Chrome Releases Blog

Chrome stable 89.0.4389.90 was released on March 12: https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop_12.html

Version bump in nixpkgs: https://github.com/NixOS/nixpkgs/commit/5f8b95113983c8f31d635c0930d9a6681e929bdb on March 13 (one day later)

Released in nixos-unstable on Mar 16 11:11:22 UTC (four days later)

Backport to 20.09: https://github.com/NixOS/nixpkgs/commit/26ba8cd77b5a4408799ffb02b281cd40382c8688 on March 13 (one day later)

Released in nixos-20.09 on Mar 16 16:31:31 UTC (four days later)

Again, four days is not great for a Chrome zero-day. NixOS doesn't have a professional security team, and if you need that assurance, maybe you can't use it. But please don't exaggerate and muddy the facts.

Most of the delay is due to hydra having to build everything that came in ahead of that change on the master branch, and sometimes the master branch is just broken.... I wish there was a fast-track process that could bump urgent security changes ahead of other ones, but it seems like it could complicate things a lot.

Of course, as I said above, it's relatively easy for you to update your local install without waiting for all that, if you're aware of the release and its severity.

Not totally related, but someone know if exist an RSS feed to follow the stable Firefox releases? Can't find it on this page.

This Firefox changelogs are awesome to know big improvements and new features on a surface level.

For Chrome I didn't find a proper way to follow the releases even if it has some RSS feeds, I follow the RSS feed of Chrome Releases blog [1] with a tag filter [2] but can't exclude the several point releases, and also the changelogs are not very informative [3]. And the Chrome blog [4] I get some feature announcements but is a mix bag.

[1] https://chromereleases.googleblog.com

[2] http://googlechromereleases.blogspot.com/feeds/posts/default/-/Stable%20updates

[3] https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop_19.html

[4] https://blog.google/products/chrome/

Sure, but opening the image in a browser wont run any malware even if there's one concealed inside the image data that can be extracted by specific "innocent-looking" software.

The only possibility of doing something that bad (i.e. running the malware by just opening the image) would be a malformed image that manages to do a buffer overflow in the image parser of the browser (see this recent example: https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html)... but I rather think that this specific case is just a false positive.

EDIT: someone in the thread apparently rescanned the file (I didn't check if the file was the same or was modified in-between on the original site) and it indeed appears clean now.

Side note: I wish there was an accepted industry-wide, machine-readable format for security advisories. It's kind of a pain that every project out there defines their own way, ranging from atrocious blog posts:

https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html

to plain text files:

http://web.mit.edu/Kerberos/advisories/MITKRB5-SA-2015-001.txt

or custom XMLs:

https://www.openssl.org/news/vulnerabilities.xml

The CVRF standard promised to be this but is largely unused since it's fairly rigid and requires a lot of investment to get it right.

Even GitHub's advisories are fairly limited in the metadata they provide and only accessible through the GraphQL API.

> most of the bugs that Rust could have prevented right on the beggining are already covered (Chrome also uses fuzzers and static analysis tools to automate C++ code)

This isn't even close to true...

https://chromereleases.googleblog.com/2020/08/stable-channel-update-for-desktop_18.html

Here's one from just this month.

Here's another from just this month with another fifteen issues:
https://chromereleases.googleblog.com/2020/08/stable-channel-update-for-desktop.html

There are hundreds a year like this. I could find many, many, many more.

Sorry, but what? Every big C/C++ project is regularly plagued by memory-safety issues. This is a blog post from Chrome where the majority of bugs are memory-safety bugs: https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_29.html

This is a project with world-class resources for enforcing memory safety, and yet they regularly encounter this class of bugs.

C and C++ do not provide sufficient tools to prevent memory safety, and this has been demonstrated across basically every project they're used in.