Hacker News Reader

Comment by greenyies | Hacker News Reader

I'm just not trusting a small browser dev team.

The risk of exploits is too high

But you’d trust a megacorporation closely tied to government that has an explicit interest in tracking you, keeping paths for intelligence agencies and law enforcement open, and generally being deceptive? You trust browsers that openly phone home about your activity?

I gauge the risk of my government targeting me lower than the risk of hackers stealing/selling my information. Mainly because the latter has occurred to me numerous times already.

Despite you painting it as extreme as you do, yes.

Random exploits on the Internet are still a higher risk for me.

If you're really this serious about security, you should be using Qubes OS. Then, a browser choice stops being important, since the strong isolation would prevent an exploit to do any damage. And disposable VMs allow to do insecure staff without any risk.

I'm serious enough about security that I don't trust a very small dev teams skill set developing a browser for the Internet we have today.

And I don't care if my browser is compromised, since the attacker would only get access to an empty VM on Qubes OS.

I'm not switching my os to some obscure one for security and it doesn't make sense for me to isolate my browser from my system/files.

And yes my mail account is more critical than my local files.

Xen is not an obscure system. Hardware isolation was broken last time in 2006 by the Qubes founder ("Blue pill software").

I open my email in a dedicated VM, so only my email provider could attempt to compromise me. Attachments are automatically opened in another, disposable VM.

I talk about the distro qubes os and not about xen.

Also my email account and everything normal I do, is part of my normal life and it's very helpful to be normal.

If I would ever do something out of the ordinary and want to do something which requires physical access, it's much easier to travel the world as someone who has a normal Internet profile.

My personal data is protected enough on Gmail and gdrive.

Everything else just doesn't exist anywhere.

And still written in C++, like c'mon, we are in 2024.

What would be a better option?

The obvious answer is Rust. But I respect their choice of using an existing and probably well-tested C++ code base as a starting point.

Reply on news.ycombinator.com