Hacker News Reader

Comment by enkid | Hacker News Reader

But these are attacks that worked across multiple systems. Heterogeneity is going to lead to more systems with less overall security work being done per system. Sure, using Firefox would have prevented the attacks we know about, but who's to say Google found all of the attacks. They exploit Chrome, Samsung browser, Windows, Android, iOS, and Safari. It seems silly to say "if we had one more, it would have stopped them."

View on HN

> They exploit Chrome, Samsung browser, Windows, Android, iOS, and Safari. It seems silly to say "if we had one more, it would have stopped them."

Samsung's browser and Chrome share 100% of attack surface; Safari and Chrome share likely near 70%. Windows and Android have Chrome built-in at the OS layer, iOS has Safari built in at the OS layer.

In this case, something like Firefox which shares much less attack surface would in fact solve the problem, because the problem is that other things have Chrome at the OS-level.

> Safari and Chrome share likely near 70%

This is wrong. I'd say it's more like 5%. Blink forked from WebKit 7 years ago and development has been very active on both sides since then. And probably the majority of the attack surface is outside Blink/WebKit proper to start with (e.g. JS engine, font libraries, media decoding, networking, etc).

The JS engine is part of Blink and WebKit, but yes, they are essentially entirely different.

I don't know about JSC, but V8 is very much a standalone project. I guess you could define it as just part of Blink but I don't think that's a very useful definition.

>Windows and Android have Chrome built-in at the OS layer

How is Chrome built into Windows at the OS layer? Wouldn't that be IE or Edge?

Edge is now Chromium based and soon Edge-Chromium webviews will ship with the OS. The old IE/Edge webviews will remain for legacy but they'll eventually get stripped.

> Edge

I think that's OP's point. Edge uses chromium.

Reply on news.ycombinator.com