Hacker News Reader

Comment by therealmarv | Hacker News Reader

Firefox is not even looked at pwn2own competition because it's too easy to hack and not using good OS or sandbox protection https://it.slashdot.org/story/16/02/12/034206/pwn2own-2016-w...

View on HN

After an absolutely massive engineering effort to make the browser multi-process, Firefox is starting to roll out OS-level sandboxing with Firefox 50.

https://blog.mozilla.org/futurereleases/2016/12/21/update-on...

The statement quoted in Slashdot is really unfair.

Not at the time it was made. This blog post is from December, the slashdot post from February. The feature wasn't even being rolled out until August. We'll see what happens at the next Pwn2Own...

The underlying engineering effort (e10s) was well underway by that point in February.

E10s has been underway for years though.

So does Firefox have security sandboxing on my Mac nowadays? No...

OS-level sandboxing for the content process is enabled for macOS as of Firefox 52, which is the current release on the Developer Edition (Aurora) channel and will be rolling out to stable come March. It's currently in stable on Windows and Nightly on Linux. Sandboxing for media plugins is already stable on macOS, Windows, and Linux.

Good to know that this is finally there. I would rather use Safari than a browser without OS sandboxing (which is a no go for me personally).

How do you know with such certainty that it is because it is too easy to hack and not because Chrome is the current "big fish" among browsers and Google gives monetary rewards to white hats, both of which could reasonably fuel disproportionate interest in breaking Chrome?

Reasons aside, the fact remains that when a group of white-hat hackers says they "won't bother" with a given target, it doesn't speak well to that target's security. There are no-doubt tons of exploits in Firefox still waiting to be found, as there are in Chrome, Opera, Edge, etc. Given that the Tor Browser is built on top of Firefox, it's a huge loss for everyone that Firefox is not being included in the attacks; the vulnerabilities that the white-hats find would be reported and promptly plugged, rather than left open for nefarious three-letter agencies to exploit.

> Reasons aside

No. Reasons not aside. Reasons are very important.

If we don't know what the reason was, and they won't elaborate on it, what importance does it have? Pwn2Own 2016 already happened. Firefox wasn't included, for whatever reason. The damage is already done at this point, as its exclusion created the impression that it was "not worth attacking".

If the guys had said, "We didn't bother with Firefox because they weren't willing to pay us as much as Google or Microsoft", okay. But they didn't. What they said was:

'We wanted to focus on the browsers that have made serious security improvements in the last year,' Brian Gorenc, manager of Vulnerability Research at HPE said."

And now Firefox looks weak by comparison.

> If the guys had said

Why would they have said that, even if it were true? What's the upside for them?

I agree the net result is the same whether they were honest or not, of course, which is again why there was no upside for them to say that if it were true.

For what it is worth, Firefox also has a security bounty program, one that is older than Chrome itself. :) Of course, the payouts are smaller than those from Pwn2Own, but on the other hand, reporters don't have to demonstrate a full exploit that can actually execute arbitrary code.

Or maybe it's because Mozilla refused to pay money to the pwn2own organizers (unlike the other browsers)? Hard to say which one is more likely.

But the Safari browser is? And Tor Browser uses Firefox?

It wasn't looked at, because no one paid a bounty for it. And they stated as reason for that, that Firefox simply didn't have any major architectural changes since the last pwn2own, i.e. they probably wouldn't find anything new. If they had expected to find many vulnerabilities, then it would make more sense to target it, as the whole point of these events is to find vulnerabilities, so that they can be fixed.

>It wasn't looked at, because no one paid a bounty for it.

I don't think you understand how PWN2OWN works. And the poster you replied to was right, at the time of PWN2OWN 2016 Firefox was the only browser without a working sandbox. It would have been very easy to compromise it.

Reply on news.ycombinator.com