Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Choose Firefox Now, or Later You Won't Get a Choice (2014)

robert.ocallahan.org

Post reply on HN
Print view View original

311–320 of 343 posts

Re: Choose Firefox Now, or Later You Won't Get a Choice (2014)

#311

Post by jolmg »

tomc1985 wrote: post #281
nindalf wrote: post #9

Just so we can avoid rehashing the discussion whenever a post encouraging the use of Firefox is posted. - Yes, Mozilla is still the better browser when it comes to privacy. - Yes, Mozilla has made missteps with Pocket and Mr. Robot. - Yes, it is slow/resource heavy on certain Macs with non-default resolutions. Yes, Mozilla is working on a fix. - Yes, it has become really fast for most users after Quantum improvements…

"- No, you can't just "fork Chromium" if you don't like the way Google is running the project. Web developers will still make their website work well with whatever Google releases, regardless of standards." Hah, even compiling Chromium takes a huge amount of effort and a workday or so of time. Don't think I'd want to go spelunking through that codebase

I would imagine that compiling Firefox is just as difficult.

Re: Choose Firefox Now, or Later You Won't Get a Choice (2014)

#312

Post by saagarjha »

lern_too_spel wrote: post #217
saagarjha wrote: post #103

Earlier quoted context omitted.

Android doesn't do codesigning, at least in the way that iOS does: on iOS, all code that executes must be signed and approved by Apple before it is allowed to be loaded by the OS into memory (with some exceptions e.g. Safari). JIT gets around this because applications can now generate and execute arbitrary code, which is obviously something that Apple doesn't want. So this basically means that you are not allowed to…

It is a result of Apple's broken security model. On Android, generated code has no more provoleges than the code that generated it, just like interpreted code.

> On Android, generated code has no more provoleges than the code that generated it, just like interpreted code.

This is true on iOS as well, just it is on almost every other operating system: you don't get to expand your privileges by being able to generate code because said code still runs in your process. There's no "broken security model" here; in a sense iOS has a much stronger security model than Android does because all code that gets executed can be statically verified beforehand.

Re: Choose Firefox Now, or Later You Won't Get a Choice (2014)

#313

Post by lern_too_spel »

saagarjha wrote: post #312
lern_too_spel wrote: post #217

Earlier quoted context omitted.

It is a result of Apple's broken security model. On Android, generated code has no more provoleges than the code that generated it, just like interpreted code.

> On Android, generated code has no more provoleges than the code that generated it, just like interpreted code. This is true on iOS as well, just it is on almost every other operating system: you don't get to expand your privileges by being able to generate code because said code still runs in your process. There's no "broken security model" here; in a sense iOS has a much stronger security model than Android does b…

> in a sense iOS has a much stronger security model than Android does because all code that gets executed can be statically verified beforehand.

The code generator can be statically analyzed in the same way that an interpreter can. The security model is broken in the sense that it applies a wholly unnecessary restriction on apps, which means not only can you not have your own fast JavaScript engine on iOS but you can't have fast emulators or run other languages fast on the device either.

Re: Choose Firefox Now, or Later You Won't Get a Choice (2014)

#314

Post by saagarjha »

lern_too_spel wrote: post #313
saagarjha wrote: post #312

Earlier quoted context omitted.

> On Android, generated code has no more provoleges than the code that generated it, just like interpreted code. This is true on iOS as well, just it is on almost every other operating system: you don't get to expand your privileges by being able to generate code because said code still runs in your process. There's no "broken security model" here; in a sense iOS has a much stronger security model than Android does b…

> in a sense iOS has a much stronger security model than Android does because all code that gets executed can be statically verified beforehand. The code generator can be statically analyzed in the same way that an interpreter can. The security model is broken in the sense that it applies a wholly unnecessary restriction on apps, which means not only can you not have your own fast JavaScript engine on iOS but you can…

> The code generator can be statically analyzed in the same way that an interpreter can.

Unless the state of static analysis has somehow changed significantly without me realizing it, no, this does not help at all. While I can (to some extent) verify the code in the code generator itself, I cannot verify that the code generator will not generate arbitrary code unless it lists out all the code it can possibly generate, in which case it's, well, an interpreter. The task of verifying program behavior is now shifted from static analysis on a compiled binary to dynamic instrumentation of a running program, which is much harder to do.

Re: Choose Firefox Now, or Later You Won't Get a Choice (2014)

#315

Post by Const-me »

I never started to use Chrome.

If/when MS Edge will switch to Blink, I'll indeed switch to FF. Until then I prefer MS Edge: performance, font rendering, OS integration (e.g. video codecs) are IMO better in MS Edge.

Couple months ago I had to downgrade one of my PCs to Win7 (a client wanted me to develop for it), I used Firefox on that PC. Worked great.

Re: Choose Firefox Now, or Later You Won't Get a Choice (2014)

#316

Post by sometimesijust »

jolmg wrote: post #311
tomc1985 wrote: post #281

Earlier quoted context omitted.

"- No, you can't just "fork Chromium" if you don't like the way Google is running the project. Web developers will still make their website work well with whatever Google releases, regardless of standards." Hah, even compiling Chromium takes a huge amount of effort and a workday or so of time. Don't think I'd want to go spelunking through that codebase

I would imagine that compiling Firefox is just as difficult.

Firefox is much easier and faster to compile but still complicated enough that you need to follow their build guide. Chromium is held back by Google's overzealous build systems that assume everything is built on a unified build server and permanently cached somewhere on their corporate network which results in actual build times being unoptimized.

Re: Choose Firefox Now, or Later You Won't Get a Choice (2014)

#317

Post by ekianjo »

dao- wrote: post #261
Karunamon wrote: post #214

Earlier quoted context omitted.

Meaning the nontechnical set of users that don't go out of their way to disable telemetry, at least...

If you disable telemetry, Mozilla won't know about you. If you want Mozilla to cater for you, don't disable telemetry?

Telemetry should never be enabled by default without consent. Its a dark pattern.

Re: Choose Firefox Now, or Later You Won't Get a Choice (2014)

#318

Post by lern_too_spel »

saagarjha wrote: post #314
lern_too_spel wrote: post #313

Earlier quoted context omitted.

> in a sense iOS has a much stronger security model than Android does because all code that gets executed can be statically verified beforehand. The code generator can be statically analyzed in the same way that an interpreter can. The security model is broken in the sense that it applies a wholly unnecessary restriction on apps, which means not only can you not have your own fast JavaScript engine on iOS but you can…

> The code generator can be statically analyzed in the same way that an interpreter can. Unless the state of static analysis has somehow changed significantly without me realizing it, no, this does not help at all. While I can (to some extent) verify the code in the code generator itself, I cannot verify that the code generator will not generate arbitrary code unless it lists out all the code it can possibly generate…

It is trivial to prove that anything that a code generator can emit can be translated into something that an interpreter can interpret. Run the generated code through an interpreter. QED.

Re: Choose Firefox Now, or Later You Won't Get a Choice (2014)

#319

Post by mito88 »

nindalf wrote: post #9

Just so we can avoid rehashing the discussion whenever a post encouraging the use of Firefox is posted. - Yes, Mozilla is still the better browser when it comes to privacy. - Yes, Mozilla has made missteps with Pocket and Mr. Robot. - Yes, it is slow/resource heavy on certain Macs with non-default resolutions. Yes, Mozilla is working on a fix. - Yes, it has become really fast for most users after Quantum improvements…

yes, sir!

Re: Choose Firefox Now, or Later You Won't Get a Choice (2014)

#320

Post by saagarjha »

lern_too_spel wrote: post #318
saagarjha wrote: post #314

Earlier quoted context omitted.

> The code generator can be statically analyzed in the same way that an interpreter can. Unless the state of static analysis has somehow changed significantly without me realizing it, no, this does not help at all. While I can (to some extent) verify the code in the code generator itself, I cannot verify that the code generator will not generate arbitrary code unless it lists out all the code it can possibly generate…

It is trivial to prove that anything that a code generator can emit can be translated into something that an interpreter can interpret. Run the generated code through an interpreter. QED.

> It is trivial to prove that anything that a code generator can emit can be translated into something that an interpreter can interpret.

That's not what we are trying to prove, though; we're trying to show that the generated code does not perform certain undesirable operations. this is much harder to do with dynamically generated code than static code.

Post reply on HN