131–140 of 242 posts
Earlier quoted context omitted.
Presumably this affects all electron apps which embed chrome too? Don’t they pin the chrome version?
Yes, but it's only a vulnerability if the app allows rendering untrusted HTML or visiting untrusted websites, which most Electron apps don't.
Earlier quoted context omitted.
HN doesn't want firefox to go away. HN wants firefox to be better, more privacy/security focused, and to stop trying to copy chrome out of the misguided hope that being a poor imitation will somehow make it more popular. Sadly, mozilla is now an adtech company ( https://www.adexchanger.com/privacy/mozilla-acquires-anonym-... ) and by default firefox now collects your data to sell to advertisers. We can expect less an…
What would be an acceptable revenue model? Google Chrome has the same privacy profile with the exception that Google retains the data for their own ad platforms. Selling preferential search access is legally precarious due to FTC's lawsuit against Mozilla.
Earlier quoted context omitted.
Presumably this affects all electron apps which embed chrome too? Don’t they pin the chrome version?
Yes, but it's only a vulnerability if the app allows rendering untrusted HTML or visiting untrusted websites, which most Electron apps don't.
Maybe Chromium should also rewrite their rendering engine in Rust ;p
Earlier quoted context omitted.
did you also take poland being omitted to be some sort of conspiracy? seems you missed the point of why that "Actually, you forgot..." moment became such a punchline. Like it or not Brave is a very niche browser with rather insignificant market share why you would expect them to be mentioned in the first place is entirely lost on me. there are dozens of chromium forks also with under 1% market share, should we be for…
It semeed to me like an obvious telegraph of bias. I understand the meme very well. What made the Poland meme was that Poland's membership in the coalition was irrelevant to the "grand coalition" narrative--Kerry's omission of Poland is therefore in the same vein as Google's.
And just to get ahead of it, I sure hope you are not tempted to make an equivalency between a Polish death and not mentioning Brave in a vain effort to resuscitate your position. Because not only would that be extremely misplaced given you provided the clumsy reference in the first place, but Kerry's point in of itself doesn't negate that. You can both understand any life lost is a tragedy while also understand there is no "grand coalition" when the United States shares > 90% of the costs. Just like (even though again, these things should not be compared, but just to indulge the comparison you yourself invoked) maybe Brave or some other under 1% fork does some good things, but that doesn't mean it is relevant to list them for this kind of announcement or any time chromium comes up.
Honestly I have no idea what you're trying to say. Following the allusion to the meme you brought up would be to realize that saying "Actually, you forgot about Brave" is a funny thing to say because its irrelevant and thus a dumb thing to say. It seems you understand there is a joke being made here but perhaps don't realize you're on the wrong side of it.
Earlier quoted context omitted.
I don't think you know anything about how these industries work and should probably read some of the published books about them, like "This Is How They Tell Me The World Ends", instead of speculating in a way that will mislead people. Most purchasers of browser exploits are nation-state groups ("gray market") who are heavily incentivized not to screw the seller and would just wire some money directly, not black marke…
I mean, you're still restricted to selling it to your own government, otherwise getting wired a cool $250k directly would raise a few red flags I think. And how many security researchers have a contact in some government-sponsored hacking company anyway? Do you really think that convincing them to buy a supposed zero-day exploit as a one-off would be easy? Say you're in the US. I'm sure there are some CIA teams or wh…
Earlier quoted context omitted.
Yeah, but lets keeping downplaying use-after-free as something not worth eliminating in 21st century systems languages.
I love rust but honestly I am more scared about supply chain attacks through cargo than memory corruption bugs. The reason being that supply chain attacks are probably way cheaper to pull off than finding these bugs
Memory safety related security exploits happen in a steady stream in basically all non-trivial C projects, but supply chain attacks, while possible, are much more rare.
I'm not saying we shouldn't care about both issues, but the idea is to fix the low hanging fruit and common cases before optimizing for things that aren't in practice that big of a deal.
Also, C is not inherently invulnerable to supply chain attacks either!
Earlier quoted context omitted.
> What would be an acceptable revenue model? They could start with the one they've refused for ages even though many have asked for it. Let people directly donate to fund the development of firefox (as opposed to just giving mozilla money to funnel into any number of their other projects). They could even make money selling merch if they didn't tank the brand. Firefox could have a very nice niche to fill as a privacy…
Well said. Do you know of any recent reports or if anyone has actually gone through the funding calculations regarding the funding model you described (let’s call it “FF-direct”) versus Mozilla’s status quo funding model? Primary questions are: How much does FF cost to sustain? How much is spent on new performance, functionality and feature development? What number does Firefox need to compete directly with Chrome? I…
Looking around I find https://stateof.mozilla.org/ledger and https://assets.mozilla.net/annualreport/2024/mozilla-fdn-202... which might help answer some of those questions.
As for competing with chrome, I don't think they need to. Most people's only computer these days is an android phone and chrome is always going to be a first class citizen there. We saw the same thing with IE when windows was the operating system most people used.
It's perfectly fine for Chrome to be the default browser for the common people leaving firefox to be the preferred choice of the computer savvy. Firefox could slowly gain an audience as people start to become more aware of how chrome violates their privacy or as they seek relief from the worsening cesspool of ads chrome is encouraging the internet to become, but firefox never has to be number 1 or anywhere close to that in order to be successful and valued.
Earlier quoted context omitted.
Chromium is pretty aggressively fuzzed. There aren't a lot of dark corners that can't be reached via a sufficiently aggressive fuzzer.
Not sure about that one. Fuzzers have a hard time creating certain narrow preconditions that a manual review can find.