Ask HN: Is Firefox better than Chrome when it comes to user security?

You should really do your research.

You haven't been blocking them, because iOS with Safari didn't allow that.

Hiding, and blocking, are not the same thing. The former is far less secure than the latter.

As for blocking ads on iOS with Brave, well, it really doesn't work that well[0]. Why? Because iOS doesn't let you block ads, unless you are in the EU and on 17.4 or later.

You should exit the RDF and really do at least a bare minimum of research.

[0] https://community.brave.com/t/is-brave-even-blocking-ads-on-...

imo having a much smaller market share disincentivize exploiters for searching ways to attack browsers like firefox. this is the same argument used for the aforementioned os. it is very optimistic to assume that either sides are able to fix all vulnerabilities, as both have been shown to have 0-days recently.

on the other hand, just like in linux, you need to trust the developers publishing extensions as i don't find moderation quite as competent as google's (even though theirs is also very lacklusture overall).

Let's agree that we disagree. I'll just say that I work for a cloud provider and non-x86 servers are anecdotal :) but their media presence is not, as it's the new hot thing and that's free advertising.

> developers, sysadmins: tend to have the hardest configs and thus making it a lot more difficult to hack.

yet those people have a cognitive bias of "i'm too smart to fall". and those people will have some practices that are so detrimental to security it's laughable. how many developers will shutdown their laptop every day after work? compare this to the common practice of "just go to sleep" which will prevent browser updates, system updates, kernel updates, you name it. take a firefox that is months old with an unpatched ubuntu and you get the idea ground for a browser escape combined with an lpe. and even without lpe you'll grab many many credentials.

imho those still are harder to trick, but not because the config is hardened, but because there is a config at all. for example a phishing that imitates a floating browser window with a fake login page would not work on me. not because i'm smart, not because my config is hardened or whatnot, but because good luck to the scam for finding the specific window decorations I have on my linux system. oh, and the fact that I use a tiling wm and thus floating windows don't exist. it's a side effect of nerds being nerds.

> So, afaik, most of the hacks on this areas are more due to human flaws than the systems per se.

This is not incompatible. "normies" will get tricked in downloading invoice.pdf.exe, but that's windows only. The payout for invoice.pdf.sh or whatever may be very high, but you need your rat or stealer or whatever to know linux.

> unless ... they are targeting the servers managed by those devs and sysadms

That was the precise reason I talked about devs and sysadmins. Infrastructure credentials, aws keys, you name it.

And as a dev/sysadmin, you don't need targeted attacks to get pwned. A malicious package on npm/gems/cargo is all it takes. It's a spray and pray strategy, but if you catch even a handful of people this way it might be the jackpot.