Hacker News Reader

Comment by mhurron | Hacker News Reader

So get Firefox back to where it was, just a browser that supported extensions. Everything beyond core browsing should be an extension or plugin.

I have no use for WebRTC, so I would not install the addon/plugin. You may want it, so you would. When there was a problem with Mozilla's implementation, I wouldn't have to care, and neither would anyone else who didn't use or want it. Only those that chose to have the functionality would need to be concerned, and even then it could be updated without a full browser update.

View on HN

If you want that you can use the Pale Moon browser. It's a very fast, non-bloated, fork of Firefox that has significantly diverged from FF. See https://www.palemoon.org/technical.shtml for details and in particular why they don't support WebRTC.

See https://www.palemoon.org/technical.shtml for details and in particular why they don't support WebRTC.

The real reason is that they are based off of an old ESR and their code wouldn't be able to inter-operate with anything else. Aside from the issue that they're not getting security patches for it, either...

The recommendation to use an external PDF reader is also not quite something I can stand behind. (Unless that external reader is Chrome...)

Sounds like your a bit behind that times. Pale Moon 27 is a rebase from FF 38 which has WebRTC. I'm not sure why we should trust your claims, already shown misinformed, when the developer's page states something else. The PM community is basically in consensus in not wanting WebRTC.

As for external PDF readers I'd argue that avoiding the push for integrating or redeveloping more and more external applications into a browser is very sane.

rebase from FF 38 which has WebRTC

This is a bit like saying "Firefox 4 has HTML5". The WebRTC stack in Firefox evolved significantly from Firefox 38 to 50, as did the WebRTC standards themselves. That's why I pointed to interoperability issues.

ESR38 stopped getting upstream security updates from Mozilla in April of 2016. But I'm sure the Palemoon folks have stayed on top of things since.

Recommending Pale Moon to folks who care about security is foolish. There is a much bigger story and a bit of internet drama around it, but essentially, when I asked the Palemoon project lead about their security program on twitter, he blocked me. The claims that they make that they "inherit" Firefox's security properties is not valid as they introduce significant code changes.

The catch using something like this - while great from many perspectives is that you risk vulnerabilities just due to it not being as popular and as commonly attacked.

So if your threat model includes targeted attacks, where an attacker might invest some (even a small) level of effort to find a 0-day vulnerability, I don't think I'd use it.

With Pale Moon the largest risk is that as far as I know the ESR branch they forked away from no longer gets security patches from Mozilla.

So you probably don't need to do effort to find a 0-day, just browse old Mozilla CVE disclosures.

I'm sure they at least attempt to patch these, but it's often all too easy to screw up a patch and leave some part of the vulnerability still exposed. Look at what happened when Google tried to patch the stagefright vulnerability.

Again with the FUD? I've witnessed the last couple big 0-day discovered by the Tor people were patched in Pale Moon before Mozilla pushed out theirs for Firefox.

edit: I'd reply to your response below normally but apparently I don't get to reply to any comments on HN anymore. The reply button has disappeared. When I log out of my 5 year old/458 karma account it's back. I guess my opinion isn't wanted here.

You have a good point there. I bet a least a couple of those are present. But you've also completely missed my point. When looking through the FF known vuln list the vast majority are for things like WebRTC, WebGl, and other attack surfaces that Pale Moon intentionally avoids.

The whole point of my post, which you seem to have completely and utterly missed, was that you don't need 0-days for exploiting Pale Moon. Every single Mozilla CVE published from Firefox 38 to Firefox 50 is potential issue for it. The amount of 0-days in there is exceedingly low, but amount of CVE is very high, because Mozilla publishes CVEs for security bugs they find themselves. AFAIK Google also does this, but Microsoft doesn't.

This isn't FUD. You can literally go read the list:

https://www.mozilla.org/en-US/security/known-vulnerabilities...

I count over 174 fixed vulnerabilities and stopped at version 48. Yes, some of these might not apply to Pale Moon because they're new vulnerabilities or it has the relevant feature disabled. You think anyone did the work to go through them all? Let alone backport the ones that are relevant?

Mozilla used to do this work for Pale Moon by virtue of still backporting the most important ones (i.e. not all) to ESR38. Not any more. Good luck!

the vast majority are for things like WebRTC, WebGl, and other attack surfaces that Pale Moon intentionally avoids

Pale Moon supports WebGL nowadays. It's needed for a few things like Google Maps to not suck. Of course, the implementation is outdated, which is perhaps what made you think it's not there...

Pale Moon does not completely ignore these though as you seem to be suggesting, they indeed do at least try to patch these.

And I'm betting most of the time they succeed. There may be a few weird ones with edge cases that they've screwed up though and some subset of the vulnerability is still possible.

Scroll through Mozilla's security announcements, pick ones at random, find the patch that fixed it and see if it ever got applied to Pale Moon. In many cases they haven't.

I have pointed out many of these and argued with Pale Moon devs about it. "Moon Child" believes they don't need to apply patches if they can't replicate the PoC from Mozilla's bugzilla.

These are things that are obviously vulnerable and need to be fixed (such as missing bound checks in the XML parser).

If someone ever cared enough to target Pale Moon users they would have an absolute field day with all the known Firefox vulnerabilities they could use.

The reply button has disappeared.

HN delays the visibility of the reply link on threads that seem to be getting too deep too quickly.

At that point you should basically only be using the hardened tor browser based off (currently) Firefox 38. https://blog.torproject.org/blog/tor-browser-65a6-hardened-r...

If your threat model includes targeted attacks I'd have serious doubts even about using Curl.

Reply on news.ycombinator.com