11–20 of 99 posts
But Firefox seems to have much better security when it comes to reviewing extensions. Some popular extensions go through approval and source code review on every release.
Chrome Play store does not seems to have that. Google incentive even goes against something like UBlock. If extension gets sold, or developer account compromised, we may get widely distributed malware!
Let's not talk about privacy (because there is no point in talking about it: Firefox is eons more private than Chrome - or any of it's based browsers - can ever be) About security: Chrome has a biggest workforce, yes. but let's think about this a bit... First, let's not forget that chrome is also a bigger target. let's imagine this: Consider that 90% of the users worldwide use chromium-based browsers, and you are an…
So I wonder how much unnecessary information people using Chrome leak to those sites and the third parties that receive, log and possibly sell those data.
I think chrome has better security model, sandboxing... But Firefox seems to have much better security when it comes to reviewing extensions. Some popular extensions go through approval and source code review on every release. Chrome Play store does not seems to have that. Google incentive even goes against something like UBlock. If extension gets sold, or developer account compromised, we may get widely distributed…
It also worth to mention that Firefox is built with Rust, and Chrome mostly C/C++.
For Firefox, you have to worry about the next "pocket", or the next "Mr. Robot"...
Manifest v3 is looming as well.
Six of one, half a dozen of the other. /shrug
My experience is that security is a function of simplicity and individuals having a complete understanding of the code and implications of changes.
Implications:
- A smaller team will generally lead to more secure software than a larger team.
- Many security layers are counterproductive.
In studies, bugs per KLOC are relatively consistent. A 100-line program can be fully auditable. One with a JIT in a virtual machine in a sandbox looks, on paper, more secure. In practice:
- There are many more places to introduce bugs.
- Beyond some level of complexity, it's impossible to understand the security model holistically.
- Bugs often cut across layers
- Layers are often used as an excuse ("We'll leave this, since that other layer will catch it).
Layers can be okay if they're well-understood, analyzed, and well-documented (e.g. postfix). However, the vast majority of the time, they're not. People pointing to bigger workforce or sandboxes in Chrome aren't selling me. It only takes one idiot.... And for sandboxes? I've never seen a clean block diagram of the Chrome security model.
To be clear: I'm not arguing which browser is more secure -- simply that the arguments in this thread don't sell me.
If you're willing to include Chrome forks then I'd say Brave is, despite the issues surrounding their love for crypto, more secure than Chrome, and it has much better anti-fingerprinting if you care about that.
Why would you say it's more secure?
And since “private” and “secure” are correlated…
Let's not talk about privacy (because there is no point in talking about it: Firefox is eons more private than Chrome - or any of it's based browsers - can ever be) About security: Chrome has a biggest workforce, yes. but let's think about this a bit... First, let's not forget that chrome is also a bigger target. let's imagine this: Consider that 90% of the users worldwide use chromium-based browsers, and you are an…
Some progress is made though...
Brave: https://brave.com