Firefox zero-day was used in attack against Coinbase employees, not its users

Re:Firefox zero-day was used in attack against Coinbase empl... by ErikAugust on Thursday June 20, 2019 @07:41PM (#20238569)

Do you know why? Isn’t a security fix a bug fix?

[ Parent | on HN ]

Re:Firefox zero-day was used in attack against Coinbase empl... by tedunangst on Thursday June 20, 2019 @07:49PM (#20238620)

Nope. Security vulns are not regressions!

[ Parent | on HN ]

Re:Firefox zero-day was used in attack against Coinbase empl... by luch on Friday June 21, 2019 @01:43AM (#20240145)

And how do you qualify "Meltdown" and it's notorious bad fix "Total Meltdown" in that case ?

To me, the bug fix introduced a clear regression, allowing an even more powerful vuln in the process.

[ Parent | on HN ]

Re:Firefox zero-day was used in attack against Coinbase empl... by tru3_power on Thursday June 20, 2019 @11:51PM (#20239737)

I’m confused what do you mean? Fixing security vulns can often times lead to regressions since overtime users become dependent on a behavior that relies on a insecure behavior.

[ Parent | on HN ]

Re:Firefox zero-day was used in attack against Coinbase empl... by staticassertion on Friday June 21, 2019 @02:38AM (#20240380)

Secure behaviors should generally trump API guarantees.

[ Parent | on HN ]

Re:Firefox zero-day was used in attack against Coinbase empl... by bscphil on Friday June 21, 2019 @02:47AM (#20240433)

Your parent comment didn't say security fixes couldn't lead to regressions, they said security vulns themselves aren't regressions.

[ Parent | on HN ]