Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Site Isolation in Firefox

blog.mozilla.org

Post reply on HN
Print view View original

111–118 of 118 posts

Re: Site Isolation in Firefox

#111

Post by OrvalWintermute »

jedberg wrote: post #38
OrvalWintermute wrote: post #34

Earlier quoted context omitted.

I think they are complementary, since one is about browser site isolation, and one is about process isolation on the computer. Using temporary containers, multi-account containers, site isolation, along with a number of other privacy/security addons such as Umatrix, LocalCDN, and many others, I have not noticed any slowdown. This on an older broadwell i7 with 32GB of ram.

So far it seems to work fine for me too. Can you share you list of security/privacy addons? I've used Umatrix but never heard of LocalCDN. Was wondering what other gems you may have found.

Here is a complete list of security/privacy addons I am using, a small number of which I have disabled, as I regularly toggle them depending on what I am doing at the time

AdNauseam

Archive Page

ClearURLs

Cookie AutoDelete

Cookie Remover

Decentraleyes

DoH Roll-Out

Don't track me Google

DuckDuckGo

Facebook Container

Firefox Multi-Account Containers

Firefox Private Network

Firefox Relay

Firefox Screenshots

First Party Isolation

Google Container

Google search link fix

Greasemonkey

HistoryBlock

HTTPS Everywhere

I don't care about cookies

Laboratory

Link Cleaner

LocalCDN

PinPatrol

Privacy Badger

Privacy Pass

Redirect AMP to HTML

Skip Redirect

Tampermonkey

Temporary Containers

Trocker

Twitter Container

uBlock Origin

Ugly Email

uMatrix

Wappalyzer

Zoom Redirector

Re: Site Isolation in Firefox

#112

Post by takluyver »

yakubin wrote: post #104
takluyver wrote: post #97

Earlier quoted context omitted.

People object to the massive effort it takes to create or maintain a browser engine which can practically browse the modern web. We're down to 3 players now actually trying to do this (Mozilla, Google, Apple). It conflicts with the idea that you can fork software if you dislike what it's doing, because even starting from existing code, it would be a lot of work to keep up with changes so you don't get left behind. So…

There are many distinct PDF readers. Making a document browser shouldn't be more complicated than making a PDF reader. PDF readers is how it works in practice.

I guess the issue is that a modern web browser is a sandboxed application runtime which also happens to function as a document browser. It's been going in that direction for a long time (since webmail became common), and there are real advantages of the browser as a platform for applications - it's cross platform by default, and it has pretty good sandboxing.

So probably the most you can hope for is that we split the document part of the web from the application part, so that it's easier to make a viable document browser. But it's not clear what advantage this offers for anyone who's not trying to make their own browser. Security is probably much simpler for the document browser, but the logins and sensitive data you care about securing are probably in the application browser anyway. And we've spent the last 20 years blurring the lines between documents and applications (think of a Github issue page, for instance), so even if it was possible to access information as a pure document, there would be advantages to looking at it in an application browser.

Re: Site Isolation in Firefox

#113

Post by tialaramex »

mastazi wrote: post #102
tialaramex wrote: post #75

Earlier quoted context omitted.

One of the maintainers of the PSL (Ryan Sleevi) has written on HN before that they'd sure like it if people leant on the PSL less rather than more. It's a nasty hack, the successor to even worse proprietary hacks but still something we ought to strive to get rid of. I can see exactly why it was the choice here, and I don't blame Mozilla for choosing it, but we're not going to make things better if nobody gets out and…

How do you propose getting rid of the PSL? I don't see alternatives to having an authoritative publicly available list, unless we change the current standards somehow? > I sure would like it if Mozilla shipped a way for extensions to just consult Firefox's built-in copy of the PSL the PSL is available at https://publicsuffix.org/list/public_suffix_list.dat - as noted elsewhere in this tread it is also used by other b…

I do not have a concrete proposal. If I did I'd probably be too busy arguing about it with other people in that space to comment here.

> I guess the one built into Firefox is just downloaded from there and cached? If so why would you want that over the other?

If your extension is 10kB of Javascript and you typically update it once or twice a year to tweak things, it's crazy that now the total extension size is over twenty times bigger and you need updates every month or so at least because otherwise things might not work for some users.

If your extension wraps, say, the New York transit map, or Wikipedia's list of English monarchs then fine, there's no reason Firefox would know those, you need to ship or fetch the data. But the PSL is necessarily built-in to Firefox, they do have the data, you just can't access their copy.

Re: Site Isolation in Firefox

#114

Post by daxelrod »

virginia_a wrote: post #84
daxelrod wrote: post #62

This is fantastic work that will greatly improve the security of Firefox; big thanks to those who have worked on it. Is there data on what effect it will have on memory use? One of the primary reasons I use Firefox is that it uses significantly less memory than Chrome, and the entire OS seems to function better as a result (I've seen the most stark difference on macOS). I had been under the impression that most of th…

Yes, more processes come with the cost of more memory but we have reducing the process overhead in Firefox in order to minimize that cost as much as possible. We will continue doing memory reductions and will have numbers to report when we roll-out to all our users. Thank you for your continued support and use of Firefox.

Awesome! I'll look out for these numbers.

Do you need more data? If so, what's the best way for me to add to it? Would that be installing Nightly, setting fission.autostart to true, and enabling some telemetry?

Re: Site Isolation in Firefox

#115

Post by mastazi »

tialaramex wrote: post #113
mastazi wrote: post #102

Earlier quoted context omitted.

How do you propose getting rid of the PSL? I don't see alternatives to having an authoritative publicly available list, unless we change the current standards somehow? > I sure would like it if Mozilla shipped a way for extensions to just consult Firefox's built-in copy of the PSL the PSL is available at https://publicsuffix.org/list/public_suffix_list.dat - as noted elsewhere in this tread it is also used by other b…

I do not have a concrete proposal. If I did I'd probably be too busy arguing about it with other people in that space to comment here. > I guess the one built into Firefox is just downloaded from there and cached? If so why would you want that over the other? If your extension is 10kB of Javascript and you typically update it once or twice a year to tweak things, it's crazy that now the total extension size is over t…

I was thinking about downloading the data at runtime, not baking it into the extension source. Obviously I don't know what your extension does and maybe there are reasons why this is not possible (e.g. maybe that's not doable because you need offline support).

Re: Site Isolation in Firefox

#116

Post by rstuart4133 »

dmos62 wrote: post #56
gourlaysama wrote: post #9

Earlier quoted context omitted.

On Firefox you can go to `about:processes`. It lists tabs by process, and includes the PID (on Linux; no idea about other platforms). You can also directly kill tabs and processes from there.

That's super useful on a resource strapped system. Wish I knew this earlier.

You should take a look at Firefox's about:about. There are all sorts of goodies in there.

For example, about:compat lists sites they added hard coded work arounds for.

Re: Site Isolation in Firefox

#117

Post by account42 »

mccr8 wrote: post #68
iggldiggl wrote: post #59

Any news about the memory usage overhead this brings? The original design goal when the work on site isolation started was 1 GB overhead for a browsing session with 100 separate origins (can't remember how many tabs that was supposed to correspond to, although due to iframes it was definitively less than 100 tabs). Was this goal reached in the end, or perhaps even surpassed, or missed after all? I guess this also mak…

I think the overhead is something more like 15MB per process, on Windows. It is higher on other OSes, due in part to the way they load executables. In practice, the total overhead is less bad than you might expect, because people usually don't have that many unique sites open. Telemetry shows that unique sites per tab decreases as the number of tabs increases. It really depends on what web sites you have open. If you…

> It is higher on other OSes, due in part to the way they load executables.

Can you explain this in more detail?

Re: Site Isolation in Firefox

#118

Post by maverick74 »

OminousWeapons wrote: post #108
fragileone wrote: post #107

Earlier quoted context omitted.

That's not for the Dynamic version as far as I'm aware.

Is there a way to enable the dynamic version via about:config to your knowledge?

Take a look at:

https://techdows.com/2020/04/enable-dynamic-first-party-isol...

Post reply on HN