2 ms·

Maybe you should look at how they are architected. There's a HUGE difference in how they operate. In Chrome the code the pages run in themselves can't do anythi

Maybe you should look at how they are architected. There's a HUGE difference in how they operate. In Chrome the code the pages run in themselves can't do anything. Not true in Safari. The two are night and day different. I'm a contributor to both Chromium and WebKit. Sure at some level they share some code. Chrome tho pretty much implements an entire virtual and secured OS in which it then executes Blink. Safari does no such thing for WebKit.

pcwalton 11y ago
> In Chrome the code the pages run in themselves can't do anything. Not true in Safari. The two are night and day different. By "the code the pages run in themselves can't do anything" do you mean that Chrome is sandboxed and Safari isn't? That's not true. WebKit rendering happens in a "WebProcess" which uses the Mac Seatbelt framework for sandboxing. The sandbox file is WebKit2.framework/A/Resources/com.apple.WebProcess.sb. Sure, Chromium's sandbox is more restrictive. It proxies more things out through the broker process. But the difference is a matter of degree, not a fundamental architectural difference.
vonklaus 11y ago
Does it matter that Safari typically runs on Mac hardware? I would suspect having a sandboxed solution as well as teh ability to control the hardware, software and OS would be very secure, but it must be quite good that they have end to end control over the hardware and software and can integrate it. Chrome runs as more of an application "anywhere that google can go TM". So they have to provide better sandboxing as they likely don't control the hardware/must make it easier to ship? On Mac hardware, what do you think is "safer" ceterus paribus, Safari or Chrome?
- greggman 11y ago
  It's clear from the CVEs which is safer. Assume all bugs in Chrome on happen on OSX. There's 13 to 1 more code execution bugs in Safari.

pcwalton 11y ago

> In Chrome the code the pages run in themselves can't do anything. Not true in Safari. The two are night and day different. By "the code the pages run in themselves can't do anything" do you mean that Chrome is sandboxed and Safari isn't? That's not true. WebKit rendering happens in a "WebProcess" which uses the Mac Seatbelt framework for sandboxing. The sandbox file is WebKit2.framework/A/Resources/com.apple.WebProcess.sb. Sure, Chromium's sandbox is more restrictive. It proxies more things out through the broker process. But the difference is a matter of degree, not a fundamental architectural difference.

vonklaus 11y ago

Does it matter that Safari typically runs on Mac hardware? I would suspect having a sandboxed solution as well as teh ability to control the hardware, software and OS would be very secure, but it must be quite good that they have end to end control over the hardware and software and can integrate it. Chrome runs as more of an application "anywhere that google can go TM". So they have to provide better sandboxing as they likely don't control the hardware/must make it easier to ship? On Mac hardware, what do you think is "safer" ceterus paribus, Safari or Chrome?

greggman 11y ago
It's clear from the CVEs which is safer. Assume all bugs in Chrome on happen on OSX. There's 13 to 1 more code execution bugs in Safari.