Hacker News Reader

Comment by jorvi | Hacker News Reader

Are browser UIs themselves vectors for serious exploits?

Orion uses WebKit and I assume they try to track as close to the release branch as possible. So if you trust WebKit, you can trust Orion.

Personally I'm more of a Brave guy though, despite having been a Kagi user since 2024 :).

What I'd really wish for is an EU browser that 'just works'. Vivaldi is nice but it often has papercuts because it has a small team behind it that have to try to support a mountain of features.

View on HN

When a vendor bundles their own code with Webkit, it's quite easy for that vendor's code to have it's own security vulnerabilities, yes commonly in the UI, but also to open security vulnerabilities in Webkit. There's also no telling how much they've modified Webkit itself to make the rest of their code work. You simply cannot trust it and there are many security failure modes here. If you cannot inspect it all, you are trusting the vendor and I would be very careful trusting un-tested vendors of the most complex programs ever written which hold your credit cards and all of your logins probably your bank as well. I damn well would not trust the first few versions before the white hats have had a few years poking at it.

> Orion uses WebKit and _I assume_ they try to track as close to the release branch as possible. So if you trust WebKit, you can trust Orion.

The problem is you're stuck at assuming, but can't verify.

This in particular is not very difficult to verify

I mean, if you're really worried just test for support of certain features or absence of bugs that are only in the newest WebKit.

> What I'd really wish for is an EU browser that 'just works'.

Have you tried Zen Browser? It's entirely open source but the core team and sponsor are European, and it's actively positioning itself as the European alternative. I've been giving it a go lately. So far, so good, and I like most of their UI/UX choices.

Not OP, but your comment had me looking into it: the fact that it's Firefox-based is reason enough to give it some consideration: the Chrome monopoly we are currently under is not compatible with a healthy and neutral web.

I've considered Zen, but the problem there is no Widevine, which means no DRM video.

I do love the design and how the interface has vertical and pinned / favorite tabs as its foundation. It's where I expect other browsers to go eventually.

There’s a lot of ways you can hold an engine wrong. Some 3rd party browser (often by security vendors…) have been vulnerable to exploits due to not compiling it with all the hardening options, or injecting vulnerable extensions that expose an attack surface to the webpage, for instance.

Reply on news.ycombinator.com