Ask HN: Firefox vs. Chrome security

#1

Post by nsudio » Wed, Nov 15, 2017, 4:11 PM UTC

I'm seeing a lot of hype surrounding Mozilla's recent release of Firefox Quantum - which promises massive improvements, mainly speed.

Looking past the speed aspect, where does FF stand against Chrome? Does Rust offer much better security? AFAIK Chrome is gold standard in sandboxing...does this still hold true?

Re: Ask HN: Firefox vs. Chrome security

#2

Post by nwah1 » Wed, Nov 15, 2017, 4:18 PM UTC

One of the exciting new features is the beginnings of a formally verified cryptography stack.

https://blog.mozilla.org/security/2017/09/13/verified-crypto...

Re: Ask HN: Firefox vs. Chrome security

#3

Post by beaconfield » Wed, Nov 15, 2017, 4:22 PM UTC

From what I understand about Rust, it does offer some native security improvements.

Re: Ask HN: Firefox vs. Chrome security

#4

Post by nwah1 » Wed, Nov 15, 2017, 4:25 PM UTC

beaconfield wrote: post #3

From what I understand about Rust, it does offer some native security improvements.

Apparently about a third of browser security vulnerabilities can be traced to memory safety issues. So, yes.

Re: Ask HN: Firefox vs. Chrome security

#5

Post by prohor » Wed, Nov 15, 2017, 4:28 PM UTC

The release is also improving sandboxing for Linux:

https://www.bleepingcomputer.com/news/security/firefox-57-br...

Sandboxing for Windows was introduced in version 54.

Re: Ask HN: Firefox vs. Chrome security

#6

Post by AdmiralAsshat » Wed, Nov 15, 2017, 4:28 PM UTC

Firefox has been a low-priority target for a couple years due to its waning user-base. In fact, Firefox wasn't even at Pwn2Own 2016 because hackers didn't think it was worth their time[0].

Hopefully with Quantum and a resurge in popularity, it'll become a target of white-hat hackers again.

[0] http://www.eweek.com/security/pwn2own-hacking-contest-return...

Re: Ask HN: Firefox vs. Chrome security

#7

Post by 3ds » Wed, Nov 15, 2017, 4:29 PM UTC

My understanding is, that Firefox Quantum is not faster due to any additional rust parts, but because the team focused on performance optimization across the entire codebase.

The only big rust component was introduced a couple of releases ago: Stylo.

Once Webrender is in Firefox, a serious chunk of Firefox will be written in Rust.

Re: Ask HN: Firefox vs. Chrome security

#8

Post by icen » Wed, Nov 15, 2017, 4:29 PM UTC

nwah1 wrote: post #4

beaconfield wrote: post #3

From what I understand about Rust, it does offer some native security improvements.

Apparently about a third of browser security vulnerabilities can be traced to memory safety issues. So, yes.

But how many of them come from the rendering engine?

Re: Ask HN: Firefox vs. Chrome security

#9

Post by bkor » Wed, Nov 15, 2017, 4:32 PM UTC

icen wrote: post #8

nwah1 wrote: post #4

Earlier quoted context omitted.

Apparently about a third of browser security vulnerabilities can be traced to memory safety issues. So, yes.

But how many of them come from the rendering engine?

They're slowing replacing more and more code with Rust. So eventually Rust will have a much bigger impact.

Re: Ask HN: Firefox vs. Chrome security

#10

Post by styfle » Wed, Nov 15, 2017, 4:41 PM UTC

AdmiralAsshat wrote: post #6

Firefox has been a low-priority target for a couple years due to its waning user-base. In fact, Firefox wasn't even at Pwn2Own 2016 because hackers didn't think it was worth their time[0]. Hopefully with Quantum and a resurge in popularity, it'll become a target of white-hat hackers again. [0] http://www.eweek.com/security/pwn2own-hacking-contest-return...

Are there historical records for number of "critical" vulnerabilities found in browsers? It would be interesting to compare the number for different browsers.

Update Maybe this:

http://www.cvedetails.com/product/15031/Google-Chrome.html?v...

http://www.cvedetails.com/product/9900/Microsoft-Internet-Ex...