Let's say that, like most everyone else in the world, they already know how to break firefox and internet explorer, etc. They don't want to spy on your net, they want to steal your files.
The Govt in question is obviously the US Govt. They want to know how to break Chrome, and every other net-facing app, so that they can hack your computer and spy on you, whoever you might be. Did you know, the CIA does do espionage?
Actually, you can fix it, too: chromium is open source.
Good to see this tired claim getting its play in this thread. I wondered how long it would be until it showed up. I think everyone who says "go fix it, it's open-source" should instead be required to come back with a diff within 24 hours.
People are quick to demand bug fixes or better security, but they never seem interested in actually doing the work.
I don't use Chrome or Windows, so I have almost negative personal interest in this story. However, some people probably do use Chrome and Windows, and those people's demands should be tempered by reality. If they didn't find this bug, why did they expect Google to?
I think everyone who says "go fix it, it's open-source" should instead be required to come back with a diff within 24 hours.
I think everyone should be required to give me a pony.
The person you replied to did not demand anything but instead theorized about a way to fix it.
I love how you assert that literally anybody could check out Chromium and fix the sandbox, a sensitive security-essential part of the browser, with very little effort required to appreciate the source and all of the moving parts.
Not dumb, there's just a lot of skills assumed to work on the security components of a modern Web browser. I would never claim that I could turn around and fix this bug as an outside developer. Words in my mouth.
In my opinion, this is one step away from sacrificing a virgin to make it rain. We should control our own software destiny and not just hope other people will do it for us.
There's absolutely no evidence that this has anything to do with Flash. In fact, even if it was via Flash, there would still have to be another vulnerability to escape the Chrome sandbox, which could very likely be exploited via other means.
