Hacker News Reader

Comment by dimdimdim | Hacker News Reader

Firefox created the revolution of "better browsers"! Google was smart enough to have market their own browser by having themselves be the default search on it. Once you land on Google, the "install Chrome for a better experience" slowly had people move to it.

View on HN

>the "install Chrome for a better experience" slowly had people move to it.

No, people moved to Chrome because it was a much better product.

Only before Firefox optimized its JS engine to bring it to par.

Firefox's security is still nowhere near up to par, unfortunately.

156 CVEs in Firefox this year compared to 133 in Chrome. Worse, but not ‘nowhere near up to par’.

Some relevant, interesting, material on counting CVEs:

https://plus.google.com/u/0/+JustinSchuh/posts/CNEgtJWYTb5

http://lcamtuf.blogspot.com/2010/05/vulnerability-databases-...

Good points there, will bear in mind in the future.

CVE counting is a poor proxy for actual security. A browser that does not sandbox its renderers or enforce a permissions model on its extensions cannot reasonably be considered secure in 2015.

> enforce a permissions model on its extensions

Why? Surely as with any software one should only install extensions that one trusts?

You trusted it, but you were wrong

Then neither is Chrome. If you want security you probably want to look into Servo.

No, Chrome has a materially better security architecture than Firefox.

https://seclab.stanford.edu/websec/chromium/chromium-securit...

When it's ready, hopefully Servo will be used as the basis for a browser that can provide security comparable to Chrome. But there's much more to that comprehensive goal than just writing a renderer in Rust.

> But there's much more to that comprehensive goal than just writing a renderer in Rust.

Which is why the latest Servo builds have very strict sandboxing. People assume that Servo's security story is "just write it in Rust and it'll magically be secure". In reality, nobody on the team is that naive. The goal is to create a browser engine that achieves and significantly exceeds the state of the art. The architecture for that exists right now.

The architecture may exist, by Servo as a day-to-day usable browser does not yet. Don't get me wrong; I absolutely look forward to the day that it does.

Neat that they have a sandbox up and running, though. I wasn't aware of that. Is there a paper somewhere I can read about their sandbox architecture?

There is no paper per se, but you can look at the code (including readme) for the sandbox here: https://github.com/pcwalton/gaol

To some people, that may be.

Either way, there's no denying that Google literally spammed Chrome everywhere, and often with misleading or dishonest text.

"Your browser is outdated. Upgrade it now (to Chrome) for a better experience", "Make youtube faster with Chrome" etc etc.

It was literally impossible to go anywhere on the web, without the top of every second screen you visited saying "Upgrade to Chrome". It was massive and it was dishonest.

Ofcourse moms and dads everywhere jumped on this, like they jump on the "free scans" and "you have a virus" messages without ever considering if Chrome was a different browser or there being any technical merit to the claims about being better. Google used the exact same strategy as malware authors.

They even bundled it as a drive-by install with other popular software (like Flash). Update flash and suddenly your default browser is Chrome, which conveniently imported all your Firefox data and now reports all of that to Google, one keystroke at a time.

It's hard not to call this spyware.

Plain and simple: Chrome's marketshare is based on being evil and nothing else.

These days Chrome may feel like a better product, because Google keeps making their pages for Chrome and nothing else, using proprietary Google only extensions.

And that reminds me of a story I've heard before... Something about there E's..?

This ought not to be in past tense. There is still only one ad on www.google.com: "A better way to browse the web..."

While I disagree with "free scans" and "evil", I think you're hitting pretty close to the mark.

Back then, Google's Chrome was still an exciting new thing being discovered by many non-techies, fast and simple. Google seemed like a company dead set on being the good guys.

Things have muddled since, IMHO.

> Back then, Google's Chrome was still an exciting new thing being discovered by many non-techies, fast and simple. Google seemed like a company dead set on being the good guys.

Yea this was pretty odd. Usually all the people around me are the last to switch, because they make their decisions based on "whichever thing they saw first or more prominently". In Chrome's case, I switched quite a while after most of my friends: they all saw Chrome marketed all over the place while I consciously enjoyed a Firefox feature or two that Chrome was lacking. I finally ended up switching when Firefox's incredible slowness made it too painful to keep using (this was around v3.5, I believe).

A spyware? Come on. To my experience it was the clear advantage on the design, security and speed (launch and JS speed). It was way ahead of Firefox or IE. I often asked people why they use Chrome they say it feels faster and not cluttered. Sure commercials helped but IMO, it was the word of mouth made it that popular.

Again: When you bundle it as a unwanted drive-by install and steal users' data, it's hard to not call something spyware.

>'steal users data'

Please. Aren't we all tired of this?

If you download and install App A because you want App A, but unasked App B also gets installed as a paid-for drive-by installation which sets itself as your new default browser, which upon first launch (because its now default) imports all your data, history, bookmarks and passwords from your actual preferred browser and then proceeds to send all this data to App B's vendor without making it clear to you what just happened...

How is that not stealing? How is that different from what we usually call spyware?

There is nothing legitimate about how Chrome has hijacked a multitude of users' PCs and their data. There's no way to defend this behaviour.

"proceeds to send all this data to App B's vendor"

Proof?

It's called "sync" and you can bet everyone who has a Gmail account who gets asked to "log into Google" when Chrome is opened (as their new default browser) will enter their username and password without giving a second thought to it or realizing what they just authorized.

That's ofcourse if they even noticed that their browser now looks slightly different at all.

Voila. Data stolen. Or are you going to argue that this represents completely concentfull and legitimately syncing?

It is entirely optional, and don't fit normal definitions of "spyware".

You mistakenly assume this feature which by default requests your google login for sync will be understood by users as this, when they open their browser and see "Log into google". Much more likely is that your casual user will think they're logging into Gmail.

This is a dark UX anti-pattern, using the same technique as a regular scammer or phishing site.

Google is absolutely, horrifyingly into evil territory here.

I think what Win8.1 does with pushing you to use MS accounts during OOBE is a much worse dark pattern than this.

"I think hanging someone is worse than just giving them poison."

I don't particularly care about this spyware debate but I can't see how something bad being better than something else bad bears any relevance unless we are talking about choosing between two bad options.

The vast majority of "spyware" and "malware" these days has a big long page of EULA legalise that makes the tracking totally optional too.

People clicking the "I agree" button on a EULA is not consent.

Chrome can do client side encryption of your data, which isn't something you can say about the new Firefox Sync.

Source?

Are you perhaps thinking of the currently unused "class-A data"?

https://blog.mozilla.org/services/2014/04/30/firefox-syncs-n...

https://blog.mozilla.org/services/2014/02/07/a-better-firefo...

https://github.com/mozilla/fxa-auth-server/wiki/onepw-protoc...

Edit:

From what I can see, client side encryption in Google Chrome appears to be opt-in?

Are you talking about Chrome browser?

If you say synchronized data in Chrome is being sold to 3rd parties by Google, I would really love to see a proof for this claim.

I'm not saying Google is selling the data.

I'm saying Google shouldn't have the Firefox/MSIE data in the first place, because lots of users never intended to install chrome, but got it as a drive-by installation.

They are the illegitimate third party "stealing" the data.

> They are the illegitimate third party "stealing" the data.

And you still didn't provide any proof of that

> which upon first launch (because its now default) imports all your data, history, bookmarks and passwords from your actual preferred browser

Any source showing that it is put as default browser and imports everything without asking?

I am tired of them stealing user data, yes.

According to wikipedia Google Chrome bundles:

    Randomly generated token included in installer. Used to measure success rate of Google Chrome once at installation.[99]

    Encoded string, according to Google, contains non-identifying information about where Chrome was downloaded from and its installation week, and is used to measure promotional campaigns.[99] Google provides the source code to decode this string.[95] On Google search query On first launch and first use of address bar[99] Optional.

    Unique identifier along with user preferences, logs of usage metrics and crashes. default disabled

    Text typed into the address bar. Optional

    Information about how often Chrome is used, details about the OS and Chrome version. used on update

None of these things are "Stealing users data". From what I can see, you have to go out of your way to even send usage metrics and crashes to Google. All of these tracking metrics are similar, if not identical, to what other major browsers are currently doing.

I think you misunderstand me.

See comment thread here for classification: https://news.ycombinator.com/item?id=10631843

> speed (launch and JS speed). It was way ahead of Firefox or IE.

By the time V8 shipped, SpiderMonkey's TraceMonkey (and not long thereafter JaegerMonkey) was pretty competitive. There were differences between the engines—TraceMonkey fell off fast paths more often while V8 sans Crankshaft had fewer optimizations for tight loops—but they weren't night and day differences.

This is all history, of course. Nowadays, V8 and SpiderMonkey have essentially the same architecture (although as I understand things SpiderMonkey is more unified with the IonMonkey JIT core powering both Baseline and Ion, whereas Crankshaft and non-Crankshaft V8 are more divergent).

Some did. Some people moved to Chrome because they saw ads for it everywhere. Some moved to Chrome because it was bundled with something else they installed (e.g. Flash, Acrobat Reader), with the "make it the default browser checkbox" pre-checked by default.

Google spent a fair amount of money for a few years on marketing and paying all sorts of other software to bundle Chrome as an opt-out.

It's still just a browser and most of the world doesn't care about the intracacies of one browser or the other in determining which is better like more tech savvy people do.

They just want something that works and for most people they were told that that was Chrome, because it was pushed right in their faces from Google Search and whatever other Google services they used. Not to mention all the installers they had it bundled with.

I'm convinced it was 80% advertising that got the average person to install desktop Chrome originally. On mobile I think it was 99% due it being the default on Android. Most people don't change default apps or settings.

No, people moved there because it had multi-million dollar campaign. Ads everywhere from radio, tv, to outdoor posters and billboards is what they had to pay for, and then another millions worth of advertising through ad sense, youtube, google. Still excluding priceless ad positions like mentioned above.

Then there was their active push to eliminate other browser by providing chrome-only experiences. Mostly tech demos and games, but also actively blocking random features in other browsers.

And let's not forget android.

So in short, no, people didn't move there because it was better. You are really overestimating people.

You're probably right, but as a personal anecdote, I switched to chrome when it came out because I felt it was a better browser. The lack of clutter and the significantly faster JS engine made it feel far nicer to me than FF. For I.E. and Safari it wasn't even a competition. That was circa 2008.

Reply on news.ycombinator.com