21–30 of 73 posts
Firefox offers similar sandboxing; see https://wiki.mozilla.org/Security/Sandbox
Firefox's JavaScript engine also implements more in-depth protections than V8, such as W^X in the JIT and compartments+wrappers to provide revokable access control and separation between code from different origins. There's a lot more to security than ensuring code execution can't break out of the browser.
From what I've seen, FF57 only uses one content process by default (at least when you upgrade it from FF56), although you can enable up to 7 in settings ( I wish they gave higher numbers, too, like 50, or have a custom field).
Also, Rust is still a small portion of the browser. I'm not sure how big of a portion is of the rendering parts, which are usually the ones causing security issues.
We'll see how it fares at the next Pwn2Own and perhaps in new papers comparing browsers' security over the coming year.
That said, I am excited that Tor will soon use FF59, which should include all of these improvements (but hopefully customized to have improved hardening by default compared to regular Firefox, on all operating systems).
Firefox has been a low-priority target for a couple years due to its waning user-base. In fact, Firefox wasn't even at Pwn2Own 2016 because hackers didn't think it was worth their time[0]. Hopefully with Quantum and a resurge in popularity, it'll become a target of white-hat hackers again. [0] http://www.eweek.com/security/pwn2own-hacking-contest-return...
Are there historical records for number of "critical" vulnerabilities found in browsers? It would be interesting to compare the number for different browsers. Update Maybe this: http://www.cvedetails.com/product/15031/Google-Chrome.html?v... http://www.cvedetails.com/product/9900/Microsoft-Internet-Ex...
Until proven otherwise, I think Chrome remains the most secure browser. From what I've seen, FF57 only uses one content process by default (at least when you upgrade it from FF56), although you can enable up to 7 in settings ( I wish they gave higher numbers, too, like 50, or have a custom field). Also, Rust is still a small portion of the browser. I'm not sure how big of a portion is of the rendering parts, which ar…
More content processes wouldn't do much difference. It doesn't reduce the attack surface (potentially increasing it due to complexity), but only reduce amount of data per process in case you gain read-only access to its memory (which I can't currently think of as being an interesting attack).
I would imagine that more content processes is about stability, rather than security. However, splitting larger processes into smaller ones can yield great benefit on the security front.
EDIT: FF57 defaults to four content processes.
Firefox has been a low-priority target for a couple years due to its waning user-base. In fact, Firefox wasn't even at Pwn2Own 2016 because hackers didn't think it was worth their time[0]. Hopefully with Quantum and a resurge in popularity, it'll become a target of white-hat hackers again. [0] http://www.eweek.com/security/pwn2own-hacking-contest-return...
Are there historical records for number of "critical" vulnerabilities found in browsers? It would be interesting to compare the number for different browsers. Update Maybe this: http://www.cvedetails.com/product/15031/Google-Chrome.html?v... http://www.cvedetails.com/product/9900/Microsoft-Internet-Ex...
Firefox has been a low-priority target for a couple years due to its waning user-base. In fact, Firefox wasn't even at Pwn2Own 2016 because hackers didn't think it was worth their time[0]. Hopefully with Quantum and a resurge in popularity, it'll become a target of white-hat hackers again. [0] http://www.eweek.com/security/pwn2own-hacking-contest-return...
From Peter Bright at Ars: "And security remains a pressing concern, prompting the use of new techniques to protect against exploitation. Some of the rebuilt portions are even using Mozilla's new Rust programming language, which is designed to offer improved security compared to C++. While today's release represents a major step forward in the browser's performance and reliability, work on Quantum continues. One major…
So what version will get Webrender exactly?
Earlier quoted context omitted.
But how many of them come from the rendering engine?
They're slowing replacing more and more code with Rust. So eventually Rust will have a much bigger impact.
This seems to be a recent Firefox policy change: all editions of Firefox is now collecting data, such as telemetry, information gathering, usage data. (URL's? Form data?) This is all opt-out instead of opt-in now, and you're asked only after installation. You have to pro-actively disable it.
(Formerly, telemetry gathering was only gathered by default on nightlies and dev tracks; this telemetry does cover usage.. i.e., this seems to include what URL's you're browsing; this could be a security risk for apps like Dropbox and OneDrive.)
To be fair, it's easier to opt-out in Firefox than it is in Chrome, and Firefox is also more up-front about it after initial setup/installation; still, given that Firefox held itself out as the privacy-oriented browser, this is a significant change.
(Which leads to a new question.. what's the new best privacy browser? probably Brave? or, perhaps, Opera?)
EDIT: citation, thanks to cJ0th:
From Peter Bright at Ars: "And security remains a pressing concern, prompting the use of new techniques to protect against exploitation. Some of the rebuilt portions are even using Mozilla's new Rust programming language, which is designed to offer improved security compared to C++. While today's release represents a major step forward in the browser's performance and reliability, work on Quantum continues. One major…
> Early next year should also see the rollout of a new GPU-accelerated rendering engine So what version will get Webrender exactly?