wrote: >The problem with these is when there are security holes in image >rendering libraries (eg, versions of Netscape with custom handlers for >extended information in GIF files). If you state the system >architecture then it's relatively trivial to use the User-Agent field on >the server-side to select the image with the correct shell-code to >exploit your system. Hmm, I hadn't thought of that one. There are a couple of discussions linked to from the Mozilla page I mentioned, but they're mainly focused on things like revealing the OS version to make follow-up hacking attempts easier. However, it seems to me that it would be just as trivial to put several malicious images on a single page, each targeting a different system. It's not as if multiple images on a page - or even multiple broken images - would raise much suspicion. >open source >means I get to run stuff how I like it; everyone gets what they want (as >long as they can make trivial hacks) so everyone's happy. Agreed! Kelson Vibber www.hyperborea.org

July 9, 2003

Re: [Dillo-dev] Dillo 0.7.3 delayed...

by Jorge Arellano Cid

On Wed, 9 Jul 2003, Jorge Arellano Cid wrote: > [...] > The good/bad news (depends on being optimistic/pesimistic!) is > that yesterday I found a bug. The newest CVS has a g_print that > makes it evident. I digged in a bit more and found the bug! Just a missing "break;" inside a case. The patch is in CVS. In any case, I'll wait for Sebastian to confirm me that. At first I hesitated because 5 anchors in the splash page produced about 15 extra calls, but this seems OK because they need to update the offset as the text rewraps. Once this is confirmed, 0.7.3 will be released (on Thursday). Cheers Jorge.-

July 9, 2003

Re: [Dillo-dev] Suggestion & patch for browser identification (user-agent)

by Nicolas Kaiser

* Kelson Vibber <kelson(a)pobox.com>: > So does anyone else think this is a good/bad/interesting idea? And is anyone > interested in testing it on *BSD/Solaris/Mac/etc.? I think it is a good idea. Working nicely on Gentoo Linux ppc. User-agent says Dillo/0.7.2 (Linux ppc). Have a nice day, n.

July 9, 2003

Dillo 0.7.3 delayed...

by Jorge Arellano Cid

Hi guys! Did you test 0.7.3 as I suggested? The good/bad news (depends on being optimistic/pesimistic!) is that yesterday I found a bug. The newest CVS has a g_print that makes it evident. Valgrind says: ==983== Invalid memory access of size 1 ==983== at 0x4014861B: strcmp (in /usr/local/lib/valgrind/valgrind.so) ==983== by 0x403CABAD: g_str_equal (in /usr/lib/libglib-1.2.so.0.0.10) ==983== by 0x403BDB38: g_hash_table_lookup_extended (in /usr/lib/libglib-1.2 ==983== by 0x805B912: p_Dw_gtk_viewport_put_anchor (dw_gtk_viewport.c:770) ==983== Address 0x41054960 is 0 bytes inside a block of size 12 free'd ==983== at 0x40148050: free (in /usr/local/lib/valgrind/valgrind.so) ==983== by 0x403C1FE8: g_free (in /usr/lib/libglib-1.2.so.0.0.10) ==983== by 0x805D646: Dw_page_destroy (dw_page.c:338) ==983== by 0x402EB876: gtk_marshal_NONE__NONE (in /usr/lib/libgtk-1.2.so.0.9 Note the p_Dw_gtk_viewport_put_anchor where the g_print is. This may come from somewhere else, so let's hunt. It should be solved before making the release. Cheers Jorge.-

July 9, 2003

Re: [Dillo-dev] Suggestion & patch for browser identification (user-agent)

by Todd Carson

On Tue, 8 Jul 2003 19:44:50 -0700 Kelson Vibber <kelson(a)pobox.com> wrote: > > So does anyone else think this is a good/bad/interesting idea? And is > anyone interested in testing it on *BSD/Solaris/Mac/etc.? > Your patch works for me on Solaris. It sets the user-agent to Dillo/0.7.2 (SunOS sun4u).

July 9, 2003

Re: [Dillo-dev] Porting to Windows?

by Jorge Arellano Cid

On Wed, 9 Jul 2003, Lars Segerlund wrote: > > It seem's the windows platform is losing ground rather rapidly, so it > might not be worth the trouble to support at soon to be obsolete system. I'd love to be able to cite these words in the future! I'll be looking forward! > ;-) Lars Segerlund. > > ( there is a smiley above, no flames :-) ). Technically, Dillo aims to run in POSIX compatible systems. Cheers Jorge.-

July 9, 2003