Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Firefox vs. Chrome security

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 73 posts

Re: Ask HN: Firefox vs. Chrome security

#61

Post by mintplant »

jamiesonbecker wrote: post #58
mintplant wrote: post #51

Earlier quoted context omitted.

You are spreading FUD. > (URL's? Form data?) > this telemetry does cover usage.. i.e., this seems to include what URL's you're browsing; this could be a security risk for apps like Dropbox and OneDrive. Back these claims up with something specific and concrete, otherwise they're just wild speculation. The search bit you're quoting refers to when you, say, search for something using Amazon via the Amazon search provid…

> You are spreading FUD I was pointing out that this is a new opt-in change. The links that were posted prove it. Is that FUD? > specific and concrete In the absence of specific information, should we not assume the worst? > data collection That sounds reasonable for normal users, but any of this data can be used for fingerprinting, data mining, etc. Do you disagree? One suggestion for improvement would be that the s…

I believe the information you're asking for is already all there on the privacy policy page, broken down by feature and with links to disable each, even. It also includes a link to the full technical docs on Firefox telemetry:

https://firefox-source-docs.mozilla.org/toolkit/components/t...

The wording of the search partnership disclaimer could be made clearer. Is there anything else that you find confusing or disconcerting?

Re: Ask HN: Firefox vs. Chrome security

#62

Post by jamiesonbecker »

mintplant wrote: post #61
jamiesonbecker wrote: post #58

Earlier quoted context omitted.

> You are spreading FUD I was pointing out that this is a new opt-in change. The links that were posted prove it. Is that FUD? > specific and concrete In the absence of specific information, should we not assume the worst? > data collection That sounds reasonable for normal users, but any of this data can be used for fingerprinting, data mining, etc. Do you disagree? One suggestion for improvement would be that the s…

I believe the information you're asking for is already all there on the privacy policy page, broken down by feature and with links to disable each, even. It also includes a link to the full technical docs on Firefox telemetry: https://firefox-source-docs.mozilla.org/toolkit/components/t... The wording of the search partnership disclaimer could be made clearer. Is there anything else that you find confusing or disconc…

Thanks - this is really helpful! I appreciate this link, missed it the first time.

Re: Ask HN: Firefox vs. Chrome security

#63

Post by shmerl »

mixedCase wrote: post #52
seba_dos1 wrote: post #30

Earlier quoted context omitted.

59 AFAIK

Where did you get that info? I'm running Nightly (v59) but it's not enabled by default. Can't find anything on their roadmap either.

In the nightly you need to enable it in about:config. I.e. it ships both Webrender and Gecko engine.

Re: Ask HN: Firefox vs. Chrome security

#64

Post by mintplant »

robbyking wrote: post #45

I actually noticed some weird and potentially concerning behavior with Firefox Quantum this morning. I had a fair number of tabs open (~28 or so), and I restarted the browser so a change I made would take effect. I have FF set to show my windows and tabs from my previous session on start up, but it instead launched with a single tab showing my home page. Okay, no big deal, I'll just restore my previous session from t…

That really does sound like a sync/profile issue, especially as it coincided with a failure to restore your previous session. I suspect you encountered some sort of corruption in your profile, and Firefox automatically restored one of the multiple backup copies it keeps to attempt to mitigate data loss. Still, always good to take precautions.

What Firefox release channel(s) are you using? Are you running the same version across all of your sync'd devices? And can you share what change you made before restarting the browser?

Re: Ask HN: Firefox vs. Chrome security

#65

Post by rammy1234 »

gsnedders wrote: post #19
rammy1234 wrote: post #12

Earlier quoted context omitted.

Rust helps in to avoid segFaults which helps in avoid buffer overflows and stack overflows. most of security attacks are due to these and can prevent them better. there is no way a developer can write a code in Rust that causes segfaults ( atleast language promises that ). recent blog post https://blog.rust-lang.org/2017/11/14/Fearless-Concurrency-I...

> there is no way a developer can write a code in Rust that causes segfaults ( atleast language promises that ). Well, you can very easily: write bad code in unsafe blocks. That said, your badness is contained within unsafe blocks, so hopefully you have much less code to closely review.

right, it is well known to the developers what to look for when we see something wrong. it doesnt crash randomly, it cries out loud when it fails so we know what is happening and manage it better.

Re: Ask HN: Firefox vs. Chrome security

#67

Post by dveditz_ »

gcp wrote: post #32
AdmiralAsshat wrote: post #6

Firefox has been a low-priority target for a couple years due to its waning user-base. In fact, Firefox wasn't even at Pwn2Own 2016 because hackers didn't think it was worth their time[0]. Hopefully with Quantum and a resurge in popularity, it'll become a target of white-hat hackers again. [0] http://www.eweek.com/security/pwn2own-hacking-contest-return...

Coincidentally it not being worth their time coincided with Mozilla not sponsoring the contest any more. You can make of that what you will.

Mozilla has never sponsored the Pwn2Own contest.

Re: Ask HN: Firefox vs. Chrome security

#68

Post by hobarrera »

_hyn3 wrote: post #29

Google has (always) gathered information about Chrome -- and Chromium -- users by default , including every keystroke typed into the "omnibox". Not easy to disable, either. This seems to be a recent Firefox policy change: all editions of Firefox is now collecting data, such as telemetry, information gathering, usage data. (URL's? Form data?) This is all opt-out instead of opt-in now, and you're asked only after insta…

> you're asked only after installation. You have to pro-actively disable it.

Of course it's done after installation -- how would an app allow you to configure something BEFORE it's installed?

Re: Ask HN: Firefox vs. Chrome security

#69

Post by geeknik »

mixedCase wrote: post #52
seba_dos1 wrote: post #30

Earlier quoted context omitted.

59 AFAIK

Where did you get that info? I'm running Nightly (v59) but it's not enabled by default. Can't find anything on their roadmap either.

For the adventurous:

1) open about:config 2) set gfx.webrender.enabled to true 3) restart Nightly

For the even more adventurous:

1) open about:config 2) set gfx.webrender.enabled to true 3) set gfx.webrendest.enabled to true 4) restart Nightly

Re: Ask HN: Firefox vs. Chrome security

#70

Post by jovial_galileo »

greenhouse_gas wrote: post #28
bkor wrote: post #9

Earlier quoted context omitted.

They're slowing replacing more and more code with Rust. So eventually Rust will have a much bigger impact.

I remember that quite a few were JS exploits (which is why noscript is so popular), and there's no plan to rewrite the JS JIT to rust (not that it would help much anyways)

They want to rewrite everything in Rust, including the JS JIT https://blog.mozilla.org/javascript/2017/10/20/holyjit-a-new...
Post reply on HN