Hacker News Reader

Comment by concinds | Hacker News Reader

This is slightly outdated now, but here's the GrapheneOS explanation for why they don't recommend Firefox, and why they bundle Chromium-based forks instead.

https://grapheneos.org/usage#web-browsing

It's basically universally agreed among security people that Firefox is less secure than Chrome. It's up to you to decide is it's likely Mozilla's caught up in the (year?) since this was written,. Or if they'll ever be able to catch up, with their current funding, compensation packages, the size of their workforce (750 employees?), their hiring attractiveness to top security researchers, and their management priorities.

View on HN

There are more factors affecting your safety as a user: how popular a target is the app? Eg a Linux desktop is thought to be less likely to get a malware infection than a Windows desktop, even though Windows has more security investment and attention and mechanisms (antivirus, quarantined files, etc) to defend against this. The same reasons might apply: Firefox too has a smaller market share and more discerning user base, so less attractive to target at least for mass malware.

We're reduced to reasoning like this because we've in browser security apathy.

If only there was a browser that wasn't implemented by juggling chainsaws like this... It's ridiculous that we have been unable to just fire all the these apps for sane reimplementation. Feeding hostile internet content to millions of lines of unsafe code day in, day out on billions of user devices would sound like a ridiculous idea if it were invented today.

> It's ridiculous that we have been unable to just fire all the these apps for sane reimplementation

It is unfortunately nigh impossible to reimplement the web with its gigantic scope.

It's easy to get daunted at least.

A realistic scenario could be something along the lines of: get content onboard by securing some buy-in from some heavyweights, for a reduced feature set. Maybe convince a incumbent browser vendor or two to also provide a safer kernel for that content profile. Then targeting that feature set with the new implementation, and supporting a compatibility mode fallback to a legacy rendering engine for other web content. (VM-based or remote cloud based sandboxed rendering for the fallback?)

But the above would of course have a much better chance of taking off if there was a promising start of an implementation first, so it's not necessarily a reason to wait for the big boys before working on it.

(I wonder if Servo could be a starting point?)

> The same reasons might apply: Firefox too has a smaller market share and more discerning user base, so less attractive to target at least for mass malware.

Firefox is Tor Browser which is the most attractive target by far for 0 days. 0 days are often not targeted to a single individual anymore but are commonly used "in the wild" against mass targets, e.g. everyone who browses a political dissident website.

This sounds like a plausible factor but on the other hand, people who use Tor might be more security conscious and/or tech savvy, frequently run in a sandbox VM - and those unpatched vulnerabilities might get burned sooner if used on them. Any evidence or data would be interesting to see of course.

That seems to be quite focused on the situation with Firefox on the Android/Graphene environment.

>It's basically universally agreed among security people that Firefox is less secure than Chrome.

A reference would be nice here...

The biggest issue is that Firefox on Android runs all websites in the same process.

https://bugzilla.mozilla.org/show_bug.cgi?id=1565196

Another example, third party Chromium builds like Vanadium or Mulch also go further and enable CFI on Android (still default disabled upstream last I checked).

Chrome also has what, at least from the outside, looks like a little more refined mitigations for WebGL.

That said, both browsers have huge attack surfaces. The best you can do for any of them is to disable WebGL, WebRTC, WebUSB etc. completely and only enable the ones you need. This does much more for your security when browsing the web than the differences between browsers.

The plugins for Firefox to expose this functionality have at least traditionally been a little bit more user friendly.

Opt-in javascript functionality would be the next step.

I maintain configs for both to do just that!

https://gitlab.com/divested/brace/-/blob/master/brace/etc/ch...

https://gitlab.com/divested/brace/-/tree/master/brace/usr/li...

Related: Mozilla fired parts of their security team (though likely not the people directly responsible for securing the browser) - https://news.ycombinator.com/item?id=24128865

Quote from one of the tweets confirming it: "They killed entire threat management team. Mozilla is now without detection and incident response."

The thing i’m still trying to understand is why Mozilla management is so hell bent on crippling their flagship product? RIP Servo, among other forward looking technologies.

Follow the money?

But according to your own link, it was confirmed that they didn't do that? Did you mean to link to something else?

They fired part of their security team, namely the entire security response and threat management teams, according to that link and the linked tweets. They still have some security team left.

I have been dragging my feet on leaving Firefox for security reasons for so long, and just now I have come to terms with how ridiculous that is.

I’ve known about the security team, and I remember hearing that even prior to that, a CTF event had banned Firefox exploits as too easy.

I am doing it next time I open my work laptop. I mean what is the single most important class of features in a browser? Security. I feel dumb for waiting so long.

This makes me sad. I was emotionally invested invested in Mozilla and that caused an error in judgment.

I would also like to point out that I would absolutely pay $5/month via something like a Patreon which funded an organized group of security minded devs to work on Firefox security issues.

It's not a money issue. It's money allocation problem. Mozilla has plenty of money they just don't care about security that much. They care more about Pocket and other useless junk that probably nobody, but they care about.

I use Firefox, but only because of "browser diversification" and privacy. Other options are worse not because Firefox is a superior product. It's sad really.

Yeah, I have to say that this is the only tech product that I am very emotional about at this point in my life. I want Firefox to win so bad, even now, as I’m leaving it.

But I feel like I would be doing a disservice to myself, and my employers, by continuing to use a less secure browser, just because I’m religious about Mozilla.

Turns out I was thinking of pwn2own in 2016 [0]. Can anyone update me on how Firefox does these days at CTFs?

[0] https://it.slashdot.org/story/16/02/12/034206/pwn2own-2016-w...

Reply on news.ycombinator.com