Hacker News Reader

Can you maybe elaborate on the main non-js vectors? I know image/video is one, is webgl/canvas maybe a big one? or webrtc? Or would you say js is by far the biggest vector? I currently browse with developer edition (daily patches) with noscript and requestpolicy to make firefox as secure as I can but I still feel using a browser, and Firefox in particular is very unsafe practice and the code is a mess. Am I right in this as far as you know?

View on HN

JS is by far the biggest vector. Even if you have a good bug in another component (those you listed are good candidates) you will typically need JS to massage the heap or trigger it.

SVG is another good source of bugs that comes to mind.

I don't think FF code quality is particularly worse than other browsers. Part of the problem is that it is simply a very large very public project. Some of the code is very old. Mainly though, they have been a bit slow to implement architectural features (e.g. privilege separation / sandboxing) which would improve resilience.

Reply on news.ycombinator.com