Hacker News Reader

Comment by ecshafer | Hacker News Reader

Most Government and Corporate security / IT just aren't some awesome hacker or security analyst. Most just follow some corporate flow chart for security. I once worked at a company that allowed IE only as a browser for security reasons, eventually they allowed Chrome, but not Firefox again for security reasons, their reasoning was: Microsoft and Google are Billion dollar companies. If you try and bring some solid open source software, well where is the X certification? Even though just from using the corporate certified software for 10 seconds you can tell its not good.

View on HN

That is a reasonable argument about Chrome! That's not hokum; even some people who have worked on and are invested in the Firefox security and isolation model will concede that Chrome has historically had a material edge there, and it has been reflected in browser vulnerability prices (I don't want to cite the obvious chart here because I think the audience for that thing is message boards and not people working in the field, but it's directionally correct).

There's also the benefit of having one set of controls with respect to profiles and extensions.

You've been known for your hot takes past and present, but this one threw me for a curve.

Is there empirical data on this? I think many in the security industry believe this. I ironically use FF if we can accept personal beliefs since I believe people attack the Chrome sandbox as a badge of honor and I can use containers to isolate state to different personas. That said also anecdata bullshit take on my part.

(1) I think public exploit price lists are bullshit, and mostly about marketing, but directionally they consistently put Chrome >2x of Firefox. You can choose not to take that seriously.

(2) The fact that people attack Chrome as a badge of honor is a reason to use it, not to avoid it. It's why exploits for Firefox would be cheaper.

(3) I don't think my take is spicy at all? I haven't refreshed it in a few years, but when last I did, I don't think I talked to anybody on either side of browser security who felt that Firefox outclassed Chrome (I got a long, valuable Slack thread from a FF security person that I wish I'd saved that built a claim that FF was approaching parity with Chrome architecturally). I have spicy takes, to be sure, but I think I'm giving you a pretty mainstream take from software security land.

(4) Even if you believed Firefox and Chrome (or Chrome and Safari) were at parity, it makes a great deal of sense to standardize browsers, for the reasons I gave previously. The right way to think of your browser "fleet" is as multiple single points of failure; diversity isn't helping you at all. This is one of those "put all your eggs in one basket and guard it" situations.

I don't have any particular personal reason to love Chrome. I'm a Mac person, so I guess the best outcome for me would be for Safari to be perceived as the best browser. Certainly my batteries would last longer! Every couple of years I talk to people about what the landscape looks like; if I ever get different answers, I'll be sure to update my take.

Point made, I meant this take threw me for a curve (not that it this too was spicy), re your point 3. I didn't make that clear. I just know your other takes so I was being cute about it. I don't know you that well so 1-4 are valid, and I am famously not a Mac user in my personal life. I know I am full of anecdata and that shit doesn't matter, but I appreciate the detailed follow up to confirm: 616c, your choices are great but not so empirical, here is what I think.

> their reasoning was: Microsoft and Google are Billion dollar companies.

Did you ever see that written down. Or was it an assumption or rumour?

I ask because I specifically advise against that thinking and debunk the "big company = trustworthy" fallacy. But what I find is that actually there is appropriate low trust of US big-tech amongst the C level, but they are compelled to use Microsoft or whatever for non-technical/non-security reasons.

The list of 'approved' software vendors doesn't say it's because their billion dollar companies, but if it's from a company on the list that's enough. No further vetting required.

Yes indeed.

I think where this goes wrong is when Bob in purchasing confuses can use this approved supplier with must use this supplier and fails to notice said supplier about to be bankrupted in court over a multi-billion security scandal, and goes ahead anyway.

Voila! We just bought a couple million IoT bricks and doorstops that will be in a landfill next week.

It very much feels like a "no one ever got fired for buying IBM" type of scenario sometimes.

In this case, a financial company, yes the reasoning written down on the intranet was that they had the backing of billion dollar companies.

This. CYA by ticking the boxes.

We once had a city IT guy block our deployment because we were vulnerable to CVE-whatever - turned out to be a minir vulnerability in the DuckDuckGo browser

Certifications (and specifically paying to get certified) are about legally throwing liability on another party, because nobody wants to end up with the hot ball in their hands.

The assumption is that shit will or already has hit the fan, and the question is how to reduce your own liabilities as much as possible by throwing what you can on someone else.

Certifications were and are never about practical or literal security.

It reminds me of the old quote by Keynes:

A sound banker, alas, is not one who foresees danger and avoids it. But one who, when he is ruined, is ruined in a conventional and orthodox way with his fellows, so that no-one can really blame him

Reply on news.ycombinator.com