Hacker News Reader

Comment by cptskippy | Hacker News Reader

I don't think you understand what you're complaining about. Each browser has had different types of sandboxing. IE's approach is to run the whole process (just the one) in PE mode. Chrome goes a step further and sandboxes each tab to its own process. Safari just sandboxes plugins. Firefox, prior to Electrolysis, sandboxes JavaScript, Media Playback containers, and Plugins. Post Electrolysis it does processes as well.

View on HN

It's the lack of defense in depth which I would say is disappointing more than anything. Firefox prior to e10s pretty much ran everything save for NPAPI plugins in the same process. Perhaps it is "sandboxed" in the code but in practice I'm not sure you could call it a sandbox from the defense in depth standpoint. Simply running stuff in a separate process doesn't count for much if the separate process is not restricted in any way.

When you contrast it with Chrome which uses basically every single operating system mitigation in addition to their sandboxing and the difference really is striking.

I'm looking forward to the future of e10s Firefox since it now enables them to move forward with more advanced security mitigations and better defense in depth. I believe Mozilla released a plan for the future of these things which it showed what they wanted to do step by step (e.g. plugins first, etc).

I believe Mozilla released a plan for the future of these things which it showed what they wanted to do step by step (e.g. plugins first, etc).

Flash and Media Plugins (video decoders, EME/DRM) have already been sandboxed for several releases. There is a content sandbox in the development versions of Firefox. Of course it won't ship before e10s is considered stable, because that's a hard prerequisite for it. The amount of protection also varies by operating system (Windows and Mac OS X are pretty OK, Linux is still pretty crappy) but obviously that is improving week by week.

> Flash and Media Plugins (video decoders, EME/DRM) have already been sandboxed for several releases.

Firefox provides its own sandboxing now? Flash used to use a subset of the Chrome sandbox for Flash but that was restricted to the 32-bit version of the browser. As far as I was aware Firefox just ran it in the plugin-container processes for crash protection and nothing else (if protected mode wasn't being used or if you were on 64-bit Firefox). Does Firefox now make use of OS mitigations and integrity levels for sandboxing the plugin process?

Like you say, Adobe's Flash sandbox (aka "Protected Mode", based on Chrome's sandbox library) only supports 32-bit Windows. Mozilla wrote its own plugin sandbox for 64-bit Windows because we didn't want to Firefox users to lose sandboxing just because they switched from 32-bit to 64-bit. Adobe's and Mozilla's sandboxes don't use all the same mitigations and some Flash content is currently broken in 64-bit Firefox.

Here is the Firefox bug tracking the 64-bit sandbox work:

https://bugzilla.mozilla.org/show_bug.cgi?id=1165891

> Perhaps it is "sandboxed" in the code but in practice I'm not sure you could call it a sandbox from the defense in depth standpoint. Simply running stuff in a separate process doesn't count for much if the separate process is not restricted in any way.

Exactly this.

By that definition Chrome is the only browser that sandboxes. But your comment was on how ridiculous it was that Firefox was the only one not doing it.

People's hate of Mozilla is very similar and as misguided as their hate for Microsoft and it really shows in your original statement that they can do no right.

Instead of a congratulatory "welcome to the club (of one)", it's "why weren't you a member all along?"

> By that definition Chrome is the only browser that sandboxes.

I believe most Chromium based browsers could also fall under that category although I admit that's just being pedantic.

Furthermore at least Edge and to the lesser extent IE(11) do have some sandboxing which purpose is to enhance security. Their (renderer) processes do run at a low integrity level and are ran within an Appcontainer. On IE11 this is enabled through the use of Enhanced protected mode with 64-bit processes. This allows it to use AppContainers even with the desktop browser. Edge always uses AppContainers AFAIK.

I'm not sure it's sandboxed to the same extent as Chrome but it is a level of defense in depth. Edge also uses some security mitigations that Chrome does not such as CFG (control flow guard) although that's not dependent on a sandbox so CFG, baring performance issues, could be used in any browser sandboxed or not.

Are you not aware of how Safari works?

https://trac.webkit.org/wiki/WebKit2

I am, would you like to clarify whatever point it is that you're trying to make?

Why are you claiming that Safari uses a single process for everything except plugins?

I was talking about sandboxing. Multi-process rendering is not the same thing and does not intrinsically sandbox an app or make it more secure.

But Safari uses multiple processes and sandboxes those processes. You keep claiming that there is some difference between it and Chrome but you can't say what it is.

Safari is a sandboxed app but that covers everything, I have never read about individual process level sandboxing in Safari beyond the plugin sandbox. Are they using XPC or did they roll something custom?

WebProcess does have its own, more restrictive sandbox, although it's not as tight as Chrome's:

https://github.com/WebKit/webkit/blob/master/Source/WebKit2/...

For IPC they use something custom (part of the WebKit repo) called "CoreIPC".

That makes sense given that it's open source.

> Safari just sandboxes plugins

That hasn't been true for at least 5 years. Safari has used a sandboxed, multi-process architecture for Web content since version 5.1.

My understanding is that kernel level sandboxing in OSX is per application, not per process unless you dispatch XPC services. Does Safari utilize XPC for rendering? If not then the processes aren't sandboxes from on another unless by some mechanism internal to Safari, which is entirely possible.

I was referring to the internal sandboxing Safari does to isolate plugins from everything else.

> Does Safari utilize XPC for rendering?

Web content and plug-in processes are XPC services, yes.

IE does process isolation too since IE 8, not just relying on low-integrity mode for a single process.

The IE process has run in protected mode since IE7. In 10 they introduced enhanced protection mode and AppContainer sandboxing.

The multiprocess architecture in IE8 isn't an isolation layer as the browser can and does frequently render multiple tabs under the same process. It's not uncommon to hear reports of 40 processes for 2 tabs or 40 tabs for 2 processes.

Reply on news.ycombinator.com