Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Site Isolation in Firefox

blog.mozilla.org

Post reply on HN
Print view View original

101–110 of 118 posts

Re: Site Isolation in Firefox

#101

Post by xuhu »

medstrom wrote: post #100
ComodoHacker wrote: post #96

Earlier quoted context omitted.

Sadly, process-per-site also means memory usage will skyrocket, which linked post doesn't mention. It's ridiculous to think that a budget laptop with 4 GB of RAM suddenly isn't enough to browse the Web comfortably. All thanks to Meltdown and Spectre.

If browsers are careful not to use CPU and mem, web developers will just bloat their sites even more because there is room for it. Let browsers bloat, it will slow down website bloat.

Let's steal everything we can grab, it will slow others from stealing.

Let's buy all the toilet paper, it will slow others from buying toilet paper.

Re: Site Isolation in Firefox

#102

Post by mastazi »

tialaramex wrote: post #75
mastazi wrote: post #69

Earlier quoted context omitted.

The public suffix list is also used by other browsers to determine whether resources are cross origin (see below), not just by Firefox. So, I think it's a pretty authoritative list, and also consider that domains are added by formal request of the domain holder, not as a result of someone's curation. That list is the reason why CORS behaves differently e.g. across two subdomains like [subdomain].herokuapp.com (reques…

One of the maintainers of the PSL (Ryan Sleevi) has written on HN before that they'd sure like it if people leant on the PSL less rather than more. It's a nasty hack, the successor to even worse proprietary hacks but still something we ought to strive to get rid of. I can see exactly why it was the choice here, and I don't blame Mozilla for choosing it, but we're not going to make things better if nobody gets out and…

How do you propose getting rid of the PSL? I don't see alternatives to having an authoritative publicly available list, unless we change the current standards somehow?

> I sure would like it if Mozilla shipped a way for extensions to just consult Firefox's built-in copy of the PSL

the PSL is available at https://publicsuffix.org/list/public_suffix_list.dat - as noted elsewhere in this tread it is also used by other browsers. I guess the one built into Firefox is just downloaded from there and cached? If so why would you want that over the other?

Re: Site Isolation in Firefox

#103

Post by oblio »

pcwalton wrote: post #94
oblio wrote: post #53

Earlier quoted context omitted.

I was wrong about the actual security policy, but multi-process is still a big security win. And not so related to this, but from what I've heard about cracking competitions a few while ago, Firefox was not even included, it was considered too easy. Maybe my sources were just bad. And I say this as a Firefox user for the last decade or more.

That was before Firefox desktop had any multiprocess support at all.

Yeah, so until just 3 years ago.

Re: Site Isolation in Firefox

#104

Post by yakubin »

takluyver wrote: post #97
staticassertion wrote: post #78

Earlier quoted context omitted.

What's wrong with the web and browsers? It's honestly pretty incredible - we have a system where we can load and execute arbitrary code from any number of third parties near-instantly and it actually works and isn't a complete security disaster. Seems pretty cool tbh

People object to the massive effort it takes to create or maintain a browser engine which can practically browse the modern web. We're down to 3 players now actually trying to do this (Mozilla, Google, Apple). It conflicts with the idea that you can fork software if you dislike what it's doing, because even starting from existing code, it would be a lot of work to keep up with changes so you don't get left behind. So…

There are many distinct PDF readers. Making a document browser shouldn't be more complicated than making a PDF reader. PDF readers is how it works in practice.

Re: Site Isolation in Firefox

#105

Post by asddubs »

korethr wrote: post #4

When Chrome was new and shiny, I used it for a time. Then, the first time I found myself needing to kill Chrome because it was completely locked up, I found myself staring at a wall of chrome processes in the task list, not knowing which one I needed to kill. At the time, I thought the idea of a separate process for each tab was silly. Though, with Firefox moving towards this model, I guess the engineers at Google we…

if you're on linux you can do killall -9 firefox

Re: Site Isolation in Firefox

#106

Post by fragileone »

nextos wrote: post #80
ksml wrote: post #37

This is really interesting. Prior to this, Firefox's isolation model was much weaker than Chrome's due to only having a pool of 8 content processes. If I'm reading the technical blog correctly [1], this will move to a process-per-site model without also doing process-per-tab as Chrome does, i.e. if you have several tabs open on the same site, they'd be in the same process. This seems much less resource intensive than…

Complementary to this, one can use the Temporary Containers addon to get isolation of e.g. cookies. I've set it up to run one container per domain, and it works really well. I hope they merge this into Firefox at some point.

First Party Isolation is the native version of this (AKA Total Cookie Protection). Set Enhanced Tracking Protection to Strict to enable it.

Re: Site Isolation in Firefox

#107

Post by fragileone »

OminousWeapons wrote: post #79
fragileone wrote: post #46

Earlier quoted context omitted.

Enable Strict Enhanced Tracking Protection setting, this turns on Dynamic First Party Isolation which is the native version of what Temporary Containers is aiming to do.

I believe this is privacy.firstparty.isolate in about:config, if you want to do this manually

That's not for the Dynamic version as far as I'm aware.

Re: Site Isolation in Firefox

#108

Post by OminousWeapons »

fragileone wrote: post #107
OminousWeapons wrote: post #79

Earlier quoted context omitted.

I believe this is privacy.firstparty.isolate in about:config, if you want to do this manually

That's not for the Dynamic version as far as I'm aware.

Is there a way to enable the dynamic version via about:config to your knowledge?

Re: Site Isolation in Firefox

#109

Post by andrewaylett »

jedberg wrote: post #27

Has anyone tried this along with Container Tabs? Do they play nicely? Does it offer any advantage over Container Tabs?

Based on the processes I'm now running, it seems that tabs for the same domain but in different containers do (as one might expect) count as separate origins for the purpose of creating one process per origin.

So they do different things, and interaction between the features appears to work without issues.

Re: Site Isolation in Firefox

#110

Post by WhyNotHugo »

nextos wrote: post #80
ksml wrote: post #37

This is really interesting. Prior to this, Firefox's isolation model was much weaker than Chrome's due to only having a pool of 8 content processes. If I'm reading the technical blog correctly [1], this will move to a process-per-site model without also doing process-per-tab as Chrome does, i.e. if you have several tabs open on the same site, they'd be in the same process. This seems much less resource intensive than…

Complementary to this, one can use the Temporary Containers addon to get isolation of e.g. cookies. I've set it up to run one container per domain, and it works really well. I hope they merge this into Firefox at some point.

How did you set it up to use one container per domain?

I'm using Temporary Containers, but if I visit `somedomain.com`, close it, and come back later, I get a new temporary container.

Post reply on HN