Hacker News new | past | comments | ask | show | jobs | submit login

One disturbing thing about Mozilla security is that most of the "Critical" flaws[1] in their list would be marked as "High" on Chrome because of Chrome's superior security model.

[1]https://www.mozilla.org/security/known-vulnerabilities/firef...




That is very unfortunate, but there is ongoing work on making Firefox multiprocess and sandboxed.

https://wiki.mozilla.org/Electrolysis

https://wiki.mozilla.org/Security/Sandbox


I think you put too much faith in the fables that surround what the chrome security model does and does not do.

In short, no, they wouldn't.


Really? Care to give an example?


I don't really want to have to go into process security from scratch, but I have previously commented on this https://news.ycombinator.com/item?id=6811368

"Sandboxing" and "process separation" are not magic smoke.


Oh sure, they are not magic smoke indeed. Still, how do you explain that Use after free bugs are marked Critical in Firefox but High on Chrome? Seems like Chrome is doing a little bit better in security department.

https://www.mozilla.org/security/known-vulnerabilities/firef...

http://googlechromereleases.blogspot.ch/search/label/Stable%...


Because they have different classification systems/schemes?

Are you really asking me this?


Security flaws browser vendors use do not have different classification schemes. They all use CVSS Severity scores, go ahead and check.

Also definitions:

Firefox Critical: Vulnerability can be used to run attacker code and install software, requiring no user interaction beyond normal browsing. High: Vulnerability can be used to gather sensitive data from sites in other windows or inject data or code into those sites, requiring no more than normal browsing actions

Chrome Critical:Allows an attacker run arbitrary code with the user's privileges in the normal course of browsing. High: Allows an attacker to read or modify confidential data belonging to other web sites.




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: