Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla patches two use-after-free vulnerabilities (ab)used in the wild

mozilla.org

Post reply on HN
Print view View original

21–30 of 67 posts

Re: Mozilla patches two use-after-free vulnerabilities (ab)used in the wild

#21

Post by eternityforest »

wizzwizz4 wrote: post #18
moonchrome wrote: post #17

Earlier quoted context omitted.

This keeps getting repeated and I still haven't heard a convincing argument on why that's a good thing. Chromium/Blink is opensource, has two megacorp contributors (Microsoft and Google) - it's a far cry from MS IE monopoly. Plus Apple has WebKit. Firefox just adds incompatibility to the mix of things you have to support, frankly I'd switch to Firefox if they decided to build it on top of Chromium. When they were act…

When Google wants a feature implemented in Chromium, it gets implemented, pretty much regardless of how buggy it is. When I want a feature implemented and Google wants it not implemented… tough luck.

When Google invents a feature I want, Mozilla writes a position statement on how it's evil and never implements it.

It's hard to get behind engine diversity when Mozilla is trying to take the web in a direction I don't really want.

Meanwhile Brave does the same thing, but with Cryptocurrency.

I wish we had an open source clone of Vivaldi.

Re: Mozilla patches two use-after-free vulnerabilities (ab)used in the wild

#22

Post by wizzwizz4 »

moonchrome wrote: post #19
wizzwizz4 wrote: post #18

Earlier quoted context omitted.

When Google wants a feature implemented in Chromium, it gets implemented, pretty much regardless of how buggy it is. When I want a feature implemented and Google wants it not implemented… tough luck.

Is that different with Firefox? I haven't been paying attention in a while now but I constantly read complaints about UI changes - and Firefox has it's share of experimental features that ended up being exploited or abuse (asm.js comes to mind).

It's not much different with Firefox, no. I was making a point that browser monopolies are bad; the fact we only have three real browser engines (two of which are based on Konqueror) is a problem.

But at least Mozilla do a basic back-of-the-envelope “is this feature a huge security vulnerability” check before shipping. (Looking at you, .)

Re: Mozilla patches two use-after-free vulnerabilities (ab)used in the wild

#23

Post by classichasclass »

moonchrome wrote: post #17
uneekname wrote: post #5

Earlier quoted context omitted.

I agree with you entirely. My third reason to stick with Firefox is to vote with my feet regarding browser engine diversity.

This keeps getting repeated and I still haven't heard a convincing argument on why that's a good thing. Chromium/Blink is opensource, has two megacorp contributors (Microsoft and Google) - it's a far cry from MS IE monopoly. Plus Apple has WebKit. Firefox just adds incompatibility to the mix of things you have to support, frankly I'd switch to Firefox if they decided to build it on top of Chromium. When they were act…

How much does Microsoft actually contribute to Blink's core really? The benefit for Microsoft of Chromium Edge is they get to outsource development. Their interest is in making it run well, and so far they've largely left the web features to Google. If Firefox became a Chromium fork they'd be just another junior partner in name only; Google would still be running the show on policy. In fact, possibly worse, because of their poor negotiating position.

WebKit only matters because of iOS, and Blink and WebKit still share a lot of DNA. It's not a credible competitor otherwise.

I do agree killing Servo was a shortsighted move, but, speaking as a long-time Mozilla community member, that's hardly the only shortsighted move MoCo has ever made (see also: dumping embedding for Fx4).

Re: Mozilla patches two use-after-free vulnerabilities (ab)used in the wild

#24

Post by dijonman2 »

abhaynayar wrote: post #2

I use Firefox on Ubuntu and Android. I love Firefox more than Chromium-based browsers. But security is the one thing that makes me think of switching. Two minor things that prevent me from switching to Chromium-based browsers: 1. There is no addon functionality on Android for Chromium-based browsers. For example, I can add the uBlock addon on Firefox for Android but not Chrome for Android. 2. There is no option to pl…

Mozilla laid off the bulk of their security team, there will be a natural decline in security over time.

Re: Mozilla patches two use-after-free vulnerabilities (ab)used in the wild

#25

Post by bkberry352 »

eternityforest wrote: post #21
wizzwizz4 wrote: post #18

Earlier quoted context omitted.

When Google wants a feature implemented in Chromium, it gets implemented, pretty much regardless of how buggy it is. When I want a feature implemented and Google wants it not implemented… tough luck.

When Google invents a feature I want, Mozilla writes a position statement on how it's evil and never implements it. It's hard to get behind engine diversity when Mozilla is trying to take the web in a direction I don't really want. Meanwhile Brave does the same thing, but with Cryptocurrency. I wish we had an open source clone of Vivaldi.

What features are you referring to?

Re: Mozilla patches two use-after-free vulnerabilities (ab)used in the wild

#26

Post by upofadown »

concinds wrote: post #20
hannob wrote: post #8

Earlier quoted context omitted.

I'm not sure there's that much difference in browser security. There were tiny nits where Chrome was somewhat stricter that I was aware of (e.g. handling of nosniff header), but most of that has been fixed at some point. Mozilla was somewhat slower with some security improvements like site isolation, but eventually catched up. Memory safety is a general problem, but all browsers have it. "We urgently fixed this use a…

This is slightly outdated now, but here's the GrapheneOS explanation for why they don't recommend Firefox, and why they bundle Chromium-based forks instead. https://grapheneos.org/usage#web-browsing It's basically universally agreed among security people that Firefox is less secure than Chrome. It's up to you to decide is it's likely Mozilla's caught up in the (year?) since this was written,. Or if they'll ever be ab…

That seems to be quite focused on the situation with Firefox on the Android/Graphene environment.

>It's basically universally agreed among security people that Firefox is less secure than Chrome.

A reference would be nice here...

Re: Mozilla patches two use-after-free vulnerabilities (ab)used in the wild

#27

Post by tgsovlerkhgsel »

concinds wrote: post #20
hannob wrote: post #8

Earlier quoted context omitted.

I'm not sure there's that much difference in browser security. There were tiny nits where Chrome was somewhat stricter that I was aware of (e.g. handling of nosniff header), but most of that has been fixed at some point. Mozilla was somewhat slower with some security improvements like site isolation, but eventually catched up. Memory safety is a general problem, but all browsers have it. "We urgently fixed this use a…

This is slightly outdated now, but here's the GrapheneOS explanation for why they don't recommend Firefox, and why they bundle Chromium-based forks instead. https://grapheneos.org/usage#web-browsing It's basically universally agreed among security people that Firefox is less secure than Chrome. It's up to you to decide is it's likely Mozilla's caught up in the (year?) since this was written,. Or if they'll ever be ab…

Related: Mozilla fired parts of their security team (though likely not the people directly responsible for securing the browser) - https://news.ycombinator.com/item?id=24128865

Quote from one of the tweets confirming it: "They killed entire threat management team. Mozilla is now without detection and incident response."

Re: Mozilla patches two use-after-free vulnerabilities (ab)used in the wild

#28

Post by extra88 »

bkberry352 wrote: post #25
eternityforest wrote: post #21

Earlier quoted context omitted.

When Google invents a feature I want, Mozilla writes a position statement on how it's evil and never implements it. It's hard to get behind engine diversity when Mozilla is trying to take the web in a direction I don't really want. Meanwhile Brave does the same thing, but with Cryptocurrency. I wish we had an open source clone of Vivaldi.

What features are you referring to?

FLoC may be one that could be characterized as “evil.” I mainly think about APIs that extend beyond the browser, like USB or Bluetooth, that Firefox won’t do for security reasons.

Re: Mozilla patches two use-after-free vulnerabilities (ab)used in the wild

#29

Post by Georgelemental »

abhaynayar wrote: post #2

I use Firefox on Ubuntu and Android. I love Firefox more than Chromium-based browsers. But security is the one thing that makes me think of switching. Two minor things that prevent me from switching to Chromium-based browsers: 1. There is no addon functionality on Android for Chromium-based browsers. For example, I can add the uBlock addon on Firefox for Android but not Chrome for Android. 2. There is no option to pl…

Kiwi Browser (https://kiwibrowser.com/) is a FOSS Chromium for Android derivative that supports Chrome extensions.

Re: Mozilla patches two use-after-free vulnerabilities (ab)used in the wild

#30

Post by consumer451 »

tgsovlerkhgsel wrote: post #27
concinds wrote: post #20

Earlier quoted context omitted.

This is slightly outdated now, but here's the GrapheneOS explanation for why they don't recommend Firefox, and why they bundle Chromium-based forks instead. https://grapheneos.org/usage#web-browsing It's basically universally agreed among security people that Firefox is less secure than Chrome. It's up to you to decide is it's likely Mozilla's caught up in the (year?) since this was written,. Or if they'll ever be ab…

Related: Mozilla fired parts of their security team (though likely not the people directly responsible for securing the browser) - https://news.ycombinator.com/item?id=24128865 Quote from one of the tweets confirming it: "They killed entire threat management team. Mozilla is now without detection and incident response."

I have been dragging my feet on leaving Firefox for security reasons for so long, and just now I have come to terms with how ridiculous that is.

I’ve known about the security team, and I remember hearing that even prior to that, a CTF event had banned Firefox exploits as too easy.

I am doing it next time I open my work laptop. I mean what is the single most important class of features in a browser? Security. I feel dumb for waiting so long.

This makes me sad. I was emotionally invested invested in Mozilla and that caused an error in judgment.

Post reply on HN