Hacker News Reader

I heard somewhere that Firefox's security showing was pretty dismal before they introduces e10s with seccomp-bpf sandboxing. The anecdote I heard was that in "hacking competitions" a Chrome vulnerability was worth a serious hunk of cash, Firefox was worth almost nothing because it was too easy. After sandboxing, Firefox RCEs are worth money again. Does anyone know whether this claim is accurate or misleading? I know I've switched back to Firefox because of it.

View on HN

The claim is correct. The security of IE9+, Edge and Chrome is far superior than Firefox. As Geohot said, writing an exploit for Firefox is similar to a harder CTF challenge (done in an day or two). While IE or Chrome Exploits cost a lot. I can back it up with references, but https://www.zerodium.com/program.html shows a pretty clear picture (Scroll down to Payout Ranges). It will take FF like 3-5 years until they have a sandbox as good as the other Browsers, sadly.

I was viewing https://wiki.mozilla.org/Security/Sandbox and it appears that Firefox on Linux now has some kind of sandboxing. I presume it's not as good as Chrome but I'm sure it's raised the security level significantly. Realistically, how much danger am I in by using Firefox?

Reply on news.ycombinator.com