Mozilla patches two use-after-free vulnerabilities (ab)used in the wild • Hacker News Board

Re: Mozilla patches two use-after-free vulnerabilities (ab)used in the wild

#31

Post by andrewSC » Sat, Mar 05, 2022, 11:15 PM UTC

tgsovlerkhgsel wrote: post #27

concinds wrote: post #20

Earlier quoted context omitted.

This is slightly outdated now, but here's the GrapheneOS explanation for why they don't recommend Firefox, and why they bundle Chromium-based forks instead. https://grapheneos.org/usage#web-browsing It's basically universally agreed among security people that Firefox is less secure than Chrome. It's up to you to decide is it's likely Mozilla's caught up in the (year?) since this was written,. Or if they'll ever be ab…

Related: Mozilla fired parts of their security team (though likely not the people directly responsible for securing the browser) - https://news.ycombinator.com/item?id=24128865 Quote from one of the tweets confirming it: "They killed entire threat management team. Mozilla is now without detection and incident response."

The thing i’m still trying to understand is why Mozilla management is so hell bent on crippling their flagship product? RIP Servo, among other forward looking technologies.

Re: Mozilla patches two use-after-free vulnerabilities (ab)used in the wild

#32

Post by _-david-_ » Sat, Mar 05, 2022, 11:20 PM UTC

classichasclass wrote: post #23

moonchrome wrote: post #17

Earlier quoted context omitted.

This keeps getting repeated and I still haven't heard a convincing argument on why that's a good thing. Chromium/Blink is opensource, has two megacorp contributors (Microsoft and Google) - it's a far cry from MS IE monopoly. Plus Apple has WebKit. Firefox just adds incompatibility to the mix of things you have to support, frankly I'd switch to Firefox if they decided to build it on top of Chromium. When they were act…

How much does Microsoft actually contribute to Blink's core really ? The benefit for Microsoft of Chromium Edge is they get to outsource development. Their interest is in making it run well, and so far they've largely left the web features to Google. If Firefox became a Chromium fork they'd be just another junior partner in name only; Google would still be running the show on policy. In fact, possibly worse, because…

>The benefit for Microsoft of Chromium Edge is they get to outsource development

They also wanted to get superior compatibility. While the old edge was quite a bit better than IE, it still feel short.

Re: Mozilla patches two use-after-free vulnerabilities (ab)used in the wild

#33

Post by blihp » Sat, Mar 05, 2022, 11:30 PM UTC

moonchrome wrote: post #19

wizzwizz4 wrote: post #18

Earlier quoted context omitted.

When Google wants a feature implemented in Chromium, it gets implemented, pretty much regardless of how buggy it is. When I want a feature implemented and Google wants it not implemented… tough luck.

Is that different with Firefox? I haven't been paying attention in a while now but I constantly read complaints about UI changes - and Firefox has it's share of experimental features that ended up being exploited or abuse (asm.js comes to mind).

Only in the sense that when Google wants a new web standard the Firefox devs need to be convinced before it happens there. That has stopped a few, but not all, user hostile things from becoming defacto standards over the years.

Re: Mozilla patches two use-after-free vulnerabilities (ab)used in the wild

#34

Post by weaksauce » Sat, Mar 05, 2022, 11:31 PM UTC

wizzwizz4 wrote: post #18

moonchrome wrote: post #17

Earlier quoted context omitted.

This keeps getting repeated and I still haven't heard a convincing argument on why that's a good thing. Chromium/Blink is opensource, has two megacorp contributors (Microsoft and Google) - it's a far cry from MS IE monopoly. Plus Apple has WebKit. Firefox just adds incompatibility to the mix of things you have to support, frankly I'd switch to Firefox if they decided to build it on top of Chromium. When they were act…

When Google wants a feature implemented in Chromium, it gets implemented, pretty much regardless of how buggy it is. When I want a feature implemented and Google wants it not implemented… tough luck.

Just look at the most recent changes to webextensions that chrome is trying to do... basically solely to make ad blocking nigh impossible. That's why browser diversity matters.

Re: Mozilla patches two use-after-free vulnerabilities (ab)used in the wild

#35

Post by kibwen » Sat, Mar 05, 2022, 11:33 PM UTC

tgsovlerkhgsel wrote: post #27

concinds wrote: post #20

Earlier quoted context omitted.

This is slightly outdated now, but here's the GrapheneOS explanation for why they don't recommend Firefox, and why they bundle Chromium-based forks instead. https://grapheneos.org/usage#web-browsing It's basically universally agreed among security people that Firefox is less secure than Chrome. It's up to you to decide is it's likely Mozilla's caught up in the (year?) since this was written,. Or if they'll ever be ab…

Related: Mozilla fired parts of their security team (though likely not the people directly responsible for securing the browser) - https://news.ycombinator.com/item?id=24128865 Quote from one of the tweets confirming it: "They killed entire threat management team. Mozilla is now without detection and incident response."

But according to your own link, it was confirmed that they didn't do that? Did you mean to link to something else?

Re: Mozilla patches two use-after-free vulnerabilities (ab)used in the wild

#36

Post by saltharp » Sat, Mar 05, 2022, 11:47 PM UTC

moonchrome wrote: post #17

uneekname wrote: post #5

Earlier quoted context omitted.

I agree with you entirely. My third reason to stick with Firefox is to vote with my feet regarding browser engine diversity.

This keeps getting repeated and I still haven't heard a convincing argument on why that's a good thing. Chromium/Blink is opensource, has two megacorp contributors (Microsoft and Google) - it's a far cry from MS IE monopoly. Plus Apple has WebKit. Firefox just adds incompatibility to the mix of things you have to support, frankly I'd switch to Firefox if they decided to build it on top of Chromium. When they were act…

I don't think it's enough that Chromium is open source. Yes it's very different from the MS IE monopoly, but Google has a very different business model compared Microsoft.

The value of IE to Microsoft was to lock people into Windows - both developers and users. They recognized that the web would become a software platform in its own right, and knew that if everyone ended up using web software then it'd be a lot easier to use non-Windows platforms.

Google gets much of its revenue from web advertising, so the value of Chromium to Google is to keep the web profitable for them. For example, Mozilla can't do to Google what Apple did to Facebook. They can do things like veto any move away from cookies as the primary tracking mechanism, at least until they have an alternative ready to go.

An open source license doesn't fully solve the problem because forking Chromium isn't enough. All the software on the web is built on top of APIs that Google gets a say in, and these are designed to be useful for ad/tracking networks.

Re: Mozilla patches two use-after-free vulnerabilities (ab)used in the wild

#37

Post by aaaaaaaaata » Sun, Mar 06, 2022, 12:25 AM UTC

andrewSC wrote: post #31

tgsovlerkhgsel wrote: post #27

Earlier quoted context omitted.

Related: Mozilla fired parts of their security team (though likely not the people directly responsible for securing the browser) - https://news.ycombinator.com/item?id=24128865 Quote from one of the tweets confirming it: "They killed entire threat management team. Mozilla is now without detection and incident response."

The thing i’m still trying to understand is why Mozilla management is so hell bent on crippling their flagship product? RIP Servo, among other forward looking technologies.

Follow the money?

Re: Mozilla patches two use-after-free vulnerabilities (ab)used in the wild

#38

Post by aaaaaaaaata » Sun, Mar 06, 2022, 12:26 AM UTC

tgv wrote: post #6

abhaynayar wrote: post #2

I use Firefox on Ubuntu and Android. I love Firefox more than Chromium-based browsers. But security is the one thing that makes me think of switching. Two minor things that prevent me from switching to Chromium-based browsers: 1. There is no addon functionality on Android for Chromium-based browsers. For example, I can add the uBlock addon on Firefox for Android but not Chrome for Android. 2. There is no option to pl…

Do you really think Chrome is safer than Firefox?

Depends on your threat model.

Re: Mozilla patches two use-after-free vulnerabilities (ab)used in the wild

#39

Post by Sunspark » Sun, Mar 06, 2022, 12:47 AM UTC

abhaynayar wrote: post #2

I use Firefox on Ubuntu and Android. I love Firefox more than Chromium-based browsers. But security is the one thing that makes me think of switching. Two minor things that prevent me from switching to Chromium-based browsers: 1. There is no addon functionality on Android for Chromium-based browsers. For example, I can add the uBlock addon on Firefox for Android but not Chrome for Android. 2. There is no option to pl…

Install Samsung Internet Browser. It's Chromium and it will run on non-Samsung devices. You can install the AdGuard add-on in it. It will let you put the bar at the bottom too.

That said, I use Firefox on my desktop.

Re: Mozilla patches two use-after-free vulnerabilities (ab)used in the wild

#40

Post by Sunspark » Sun, Mar 06, 2022, 12:49 AM UTC

moonchrome wrote: post #17

uneekname wrote: post #5

Earlier quoted context omitted.

I agree with you entirely. My third reason to stick with Firefox is to vote with my feet regarding browser engine diversity.

This keeps getting repeated and I still haven't heard a convincing argument on why that's a good thing. Chromium/Blink is opensource, has two megacorp contributors (Microsoft and Google) - it's a far cry from MS IE monopoly. Plus Apple has WebKit. Firefox just adds incompatibility to the mix of things you have to support, frankly I'd switch to Firefox if they decided to build it on top of Chromium. When they were act…

The point is Firefox has preferable ergonomics. For example, Firefox allows an end-user to specify their own fonts and colours. Chrome/Edge do not allow this.