Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome Is Bad

chromeisbad.com

Post reply on HN
Print view View original

51–60 of 306 posts

Re: Chrome Is Bad

#51

Post by f1refly »

sneak wrote: post #10

Chrome's security is, however, light years ahead of anyone else's; it remains the sole reason I still use it. It's possible to use Little Snitch to deny Keystone/ksupdate all network access, which is what I do, which removes the Google RCE vulnerability it places on your machine. Make sure to periodically manually update Chrome, however.

> chrome's security is, however, light years ahead of anyone else's

give evidence to support your claim. I've been using Firefox for the past 10 years and I fail to see how it's insecure. I do see however, how it's not nearly as user-hostile as chrome.

Re: Chrome Is Bad

#52

Post by terracatta »

vlovich123 wrote: post #45
colordrops wrote: post #9

Found an old thread involving the Google Keystone tech lead: https://news.ycombinator.com/item?id=21065504

This is why dates on articles is so important. I can’t tell if this website is newer or older than that response so I can’t tell if this is a problem today or was a problem that was resolved

The only clue this domain might be newer is he mentions the 16inch MacBook Pro which first came out in 2019.

Re: Chrome Is Bad

#53

Post by izacus »

edgefield0 wrote: post #43
sroussey wrote: post #40

Earlier quoted context omitted.

Possible correlation and hand waving equals causation. I, too, was hoping for something, well, technical. Considering #1 on hacker news...

Does anyone else see the irony that hand waving is being disputed with hand waving?

No, there's a concept of "burden of proof" which applies here.

Re: Chrome Is Bad

#54

Post by comex »

vesche wrote: post #29

The author went so far as to create a domain for this rant, and yet didn't even do any performance metrics or basic forensic analysis at all. I'm not saying the author is wrong, but there's a lot of questions here. How does Keystone hide itself from the Activity Monitor? Is there a Keystone process if you run `ps aux`? Did you run dtruss/strace? What is it doing when Chrome isn't running that causes it to degrade per…

Another thing you can do: profile the process to find out what exactly it’s spending all that CPU time on. There are a few different ways to do this on macOS, including the GUI Instruments.app which comes with Xcode, and dtrace. But if you’re the sort who always has a terminal open, the quickest way is to just run

    sudo spindump
Also useful when a process is hung, even if it’s not taking up CPU time.

Sometimes the output isn’t useful due to a binary having been stripped of symbol names, but all macOS system libraries have symbols, so you can usually figure out something.

Re: Chrome Is Bad

#55

Post by bfgoodrich »

comex wrote: post #14

This is total nonsense. Even for malware, hiding from Activity Monitor would be quite a feat. Short of an exploit, you couldn't hide your process without a kernel rootkit, but macOS has required user approval to load kernel extensions for several versions now. I suppose you could go the low-tech way and just name your process "WindowServer" to confuse the user, but you'd still end up with two WindowServers. The idea…

Chrome does have the capacity for screen sharing (e.g. Chrome Remote Desktop), but I assume it wouldn't inject any extensions into the window server unless it was actively invoked.

Re: Chrome Is Bad

#56

Post by masswerk »

comex wrote: post #14

This is total nonsense. Even for malware, hiding from Activity Monitor would be quite a feat. Short of an exploit, you couldn't hide your process without a kernel rootkit, but macOS has required user approval to load kernel extensions for several versions now. I suppose you could go the low-tech way and just name your process "WindowServer" to confuse the user, but you'd still end up with two WindowServers. The idea…

I remember quite well the Google update process being notorious for evading Little Snitch firewall rules. It popped up every intervall as if it were a new (unseen) process. There's definitely something going on with the app signature. (Haven't used Chrome for some time by now.)

Re: Chrome Is Bad

#57

Post by jsmith99 »

HelloThur wrote: post #42
aflag wrote: post #30

Earlier quoted context omitted.

What evidence do you have to back up that claim?

In the security industry it's commonly known Chrome has the best security, this partly due to the amount of money Google invests in finding vulnerabilities (via fuzzing) in Chrome. For "proof", you can check how much exploit vendors pay for exploits for each browser. For example Zerodium offer: * $500k for Chrome RCE * $100k for Safari RCE * $100k for Firefox RCE https://zerodium.com/program.html The higher amount wo…

Or perhaps that Chrome exploits are more useful?

In fact, given Firefox's tiny market share (despite my efforts) I'm surprised the disparity isn't higher. Maybe it's harder to find Firefox exploits?

It's more likely that more popular browsers equally have more people attempting to crack them; and software in general is so buggy that results probably scale in proportion to the number of people looking.

Re: Chrome Is Bad

#58

Post by jonsully »

vlovich123 wrote: post #45
colordrops wrote: post #9

Found an old thread involving the Google Keystone tech lead: https://news.ycombinator.com/item?id=21065504

This is why dates on articles is so important. I can’t tell if this website is newer or older than that response so I can’t tell if this is a problem today or was a problem that was resolved

Appears website is newer - https://twitter.com/lorenb/status/1337832978253230081

Re: Chrome Is Bad

#59

Post by terramex »

LeoPanthera wrote: post #32
Exuma wrote: post #2

It sucks because Chrome is so much better usability wise than all those others. I wish they would just fix whatever this keystone trash is, and leave that to stonehenge

What does Chrome do better than Safari?

For me - it works properly on spotty connections. I have fast, but unreliable internet that drops connection few times an hour and Safari and Firefox are almost unusable - when connection drops for just a few seconds they cannot open many websites for up to 5 minutes (reddit, google and youtube among many others; hacker news is one of the few that work all the time).

Chromium based browsers do not have that issue, I used to use Vivaldi but temporarily switched to Safari as I wait for ARM build of Vivaldi and I am constantly frustrated by that issue.

I have tried debugging it but got nowhere, it seems to be system wide issue as some 3rd party apps exhibit this behaviour too (for example live streaming through IINA or Skype) while others not (Electron based apps usually work fine). Recently switched to new M1 Macbook and it happens on it too.

Re: Chrome Is Bad

#60

Post by codetrotter »

comex wrote: post #54
vesche wrote: post #29

The author went so far as to create a domain for this rant, and yet didn't even do any performance metrics or basic forensic analysis at all. I'm not saying the author is wrong, but there's a lot of questions here. How does Keystone hide itself from the Activity Monitor? Is there a Keystone process if you run `ps aux`? Did you run dtruss/strace? What is it doing when Chrome isn't running that causes it to degrade per…

Another thing you can do: profile the process to find out what exactly it’s spending all that CPU time on. There are a few different ways to do this on macOS, including the GUI Instruments.app which comes with Xcode, and dtrace. But if you’re the sort who always has a terminal open, the quickest way is to just run sudo spindump Also useful when a process is hung, even if it’s not taking up CPU time. Sometimes the out…

Speaking of the GUI Instruments.app. Is there a way to start a process from there, instead of attaching to an already running process? I used it the other day and could only figure out how to attach to an already running process with it.
Post reply on HN