Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
Safari 15 IndexedDB Leaks (safarileaks.com)
130 points by agust on Jan 15, 2022 | hide | past | favorite | 29 comments



I never understand why WebSQL was replaced by IndexedDB, it was so much faster! Sure different implementations and all, Sqlite vulnerability and what not arguments! And still I see exploits every year on IndexedDB every year, the only thing that changed is it's slower!


This I can actually answer :D

Multiple reasons:

* No two SQL implementations have the same dialect

* There is no publicly available specification

* The people in charge of the non-free specification have demonstrated no desire to:

    * Make the spec public and freely available

    * Remove (or make mandatory) any optional features

    * Update the spec to match the real world, unify discrepancies, and require conformance to that spec

  * Following the above, existing commercial vendors have no desire to create a unified specification that covers, presumably as that would ease transition between DBs?

The core problem was that existing websql implementations were just shipping wrappers around sqlite. That meant no one could create an implementation without first doing a blackbox rewrite of sqlite, and would just have to hope they hadn't messed up anywhere.


I'm viewing the page on Firefox for Android and it looks sort of like the exploit works. Anyone else?


It looks like the page only does a User-Agent check[1]. The sites under "The demo detects the following websites:" is just a list of sites that the demo has hardcoded support for detecting[2].

[1] https://github.com/fingerprintjs/blog-indexeddb-safari-leaks...

[2] https://github.com/fingerprintjs/blog-indexeddb-safari-leaks...


It is reporting "not affected" for me on Firefox stable and nightly. It does show a list of domains at the bottom that it would check if the brower was exploitable.


I assume safari is the only effected browser but the site itself gates on a user agent check, because of course it does.


All of this hell has broken loose due to youtube hiding dislikes


How so?


[flagged]


Software bugs have nothing to do with an organisations intentions.


If they let other browers engines on iOS people could choose more privacy focused browsers.


Nope. People will install Chrome, Google will make sure nothing else works with it. And all other browsers die.


Exactly. Then your entire system is at the mercy of Google.

Furthermore, why would Apple want an adtech black box on its devices?


Wrong question, why it's not apples iphone, they sold it to you. And as a user you might be interested in a browser from a company interested in you using the web and not being stuck with apps that only work inside the walled garden


This is a good point, but we need to be mindful of the consequences. Opening the walled garden effectively hands the web over to Google, despite any immediate benefits there might be for users.

In the current situation, iPhone users can at least switch to Android. I'll take an imperfect status quo over a bad faith actor determining the future of the web for everyone.


Well, forcing Safari onto users is a pretty terrible "solution" (and an abandoned cause on desktop). If Apple is going to fold halfway, they may as well just put their cards on the table. The web is already lost to Google: some 60% of all web traffic comes from Google Chrome, and that's not even counting the people using browsers based on Blink. If Apple, with 200 billion dollars in liquid cash, cannot create a browser that's good enough on it's own merits to compete with Chrome, then the battle is over. There was no war.


Safari is a great browser, I use it on my phone and when ever I’m on a Mac. I’ve never had a reason to use another browser on either platform.


> If Apple, … cannot create a browser that's good enough on it's own merits to compete with Chrome, then the battle is over.

It can? Half of mobile users use Safari on iOS today. Im using Safari on Mac, no other browsers needed.


> Half of mobile users use Safari on iOS today

Correction, all of mobile users use Safari on iOS today. Webkit is your only option, everything else is just the same browser with a new interface added to it.

Maybe if there were actually multiple browsers to choose from on iOS, we could make that distinction and know for sure. Until then, I think it absolutely holds true.


> Correction, all of mobile users use Safari on iOS today. Webkit is your only option

When browser stats show X amount of people using Mobile Safari, those people are using Mobile Safari. Not a different web browser using WebKit.

> everything else is just the same browser with a new interface added to it.

There is more to a web browser than just its rendering engine. Chrome wasn’t “just Safari” up until they forked Blink. It used WebKit, sure, but it also had loads of development put in elsewhere.

Saying that an alternative web browser is “just Safari” because it uses WebKit is like the Hacker News cliché “I could do that in a weekend”. Sure, you might be able to knock out a proof of concept easily, but you are vastly underestimating the amount of work involved in the real product.


> Correction, all of mobile users use Safari on iOS today.

Some mobile users have Android, so correction incorrect, but real bad phrasing on me :)


You might want to re-read the sentence you quoted. It clearly states "on iOS".


Nuker was basically apologizing for the poor phrasing in his parent comment; smoldesu understandably used the same phrasing in his correction to make his point, but, in doing so, his correction suffered from the poor phrasing too. The subjects of the sentences were "half/all of mobile users", which, in the latter case for example, implies that everyone uses iOS. Nuker's intention was to refer to "iOS mobile users" only, not mobile users in general. Kudos to him for rereading his original and going "Oops! :)".


Safari is a privacy focused browser. Privacy focused browsers have security vulnerabilities too.


I’m amazed Meta/Instagram is getting investigated for antitrust while Apple is getting away with what got MS pegged in 98. It’s easy to assume regulatory capture but I wonder if Apple is effectively untouchable by whichever party is incumbent. Apple represents such a huge chunk of the US economy that penalties would likely rock the market. Market instability has ruined the careers of many politicians over the years.


The case against MS was abusive licensing practices. MS blocked OEMs from choosing their own default browser, and charged OEMs a license fee even if the computers weren't running Windows. That doesn't apply to Apple which does not license their OS.

Android and ChromeOS both technically allow other browser engines, but in practice non-Chromium browsers are a rounding error on those platforms. You can technically allow other browser engines, but that does not create a robust browser market.


All of that is just conjecture until Apple actually allows different browser engines.


Apple and Google are the most deserving of being split up [1], but you won't see it happen. Do you know how many congresspersons likely hold Apple stock?

Meanwhile Facebook is used as a platform to criticize politicians on both sides of the aisle. They all hate it.

[1] As I most recently articulated here: https://news.ycombinator.com/item?id=29908253


It's a pretty nice canary for their black-box coal mine though. If we had any better way to understand Apples internal intentions, we'd be using it.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: