Hacker News Reader

Comment by insanitybit | Hacker News Reader

No need to be revisionist. Chrome brought amazing work to the table. The multiprocess, sandboxed system was incredible - it's not to say that Chrome was the first (IE did it earlier) but it was certainly way ahead of Firefox for a long time. Chrome is the reason we have Seccomp V2 on Linux. Chrome made "software is always up to date" the standard. Before Chrome, Blackhole and PoisonIvy absolutely ruined people's computers - click to play Java, click to play and sandboxed Flash, etc, were massive improvements to every day user security, probably some of the biggest security improvements to computers in my lifetime.

Firefox took a long time to catch up and their CEO was utterly incompetent, which seriously harmed Mozilla.

View on HN

I remember for a while that Firefox had a single process architecture for all tabs. This often frustrated me as one bad tab could just crash the whole browser while Chrome used separate processes for each tab, prompting me to switch to Chrome for a bit. Firefox caught up ages after chrome, and now I went back to them over the manifest v2 stuff.

Indeed. Around that era I had a fun little "crashmybrowser.com" toy site that had a few different JS tricks you could click that would absolutely wedge your browser (any browser, at the time). This had come after years of my being vocally annoyed that there weren't better guardrails around Javascript. Each of the functions was based on a real-world failure case.

Chrome was the first browser to be immune to all of those functions.

Mozilla really screwed the pooch not long after. Their biggest single misstep was forcing automatic updates in corporate networks. At the time, they still had pretty good adoption in the kinds of environments that had a couple of people somewhere deciding what everyone was allowed to run on the company computers. Chrome had already moved to forced updates, so these environments went to Firefox. When Firefox decided to follow Chrome, they no longer had that differentiation, and corporate IT had to choose between two browsers that both had automatic updates, but one of them had frequent memory and performance problems.

I've happily returned to Firefox a few years ago and don't have Chrome installed on any device I control.

Chrome's multiprocess sandboxing wasn't unambiguously good. It carried a steep cost in overhead.

Back when Chrome was new, you could run Firefox with a decent selection of add-ons to get security benefits of similar magnitude through different mechanisms. The NoScript extension was at the forefront, providing a lot of functionality way beyond just blocking JavaScript per domain. And Firefox with extensions always had better privacy controls.

> Chrome's multiprocess sandboxing wasn't unambiguously good. It carried a steep cost in overhead.

This is true, but this is why we create faster and faster PCs, so our software can do more. The cost was because you were getting new safety features. Want the app to be fast, able to show you lots of tabs with no delay? That takes RAM and CPU. The CPU and RAM are there to be used for features the user wants. It's actually 100% ok if a computer has to work really hard to run an app as long as that app is designed well, it means the user is making it do lots of useful work. That's what the computer is there for.

The "Just buy a new computer" excuse doesn't actually make the tradeoff no longer a tradeoff. The cost is still real, you're just putting a price tag on it (then ignoring the price, along with any alternative tradeoffs).

> The "Just buy a new computer" excuse doesn't actually make the tradeoff no longer a tradeoff.

I think you accidentally responded to the wrong comment, I didn't make any excuses or debate tradeoffs. I said "things have costs".

I doubt there are many things in this universe that are unambiguously good, but Chrome's sandboxing is certainly as close as anything.

You can make your arguments about noscript if you'd like (I have a great respect for the project) but I think it was essentially irrelevant to user security at the time, real users were really harmed by malware that exploited Firefox, Java, and Flash, and Chrome killed every one of those attack paths in virtually no time at all.

Computers were far more dangerous before Chrome. You watch old TV shows and it's a joke that people would visit a site and get hacked - that's unrecognizable today, it simply doesn't happen. It used to, Chrome changed that.

I agree that on a large scale, Chrome made browsing safer for the general public at the time. But for me it made things slower, use more RAM, waste more bandwidth on ads, didn't provide meaningful security improvements, and was a big downgrade in privacy. The only time I've been successfully attacked through a browser was when a Chrome extension sold out and became adware. And Google is now deciding for a frighteningly large part of the public exactly how much security and privacy they should get.

NoScript and uMatrix were a great help - for very advanced users. But the typical user was left behind.

> Firefox took a long time to catch up and their CEO was utterly incompetent, which seriously harmed Mozilla.

This is basically whole history of Mozilla and to be honest most of open source projects that dont have BDFL type of leadership.

It is especially true for projects like Firefox which have access to massive funding since these attract the sort of people who consider those funds 'wasted' because they can be used to do so much for 'the common good'. Mitchell Baker - the utterly incompetent CEO - considered Firefox an afterthought because what the world needed was more NGO activism and what she needed was 400% more money for herself [1].

Wikipedia/Wikimedia is another example of a project with massive funding with similar problems even though the latter has a (not so) BDFL.

[1] https://calpaterson.com/mozilla.html

Wikimedia might be not perfect, but Wikipedia is still one of the most visited websites in the world and source of a lot of humanity knowledge in general.

Firefox on other hand is just something only nerds like us care about and only alive because Alphabet / Google is scared of antitrust legal action possibility.

And wikipedia runs off a tiny tiny fraction of what they raise. Almost all of the good on wikipedia comes in-spite of the organisation that owns it. Without the community pouring hundreds of thousands of hours into the project (unpaid) a year, wikipedia would be dead immediately. And if there was ever a time in its life that the project needed good leadership and innovative thinking, it would be now when AI is seriously threatening its survival. If people stop going to the site and instead go to the chat bots that scrape the site, there will be less and less incentive for the power users to continue maintaining wikipedia.

Reply on news.ycombinator.com