Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Edge: Building a safer browser

blogs.windows.com

Post reply on HN
Print view View original

31–40 of 75 posts

Re: Microsoft Edge: Building a safer browser

#31

Post by Navarr »

integraton wrote: post #22
mikhailt wrote: post #15

Earlier quoted context omitted.

The same way as before, Microsoft will release an Edge-dev optimized VM builds on their site here: http://dev.modern.ie/tools/vms/ They have other tools there to help as well. Microsoft is pretty good about helping devs here. It's not like testing sites in Safari is better, Apple isn't even bothering to update Safari on Windows as it has been dead for nearly more than 2 years. At least Microsoft is updating more ofte…

That is enormously disingenuous to try to equivocate IE/Spartan/Edge's single-OS existence with Safari/WebKit. WebKit works on every major operating system, including Windows and Linux. IE/Spartan/Edge does not work outside of Windows. There are some minor feature differences between WebKit, OS X Safari, and iOS Safari, but the reality remains that WebKit exists on Windows, can be built on Windows, and can be used on…

The reality remains that I can test Edge as Edge, perfectly, with all of it's unique quirks no matter what operating system I use.

You can't say the same for Apple's Safari browser.

Re: Microsoft Edge: Building a safer browser

#32

Post by AdeptusAquinas »

cobalt wrote: post #10
rmtew wrote: post #9

> The largest change in Microsoft Edge security is that the new browser is a Universal Windows app. .... This provides the user and the platform with the confidence provided by other Windows store apps I see it's going to be a Windows Store app. I wonder how this will affect the usability for people like myself, who never see the metro side of windows unless I accidentally move the mouse near the wrong side of the sc…

Widnows 10 does not have fullscreen apps like windows 8 did

Or rather fullscreen view is now optional.

Re: Microsoft Edge: Building a safer browser

#33

Post by vinceyuan »

kijin wrote: post #18

A bit off topic, but I really hope that Microsoft and Samsung have reached some sort of understanding regarding the name "Edge". A trademark dispute involving their new browser is the last thing Microsoft needs at this time. It was confusing enough when they had to change SkyDrive to OneDrive.

I don't think it is a problem. The new browser's name is not Edge. It's 'Microsoft Edge'. The samsung phone's name is 'Galaxy Edge'. Now tech companies like to use the compound name, e.g. Apple Watch, to avoid the trademark issue.

Re: Microsoft Edge: Building a safer browser

#34

Post by eropple »

integraton wrote: post #25
bunderbunder wrote: post #23

Earlier quoted context omitted.

There are WebKit browsers other than Safari. But judging by how often I come across sites that render differently in Chrome and Safari, I don't know that we should draw too strong an equivalence between them either. (And while I can't speak for the downvoters because I'm not one of them, I suspect that it's not the facts presented in the post that are attracting the downvotes so much as that it's written in the form…

Chrome doesn't use WebKit, it uses Blink, a fork of WebKit. I'm only referring to WebKit, the Apple open source browser project that builds and works on every major operating system including Windows. If you also want to talk about Blink, Google's browser project that, unlike IE/Spartan/Edge, also works on every major operating system, then that's fine, too. While we are at it, let's talk about Mozilla's browser and…

> Chrome doesn't use WebKit, it uses Blink, a fork of WebKit.

Chrome didn't render the same as Safari when Chrome used WebKit, either. You're caping up for this, and I can't for the life of me figure out why.

Re: Microsoft Edge: Building a safer browser

#35

Post by latiera »

I don't see anything safer here, same old garbage + snake oil.

Sandboxes are totally useless when the kernel is riddled with exploitable bugs.

ASLR 64bit bla bla is totally useless when you have a million information leak bugs.

Somebody wake me up when they implement an entire browser 100% in a memory safe language and there's no way to hit kernel surface from there.

Re: Microsoft Edge: Building a safer browser

#36

Post by latiera »

nbevans wrote: post #28
Animats wrote: post #26

Earlier quoted context omitted.

What is Edge written in? I would have assumed Microsoft would use C#, which is garbage collected.

Highly unlikely. It would be written as a native C++ app. Whilst the .NET CLR is very powerful and highly performant these days, there just wouldn't be enough justification I don't think to design their web browser on it. Remember this thing will be targeting mobile devices too. So every little performance optimisation can save minutes of battery life which all adds up. That said, I've always wondered what a JavaScri…

Not enough justification?

How about 0 security? All their measures are totally useless, there is no safety here just same old bullshit that can be trivially bypassed.

Re: Microsoft Edge: Building a safer browser

#37

Post by joshuapants »

jedberg wrote: post #5

Having met the engineers who actually built Edge, I can say with some confidence that I think this will the Microsoft browser people actually like. They built it from the ground up with security in mind, and with standards compatibility at the expense of backwards compatibility. In other words, they have finally decided that it is ok to tell their lagging enterprise customers to get with the times.

> In other words, they have finally decided that it is ok to tell their lagging enterprise customers to get with the times.

Well, they're still maintaining IE as a separate browser for those corporate users who rely on it, but it is a first step toward that.

Re: Microsoft Edge: Building a safer browser

#38

Post by joshuapants »

kid0m4n wrote: post #7

I believe that Microsoft not releasing versions for Linux / Mac OS X is going to not allow Edge to get maximum adoption. How am I supposed to test that my website works on Edge properly? The only option thus far is to setup a VM with Windows 10 on it so that I can run a browser to test my website. I dont even bother testing stuff on IE x for that reason.

> I believe that Microsoft not releasing versions for Linux / Mac OS X is going to not allow Edge to get maximum adoption.

How much will the user base grow by allowing a small fraction of desktop users the option of using this browser?

Re: Microsoft Edge: Building a safer browser

#39

Post by joshuapants »

cobalt wrote: post #10
rmtew wrote: post #9

> The largest change in Microsoft Edge security is that the new browser is a Universal Windows app. .... This provides the user and the platform with the confidence provided by other Windows store apps I see it's going to be a Windows Store app. I wonder how this will affect the usability for people like myself, who never see the metro side of windows unless I accidentally move the mouse near the wrong side of the sc…

Widnows 10 does not have fullscreen apps like windows 8 did

That said, a lot of modern apps are really annoying to use even when windowed.

Re: Microsoft Edge: Building a safer browser

#40

Post by nerraga »

Animats wrote: post #26
comex wrote: post #8

> MemGC (Memory Garbage Collector) is a memory garbage collection system that seeks to defend the browser from UAF (Use-after-free) vulnerabilities by taking responsibility for freeing memory away from the programmer and instead automating it, only freeing memory when the automation has detected that there are no more references left pointing to a given block of memory. Interesting; I don't think this has been announ…

What is Edge written in? I would have assumed Microsoft would use C#, which is garbage collected.

The fact that the article is mentioning MemGC as a defense against use-after-free attacks (something I don't believe managed languages need be concerned) and the way Control-Flow-Guard is described leads me to think it's primarily C++. Probably a mix of native/managed, but I suspect that any managed code is kept to a minimum given the emphasis on native protection and countermeasures. If this is the case then I'd be interested in their rationale in deciding not to go 100% managed.
Post reply on HN