Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Next Browser native on Linux

news.ycombinator.com

Post reply on HN
Print view View original

91–100 of 117 posts

Re: Show HN: Next Browser native on Linux

#91

Post by saagarjha »

insertcredit wrote: post #89

I saw your post at lisp.reddit.com today and there was a redditor there that brought forth webkit security concerns that IMV you did not properly address. Thread is here ( https://old.reddit.com/r/lisp/comments/a3b8m0/browsing_with_... ) I am an ex-Googler and I happen to know the effort that the Google security team expended when designing the Chrome security model was quite significant. We would all like more compe…

Wow, that thread is horrible. It's just flamebait from both sides. From metroholografix:

> I fear that webkit can not be salvaged

> How about all the huge OSX vulnerabilities that have been discovered?

> You are so out of touch with the state of cybersecurity that it's terrifying. Not only that, but you insist on this nonsensical adversarial attitude towards me when I'm spending my personal time trying to inform you.

> WebKit, which is abysmally bad security-wise to begin with

From the other side:

> If I didn't know any better I would say you were a paid blink shill

> Safari, which runs webkit is safer than Chromium. Because at least we know that Apple cares about security.

In all, I disagree with u/metroholografix's claims that Chrome is inherently significantly more secure than Safari. Sure, it might be if you are comparing yourself with running WebKit in-process and with no sandbox. But with the appropriate protections which macOS provides (which is where I fault u/jmercouris, because he cannot compare his project with Safari because his project doesn't actually implement these security features), it is stupid to move a project to Blink in this case.

Re: Show HN: Next Browser native on Linux

#92

Post by metroholografix »

saagarjha wrote: post #91
insertcredit wrote: post #89

I saw your post at lisp.reddit.com today and there was a redditor there that brought forth webkit security concerns that IMV you did not properly address. Thread is here ( https://old.reddit.com/r/lisp/comments/a3b8m0/browsing_with_... ) I am an ex-Googler and I happen to know the effort that the Google security team expended when designing the Chrome security model was quite significant. We would all like more compe…

Wow, that thread is horrible. It's just flamebait from both sides. From metroholografix: > I fear that webkit can not be salvaged > How about all the huge OSX vulnerabilities that have been discovered? > You are so out of touch with the state of cybersecurity that it's terrifying. Not only that, but you insist on this nonsensical adversarial attitude towards me when I'm spending my personal time trying to inform you.…

Hey there.

Can you point at something in my reddit posts that is inaccurate or plain wrong? I agree that my tone could be better but notice the difference between my first post to him and my subsequent replies. It's hard to maintain a civil attitude when I am immediately accused of being a shill. Nevertheless, I think I have provided enough useful information to him. Notice how he responds each time.

You wrote that you disagree with me regarding Chrome being inherently more secure than Safari. Fair enough. Do you have any additional information that makes you think so? I pointed to PWN2OWN when I made my point. I think it easily proves that Chrome is indeed inherently more secure than Safari. That does not mean that he has to move to Chromium, it was one suggestion. He could stick with WebKit and implement a sandbox of his own. Or choose not to do that but let users know, loud and clear, that this is the case so everyone understands the trade-offs involved.

To me, based on my interactions with him on reddit, it seems that jmercouris needs to revisit a lot of his beliefs and rapidly bring himself up-to-speed with the current state of browser security.

Re: Show HN: Next Browser native on Linux

#93

Post by dtornabene »

Ambrevar wrote: post #35
dtornabene wrote: post #26

Hi there, bit of a lisp fanatic so excited to see this. Just some questions: I'm not very knowledgeable about browser architecture, and my search foo is failing at a first try, could you provide a couple of links on what you mean by "controller"? My second question is probably dependent on the first, but: are you worried that using xml-rpc is going to be a bottleneck? last question: I'm a little worried about the not…

Those are all good questions! - "Controller" is just for the sake if this article, to distinguish the part that this project (or any other power-user browser for that matter) is about. It's everything that it not the GUI or the renderer. - XML-RPC: we were asking ourselves the same question, and the answer could only come out of real-world use. The happy result: no, it's not gonna be a bottlenext, it's very smooth! I…

thank you for taking the time to reply, all of this makes sense.

Re: Show HN: Next Browser native on Linux

#94

Post by dtornabene »

jmercouris wrote: post #33
dtornabene wrote: post #26

Hi there, bit of a lisp fanatic so excited to see this. Just some questions: I'm not very knowledgeable about browser architecture, and my search foo is failing at a first try, could you provide a couple of links on what you mean by "controller"? My second question is probably dependent on the first, but: are you worried that using xml-rpc is going to be a bottleneck? last question: I'm a little worried about the not…

controller? in which context? xml-rpc will not be a bottle neck. There are very few commands being passed back and forth between the Lisp core and the platform port. Basically only on keypresses, or if the Lisp core itself initiates it. With regard to changing root, I have no idea what it means myself either, as I am not a Linux user, but from what I understand, it is necessary to get any Guix pack to work, I don't t…

thank you for taking the time to reply, much appreciated

Re: Show HN: Next Browser native on Linux

#96

Post by saagarjha »

metroholografix wrote: post #92
saagarjha wrote: post #91

Earlier quoted context omitted.

Wow, that thread is horrible. It's just flamebait from both sides. From metroholografix: > I fear that webkit can not be salvaged > How about all the huge OSX vulnerabilities that have been discovered? > You are so out of touch with the state of cybersecurity that it's terrifying. Not only that, but you insist on this nonsensical adversarial attitude towards me when I'm spending my personal time trying to inform you.…

Hey there. Can you point at something in my reddit posts that is inaccurate or plain wrong? I agree that my tone could be better but notice the difference between my first post to him and my subsequent replies. It's hard to maintain a civil attitude when I am immediately accused of being a shill. Nevertheless, I think I have provided enough useful information to him. Notice how he responds each time. You wrote that y…

Hey.

The crux of the argument I'm making is that both Chrome and Safari are quite secure. Maybe Chrome is slightly more, maybe it's not, but it's disingenuous to present WebKit as completely broken and Blink as the only engine with good security engineers.

> He could stick with WebKit and implement a sandbox of his own.

I think this would be the best solution. Running WebKit without a sandbox is stupid, but I think your responses did not help jmercouris take your comments seriously because, to be honest, you do kind of look like a Blink shill.

Re: Show HN: Next Browser native on Linux

#97

Post by metroholografix »

saagarjha wrote: post #96
metroholografix wrote: post #92

Earlier quoted context omitted.

Hey there. Can you point at something in my reddit posts that is inaccurate or plain wrong? I agree that my tone could be better but notice the difference between my first post to him and my subsequent replies. It's hard to maintain a civil attitude when I am immediately accused of being a shill. Nevertheless, I think I have provided enough useful information to him. Notice how he responds each time. You wrote that y…

Hey. The crux of the argument I'm making is that both Chrome and Safari are quite secure. Maybe Chrome is slightly more, maybe it's not, but it's disingenuous to present WebKit as completely broken and Blink as the only engine with good security engineers. > He could stick with WebKit and implement a sandbox of his own. I think this would be the best solution. Running WebKit without a sandbox is stupid, but I think y…

Here is some more data regarding Chrome vs Safari, from https://www.zerodium.com/program.html

These are prices for 0-day exploits.

For desktops :

$250,000 - Chrome RCE + SBX (Windows) including a sandbox escape

$80,000 - Safari + SBX including a sandbox escape (it is on the graphical table below the changelog)

$100,000 - Chrome RCE without a sandbox escape

$50,000 - Edge, Safari, Firefox RCE without a sandbox escape

To me, these prices clearly indicate that Safari is a lot easier to exploit than Chrome. They also indicate that the Chrome sandbox is a lot harder to bypass (look at the relative price differences).

For mobile the payouts are similar which indicates that Apple has paid more attention to IOS security-wise. That is also the consensus amongst most security experts I know.

Re: Show HN: Next Browser native on Linux

#98

Post by saagarjha »

metroholografix wrote: post #97
saagarjha wrote: post #96

Earlier quoted context omitted.

Hey. The crux of the argument I'm making is that both Chrome and Safari are quite secure. Maybe Chrome is slightly more, maybe it's not, but it's disingenuous to present WebKit as completely broken and Blink as the only engine with good security engineers. > He could stick with WebKit and implement a sandbox of his own. I think this would be the best solution. Running WebKit without a sandbox is stupid, but I think y…

Here is some more data regarding Chrome vs Safari, from https://www.zerodium.com/program.html These are prices for 0-day exploits. For desktops : $250,000 - Chrome RCE + SBX (Windows) including a sandbox escape $80,000 - Safari + SBX including a sandbox escape (it is on the graphical table below the changelog) $100,000 - Chrome RCE without a sandbox escape $50,000 - Edge, Safari, Firefox RCE without a sandbox escape…

My guess is that the payout is partially a function of popularity, which is why the Windows exploits have higher bounties.

Re: Show HN: Next Browser native on Linux

#99

Post by _2d30 »

saagarjha wrote: post #98
metroholografix wrote: post #97

Earlier quoted context omitted.

Here is some more data regarding Chrome vs Safari, from https://www.zerodium.com/program.html These are prices for 0-day exploits. For desktops : $250,000 - Chrome RCE + SBX (Windows) including a sandbox escape $80,000 - Safari + SBX including a sandbox escape (it is on the graphical table below the changelog) $100,000 - Chrome RCE without a sandbox escape $50,000 - Edge, Safari, Firefox RCE without a sandbox escape…

My guess is that the payout is partially a function of popularity, which is why the Windows exploits have higher bounties.

Exactly. His argument would make sense if there were ONLY supply side differences but there are clearly HUGE demand side differences with Chrome making up a large majority of internet traffic.
Post reply on HN