Shadowing Practice: Firefox and Tor hit with 9.8 critical level exploit - Learn English Speaking with Video
בחר מצב תרגול
כל מצב פותח חדר תרגול במסך מלא.
47 משפטים
אם המשפטים קצרים או ארוכים מדי, לחץ על ערוך כדי להתאים אותם.
1
Last week, we talked about a major exploit discovered in the Chromium-based Arc browser, and all the smart people in the comments were like, thank god I use Firefox.
2
Unfortunately, the turns have tabled, and now another 9.8 critical vulnerability has crashed into a second browser, this time Firefox.
3
And this time, it's been actively exploited in the wild.
4
Now, before you go in the comments and say, thank god I use Tor, it even affects everybody out there doing totally not illegal stuff on the Tor browser, which itself is Firefox-based.
5
This time, though, it wasn't a silly mistake involving a misconfigured Firebase security rule, but rather a used-after-free flaw on their implementation of the CSS animation timeline property.
6
They left a pointer dangling, which is far more difficult to detect and audit, and in this case could be used by bad guys to take full control of your browser with remote code execution.
7
If you're running one of these Firefox versions, you're probably already dead, but if not, you'll want to update immediately.
8
In today's video, you'll learn all about the interesting and terrifying world of use-after-free exploits.
9
It is October 15th, 2024, and you're watching the Code Report.
10
Before we get started, though, I have some other bad news for internet browser users, specifically those on Chrome using uBlock Origin, or any other ad blocker for that matter.
11
We all knew this day was coming, but shots were fired yesterday when this ominous message appeared on the plugin's install page, warning users that uBlock's execution date is drawing near.
12
Now, this is all part of a grand conspiracy to get you to watch ads and be happy, and Google is achieving that by updating the manifest for plugins from version 2 to version 3,
13
which eliminates the web request API where plugins can see all the incoming network requests
14
so they can block all the garbage from known ad servers.
15
I made a video on this a while ago if you want all the details, but now let's get back to Firefox.
16
Slovakian company ESET has been credited with discovering and reporting the vulnerability.
17
Where an attacker is able to achieve code execution by exploiting a use after free flaw in the CSS animation timeline.
18
I use the animation timeline all the time to create scroll animations on websites that nobody asked for, and never would have expected it to be an attack vector.
19
But to understand why this is so bad, we need to understand what use after free actually means.
20
Exploits like this have affected all the other browsers, including Chrome and Safari, and useAfterFree was even responsible for the iOS jailbreak of 2019.
21
The Firefox browser is free and open source, but you won't find it on GitHub.
22
Its code is actually self-hosted and uses Mercurial for version control.
23
It's primarily written in C++, although more and more of its code is now being written in Rust, a language that was created by a software engineer at Mozilla.
24
Firefox itself contains over 30 million lines of code, because building a browser is extremely complex.
25
At a high level, here's how a use-after-free flaw could be introduced.
26
In the C code, let's imagine we need to allocate some memory for a value.
27
To achieve that, we create a pointer and then use malloc to allocate memory for it.
28
From there we can assign a value to it and use it in our program to do something useful, like in the case of Firefox, render an animation.
29
At some later point, when we no longer need that memory, we'll want to deallocate it with free.
30
But now we have a problem called a dangling pointer.
31
The memory is free, but the pointer itself still exists and is now being used in our code with undefined behavior.
32
If an attacker can figure out how to get some malicious code into that memory, it can cause the program to crash, or even worse, remote code execution.
33
Now, this could be easily fixed by setting the pointer to null or a different object, but in the case of Firefox, the issue is likely a lot more complex and above my pay grade.
34
It's still being analyzed, so there's not a ton of detail, but Mozilla stated that they have had reports of the vulnerability being exploited in the wild.
35
The good news, though, is that it's completely fixed, and it doesn't appear anything catastrophic has happened.
36
In addition, if you're using the anonymous Tor browser, an attacker could take control of your browser, but probably not totally de-anonymize you, assuming you're on Tails OS,
37
which recently merged with the Tor browser as one project.
38
Now, another browser that was affected by all this is Zen, which is an awesome open source project based on Firefox.
39
They quickly update it to the fixed version, but it just goes to show how one little flaw can affect a lot of downstream projects.
40
But if your goal is to write robust, bulletproof code, you'll need to start with computer science fundamentals.
41
And you can start doing that today for free thanks to this video's sponsor, Brilliant.
42
Their quick, rewarding, interactive lessons will help you build a foundation for problem solving that every software engineer needs to have.
43
Brilliant is where you learn by doing, with thousands of interactive lessons in math, data analysis, programming, and AI.
44
When you make their Python course a habit with just a few minutes of effort each day, you'll quickly develop the skills needed to build world-changing software.
45
And you can do it anywhere, even from your phone.
46
To try everything Brilliant has to offer for free for 30 days, visit brilliant.org slash fireship or scan this QR code for 20% off their premium annual subscription.
47
This has been the Code Report, thanks for watching, and I will see you in the next one.
הורד אפליקציה
כל מה שאתה צריך כדי לדבר בשטף
הגיית AIציון לכל משפט
תרגול IPAשלוט בכל צליל
אוצר מיליםבנה את מאגר המילים שלך
משחק אוצר מיליםלמד תוך כדי משחק
אותו ערוץ
C11
PostgreSQL in 100 Seconds
Daily ConversationWorking Adults
C11
React Native in 100 Seconds
Daily ConversationUniversity Students
C12
Did Google just dethrone OpenAI and Anthropic?
Daily ConversationUniversity StudentsWorking Adults
C13
Every app on Earth is now open source... whether it likes it or not
Daily ConversationWorking Adults
C14
Brainf**k in 100 Seconds
Daily ConversationUniversity Students
C13
OpenAI’s lead engineer was secretly a spy...
Daily ConversationUniversity StudentsWorking Adults
C19
The most interesting "hack" in history...
American AccentBusiness EnglishUniversity StudentsWorking Adults
C12
Mind-bending new programming language for GPUs just dropped...
Daily ConversationUniversity Students
C12
China just dropped a new frontier model... and nobody can explain how
Daily ConversationUniversity StudentsWorking Adults
C12
The last real programmers are dying out...
Daily ConversationUniversity StudentsWorking Adults
C11
Did the AI bubble just pop?
Daily ConversationUniversity StudentsWorking Adults
B26
Intel chips can’t possibly be this bad… 100% crash rate?
American AccentBusiness EnglishUniversity StudentsWorking Adults
B23
OpenAI’s new browser feels familiar…
American AccentBusiness EnglishUniversity StudentsWorking Adults
C130
Docker in 100 Seconds
American AccentBusiness EnglishUniversity StudentsWorking Adults
B23
5 open source tools that replaced my $320/mo AI stack...
American AccentBusiness EnglishUniversity StudentsWorking Adults
C12
C++ in 100 Seconds
American AccentBusiness EnglishUniversity StudentsWorking Adults
B24
Linux in 100 Seconds
American AccentBusiness EnglishUniversity StudentsWorking Adults
B22
Meta is pivoting again... everything you missed from Connect 2026
American AccentBusiness EnglishUniversity StudentsWorking Adults
C116
VS Code in 100 Seconds
American AccentBusiness EnglishUniversity StudentsWorking Adults
B26
7 Programming myths that waste your time
American AccentBusiness EnglishUniversity StudentsWorking Adults
FOR YOU
המלץ על סרטון
B23
151 משפטים
How Ad Blockers Work
Business EnglishUniversity StudentsWorking Adults
B23
268 משפטים
The Shoe That Broke Running
American AccentBusiness EnglishDaily ConversationUniversity Students
B22
532 משפטים
your home router STILL SUCKS!! (use OPNsense instead)
Business EnglishUniversity StudentsWorking Adults
B24
142 משפטים
The Internet Didn't Fail. It Was Taken.
American AccentBusiness EnglishDaily ConversationUniversity Students
C13
173 משפטים
STOP Running Code On Your Computer
Daily ConversationUniversity StudentsWorking Adults
C12
169 משפטים
12 Things That Could Destroy Earth
Daily ConversationUniversity StudentsWorking Adults
B143
26 משפטים
Two Developers Before a Release: The Login Bug Is Back
American AccentBusiness EnglishDaily ConversationWorking Adults
B24
180 משפטים
Is AI Doom Real... or Just Good Marketing?
Business EnglishUniversity StudentsWorking Adults
B24
58 משפטים
Great Moments in Unintended Consequences: Obscenity Blocks, Cooking Oil, DC's Tipped Wage (Vol. 19)
Business EnglishDaily ConversationUniversity Students
B23
190 משפטים
He’s always wrong
Business EnglishDaily ConversationUniversity Students
אוצר מילים והערות הגייה לשיעור הזה
שיעור הדיבור הזה ברמה B2 מבוסס על הסרטון “Firefox and Tor hit with 9.8 critical level exploit”. המילים שחוזרות הכי הרבה: code, browser, Firefox, pointer, animation. בסרטון הזה יש 47 משפטים ו-991 מילים לתרגול Shadowing. הדיבור נמשך 4:27. הדובר מדבר מהר, כ-223 מילים בדקה, אז צפו לצלילים מחוברים ומקוצרים. רק 80% מהמילים נמצאות בין 3,000 המילים הנפוצות ביותר באנגלית, כך שאוצר המילים מאתגר.
אוצר מילים מרכזי בסרטון הזה
12 המילים המתקדמות ביותר בסרטון, עם ההגייה והמשמעות שלהן:
| מילה | הגייה | משמעות |
|---|---|---|
| animation שם עצם | /ˌæn.ɪˈmeɪ.ʃən/ | הַנְפָּשָׁה |
| merge פועל | /mɝd͡ʒ/ | מיזג, מירג׳ג׳ |
| scroll שם עצם | /skɹoʊl/ | מגילה, מְגִלָּה |
| robust שם תואר | /ɹəʊˈbʌst/ | חָסוֹן, אֵיתָן |
| vector שם עצם | /ˈvɛktɚ/ | וקטור |
| detect פועל | /dɪˈtɛkt/ | גילה, זיהה |
| subscription שם עצם | /səbˈskɹɪpʃən/ | מָנוּי |
| scan פועל | /skæn/ | סָרַק |
| install פועל | /ɪnˈstɔl/ | התקין |
| mathematics שם עצם | /mæθ(.ə)ˈmæt.ɪks/ | מָתֵמָטִיקָה |
| anonymous שם תואר | /əˈnɒn.ə.məs/ | אַלְמוֹנִי, אנונימי |
| garbage שם עצם | /ˈɡɑɹ.bɪd͡ʒ/ | זֶבֶל, אַשְׁפָּה |
Phrasal verbs שתשמעו
| מילה | משמעות |
|---|---|
| figure out פועל | הֵבִין, מצא תשובה |
דקדוק בסרטון הזה
המבנים שהדובר משתמש בהם הכי הרבה, עם המילים המדויקות מהסרטון:
| מבנה | בסרטון |
|---|---|
| הווה מושלם (Present perfect) have/has + past participle — פעולה שקרתה בעבר ועדיין יש לה חשיבות או השפעה עכשיו | have tabled · it's been · has been credited |
| סביל (Passive voice) be + past participle — הדגש הוא על מה שקורה, לא על מי שעושה את הפעולה | were fired · has been credited · being written |
| משפטי זיקה (Relative clauses) who / which + clause — מידע נוסף על אדם או דבר | dangling, which is · Zen, which is |
הגייה ששווה לשים לב אליה
הדובר משתמש ב-13 קיצורים וצורות מקוצרות, כמו you're, you'll, doesn't. אמרו אותם בצורה הקצרה, כפי שאתם שומעים אותם.
- הצלילים של “sh” ו-“zh”: animation /ˌæn.ɪˈmeɪ.ʃən/, malicious /məˈlɪʃəs/, subscription /səbˈskɹɪpʃən/
- מילים ארוכות — שימו לב להטעמה: animation /ˌæn.ɪˈmeɪ.ʃən/, vulnerability /ˌvʌln(ə)ɹəˈbɪlɪti/, interactive /ˌɪn.tɚˈæk.tɪv/, deallocate /diːˈæləkeɪt/, catastrophic /ˌkætəˈstɹɑfɪk/
צלילים שדוברי עברית מתקשים בהם:
- /æ/ — פתוח יותר מה-“אֶ” העברית, לא כמו “a” ב-“cup”: animation /ˌæn.ɪˈmeɪ.ʃən/, attacker /əˈtækɚ/, allocate /ˈæl.ə.keɪt/, dangle /ˈdæŋ.ɡəl/, interactive /ˌɪn.tɚˈæk.tɪv/
- /r/ — הלשון לא נוגעת בשום מקום, לא ה-“ר” הגרונית: browser /ˈbɹaʊ.zəɹ/, pointer /ˈpɔɪn.təɹ/, vulnerability /ˌvʌln(ə)ɹəˈbɪlɪti/, bulletproof /ˈbʊlɪtpɹuf/, jailbreak /ˈd͡ʒeɪlˌbɹeɪk/
- עיצור קולי בסוף מילה — /b/, /d/, /g/, /z/, /v/ בלי להפוך אותם לאטומים: interactive /ˌɪn.tɚˈæk.tɪv/, merge /mɝd͡ʒ/, analyze /ˈæn.əˌlaɪz/, garbage /ˈɡɑɹ.bɪd͡ʒ/
איך לתרגל עם הסרטון הזה
- הקשיבו לכל הסרטון פעם אחת בלי לדבר, ורשמו את המילים שאתם לא מכירים.
- התחילו במהירות 0.75×, תרגלו Shadowing משפט אחר משפט, וחזרו למהירות רגילה כשזה מרגיש קל.
- הקליטו את עצמכם והשוו למקור, תוך תשומת לב למילים כמו animation, merge, scroll.
מהי טכניקת השאדואינג?
שאדואינג היא טכניקת למידת שפה מבוססת מדע שפותחה במקור להכשרת מתורגמנים מקצועיים ופופולרית על ידי הפוליגלוט ד"ר אלכסנדר ארגואלס. השיטה פשוטה אך עוצמתית: אתה מקשיב לאודיו באנגלית ילידית וחוזר עליו בקול רם מיד — כמו צל העוקב אחרי הדובר עם עיכוב של 1–2 שניות בלבד. בניגוד להאזנה פסיבית או תרגילי דקדוק, שאדואינג מכריח את המוח והשרירים בפה לעבד ולשחזר דפוסי דיבור אמיתיים בו זמנית. מחקרים מראים שזה משפר משמעותית את דיוק ההגייה, האינטונציה, הקצב, הדיבור המחובר, הבנת השמיעה ושטף הדיבור — מה שהופך אותו לאחת השיטות היעילות ביותר להכנה לIELTS Speaking ולתקשורת באנגלית בעולם האמיתי.