Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Site Isolation in Firefox

blog.mozilla.org

Post reply on HN
Print view View original

41–50 of 118 posts

Re: Site Isolation in Firefox

#41

Post by chimeracoder »

ksml wrote: post #37

This is really interesting. Prior to this, Firefox's isolation model was much weaker than Chrome's due to only having a pool of 8 content processes. If I'm reading the technical blog correctly [1], this will move to a process-per-site model without also doing process-per-tab as Chrome does, i.e. if you have several tabs open on the same site, they'd be in the same process. This seems much less resource intensive than…

> process-per-tab as Chrome does

This is a common misconception. Chrome doesn't technically do process-per-tab.

Chrome's model can most succinctly be described as process-per-domain, although even then, there are rare instances where two tabs opened on different domains will actually share the same process.

Re: Site Isolation in Firefox

#42

Post by tristan957 »

oblio wrote: post #40
tristan957 wrote: post #25

Earlier quoted context omitted.

This is factually untrue. Site isolation wasn't enabled by default in Chromium until v67 in 2018. https://www.chromium.org/Home/chromium-security/site-isolati...

https://www.google.com/googlebooks/chrome/big_04.html http://www.scottmccloud.com/googlechrome/ In early-mid 2008, I created a comic book for Google explaining the inner workings of their new open source browser Google Chrome. If I'm mixing this up with https://wiki.mozilla.org/Electrolysis , that's still 10 years.

Chrome was a new project, and didn't have to deal with the legacy of being built on top of the same source code as Netscape Navigator. I do not understand why you are trying to make this out to bash Firefox like they aren't as competent by taking ~10 years to implement multi-process browsing after Chrome. Legacy software and patterns are truly painstaking processes to iterate on.

But yes Electrolysis is the initiative that you should have referred to in the original comment.

Re: Site Isolation in Firefox

#43

Post by db48x »

jedberg wrote: post #27

Has anyone tried this along with Container Tabs? Do they play nicely? Does it offer any advantage over Container Tabs?

Container Tabs are completely orthogonal. A site loaded in a tab which is contained in this way cannot access your global cookie jar, for example. If you visit a site with a Facebook Like button on it, then Facebook will not receive the same cookie from you that it would have received if you had loaded the site in a non–contained tab. This is true whether or not the site has been given it’s own process to live in. The converse is also still true; non–contained sites still have access to your global cookie jar even if they’re isolated in their own process.

Putting sites in their own process mitigates against Spectre–like attacks, but it doesn’t do anything for higher–level problems like third–party cookies.

Re: Site Isolation in Firefox

#44

Post by arkitaip »

gostsamo wrote: post #16
annyg wrote: post #3

Earlier quoted context omitted.

hi, co-author of the blog post here. There is a more detailed blog post explaining how Site Isolation is better than the Electrolysis architecture here - https://hacks.mozilla.org/2021/05/introducing-firefox-new-si... (also linked to from the security blog post). Hope this is helpful!

Hi, I'm a blind user and I'm just dropping to say a big thank you for the excellent alt text to the diagrams in the hacks post. Thanks for the browser work as well!

Thank YOU for writing comments like these - it encourages us web devs to work harder on accessibility.

Re: Site Isolation in Firefox

#45

Post by [deleted] »

gostsamo wrote: post #16
annyg wrote: post #3

Earlier quoted context omitted.

hi, co-author of the blog post here. There is a more detailed blog post explaining how Site Isolation is better than the Electrolysis architecture here - https://hacks.mozilla.org/2021/05/introducing-firefox-new-si... (also linked to from the security blog post). Hope this is helpful!

Hi, I'm a blind user and I'm just dropping to say a big thank you for the excellent alt text to the diagrams in the hacks post. Thanks for the browser work as well!

[deleted]

Re: Site Isolation in Firefox

#46

Post by fragileone »

rcMgD2BwE72F wrote: post #30
jedberg wrote: post #27

Has anyone tried this along with Container Tabs? Do they play nicely? Does it offer any advantage over Container Tabs?

Any idea? I'd love to drop https://addons.mozilla.org/en-US/firefox/addon/temporary-con... , which automatically assigns a temporary container to any new tab, which plays nicely with the https://addons.mozilla.org/en-US/firefox/addon/multi-account... but uses too much memory (at least from my experience).

Enable Strict Enhanced Tracking Protection setting, this turns on Dynamic First Party Isolation which is the native version of what Temporary Containers is aiming to do.

Re: Site Isolation in Firefox

#47

Post by Dylan16807 »

JonathonW wrote: post #14
yakubin wrote: post #6

This provides more technical details: https://hacks.mozilla.org/2021/05/introducing-firefox-new-si... >, which should be more interesting to HN than a marketing announcement. In particular, it seems that "site" isn't precisely defined. It seems to be based on domains, but backed by a human-curated list of "sites": https://github.com/publicsuffix/list >. So it's different than Chrome's "every webpage gets a separate p…

Chrome's policy is pretty much the same; while it can generate a process-per-tab under most conditions, the guarantee it actually makes (in modern versions of Chrome) is that sites (including different-origin iframes) are isolated into different processes. They use the PSL to determine which sites constitute a different origin, just like Firefox does.

I don't know if "most conditions" is even true. Even when it's only running a handful of processes and I have plenty of ram free I cannot convince it to use more than one process for twitch tabs.

Re: Site Isolation in Firefox

#48

Post by oblio »

tristan957 wrote: post #42
oblio wrote: post #40

Earlier quoted context omitted.

https://www.google.com/googlebooks/chrome/big_04.html http://www.scottmccloud.com/googlechrome/ In early-mid 2008, I created a comic book for Google explaining the inner workings of their new open source browser Google Chrome. If I'm mixing this up with https://wiki.mozilla.org/Electrolysis , that's still 10 years.

Chrome was a new project, and didn't have to deal with the legacy of being built on top of the same source code as Netscape Navigator. I do not understand why you are trying to make this out to bash Firefox like they aren't as competent by taking ~10 years to implement multi-process browsing after Chrome. Legacy software and patterns are truly painstaking processes to iterate on. But yes Electrolysis is the initiativ…

> Software is hard. Chrome had this in 2008. Firefox had to be rearchitected 14 years for this.

How is this bashing? :-)

It literally starts with "Software is hard."

...

Re: Site Isolation in Firefox

#49

Post by staticassertion »

oblio wrote: post #40
tristan957 wrote: post #25

Earlier quoted context omitted.

This is factually untrue. Site isolation wasn't enabled by default in Chromium until v67 in 2018. https://www.chromium.org/Home/chromium-security/site-isolati...

https://www.google.com/googlebooks/chrome/big_04.html http://www.scottmccloud.com/googlechrome/ In early-mid 2008, I created a comic book for Google explaining the inner workings of their new open source browser Google Chrome. If I'm mixing this up with https://wiki.mozilla.org/Electrolysis , that's still 10 years.

Chrome didn't have this until 2018, as the parent link shows. This is not about multi-process architecture. Firefox is < 3 years behind, not 10, not 14.

Re: Site Isolation in Firefox

#50

Post by staticassertion »

chimeracoder wrote: post #41
ksml wrote: post #37

This is really interesting. Prior to this, Firefox's isolation model was much weaker than Chrome's due to only having a pool of 8 content processes. If I'm reading the technical blog correctly [1], this will move to a process-per-site model without also doing process-per-tab as Chrome does, i.e. if you have several tabs open on the same site, they'd be in the same process. This seems much less resource intensive than…

> process-per-tab as Chrome does This is a common misconception. Chrome doesn't technically do process-per-tab. Chrome's model can most succinctly be described as process-per-domain, although even then, there are rare instances where two tabs opened on different domains will actually share the same process.

It's "scheme + eTLD + 1", with a flag to set it to per origin.
Post reply on HN