7 ms·

RAM is cheap. Getting hacked isn't (especially when you consider ransomware these days). That's the reason Chrome is the most secure browser around, and Firefox

by mtgx 10y ago

RAM is cheap. Getting hacked isn't (especially when you consider ransomware these days). That's the reason Chrome is the most secure browser around, and Firefox isn't even invited to Pwn2Own anymore. https://it.slashdot.org/story/16/02/12/034206/pwn2own-2016-wont-attack-firefox-because-its-too-easy https://it.slashdot.org/story/16/02/12/034206/pwn2own-2016-w...

kuschku 10y ago
Great, so we have no open browser left anymore? Chrome is at best visible source – Google controls development, not the community – and the others are even fully proprietary Great fucking world.
- Ichaitei 10y ago
  How about making Firefox more secure (one of the goals of E10s)?
  - kuschku 10y ago
    That can only be done if Firefox has users. Which is hard to do when Google competes unfairly, even illegally – which they did, for example with using AdSense for Chrome ads everywhere, and not paying website owners where the ads were displayed the normal rates, or by adding fraudulent banners "Your browser (Firefox) is outdated, upgrade to Chrome now" to Google Search.
    - kebolio 10y ago
      Can someone answer why this is wrong instead of just downvoting?
      - Sylos 10y ago
        Well, it's wrong, because it can not only be done, if Firefox has users. You don't need to care what 99% of the world population is doing. As long as Firefox exists, you can use it. You could say that without many users, there won't enough real-world exposure, but at the same time, Firefox will also be targeted far less, so you wouldn't have to worry about security vulnerabilities as much. And while yes, if at some point Chrome becomes Internet Explorer 2.0 and webpages target nothing else anymore, that could cause Firefox to be hardly usable, but that's then an entirely different nightmare and not anymore relevant to the current situation.
        kuschku 10y ago
        But it isn’t – the amount of open source devs working on FF depends on how many people use FF, and the amount of fulltime devs depends on funding, which depends on the amounts Yahoo or Google pay, which depend on how many users Firefox has. With no devs, you can’t implement those features or the security easily. And especially for security you’ll want fulltime employees. Also, you’ll have to pay more than Google pays their Chrome devs to ensure the people will keep working for you.
        asadotzler 10y ago
        We built Firefox 1.0 and shipped it to the world with zero revenue. Open Source is funny like that. Some people work on it because they love it, not because they're being paid.
        kuschku 10y ago
        Indeed, and one can surely maintain Firefox 1 or 2 easily with a bunch of volunteers. But maintaining a whole OS with a whole virtualization layer, a whole sandbox system, several supported scripting systems, its own scheduler, its own graphics stack, and support for compatibility with any bug a competing system has? Modern browser are reaching complexities we’ve only seen in whole operating systems before. You don’t see a bunch of volunteers maintain everything from Linux to KDE at once, it’s hundredthousands of people working in a very different way. To be able to compete against Google, be able to force them to implement features you pioneer, and force them to avoid implementing other features, to be able to keep up with them and reach better security than them, the current Firefox team is not enough.
- dragonwriter 10y ago
  > Chrome is at best visible source – Google controls development, not the community Chromium is open source, Chrome is open core. Chromium may also be cathedral (rather thean bazaar) development model, but that's only distantly related to open source or not (bazaar is facilitated by open source, but not required for it.)
  - kuschku 10y ago
    Eh, it’s not really related. Google even openly discourages forks, or any contribution that doesn’t fit their ideals. It’s only truly open if development is controlled by a democratic community, or if it’s easily possible to be forked and competed with. Which isn’t the case. And for users open development is a lot more important than open source: Being able to get their own changes into the browser, ensuring the browser is made by the users, for the users.
    - kelnos 10y ago
      Google even openly discourages forks... Google may discourage forks, but there's nothing they can do to prevent one, and forking Chromium is no more difficult than forking any other project its size. ... or any contribution that doesn’t fit their ideals. That's one of an OSS project maintainer's more important jobs. I used to maintain some decent-sized open source projects, and part of my job was to say "no" when someone wanted to add something I didn't think belonged (for whatever reason).
      - kuschku 10y ago
        Forking Chrome is useless, Google can just take a bunch more of engineers to work on it, add some features to chrome, and extinguish your project again. Forking Chrome would be like fighting against Embrace, Extend, Extinguish after you’ve already lost (which we have with Chrome, compared to what KHTML used to be like)
        kelnos 10y ago
        That's true of any large open source project, whether heavily backed by a company or not. You need both users and developers to make a fork successful. Regardless, though, there's nothing that says the hypothetical developers of a Chromium fork couldn't devote some time to merging reasonable fixes & new features from upstream.
vacri 10y ago
From further down the same page, one comment says that CVE counts for FF are better than Safari or Edge, though Chrome is still by far the best. https://it.slashdot.org/comments.pl?sid=8737473&cid=51495357 https://it.slashdot.org/comments.pl?sid=8737473&cid=51495357
Sylos 10y ago
That's nonsense. They did not target Firefox, because it has not made any major (architectural) changes in regards to security, since they've last targeted it. No major changes means that there will also likely not be any new security vulnerabilities and therefore they would almost certainly not find anything new. This does not mean that Firefox is less secure, it just means that Mozilla has not innovated much. And if you look at actual statistics, you'll see that Firefox is not behind at all. You could maybe make a separate case that this will lead to bad security in the future, as some innovation is inevitably going to be necessary, but with addon signing, E10s, WebExtensions and Servo all up and coming, you'll have a hard time to actually defend that case.

by mtgx 10y ago

kuschku 10y ago

Great, so we have no open browser left anymore? Chrome is at best visible source – Google controls development, not the community – and the others are even fully proprietary Great fucking world.

Ichaitei 10y ago
How about making Firefox more secure (one of the goals of E10s)?
- kuschku 10y ago
  That can only be done if Firefox has users. Which is hard to do when Google competes unfairly, even illegally – which they did, for example with using AdSense for Chrome ads everywhere, and not paying website owners where the ads were displayed the normal rates, or by adding fraudulent banners "Your browser (Firefox) is outdated, upgrade to Chrome now" to Google Search.
  - kebolio 10y ago
    Can someone answer why this is wrong instead of just downvoting?
    - Sylos 10y ago
      Well, it's wrong, because it can not only be done, if Firefox has users. You don't need to care what 99% of the world population is doing. As long as Firefox exists, you can use it. You could say that without many users, there won't enough real-world exposure, but at the same time, Firefox will also be targeted far less, so you wouldn't have to worry about security vulnerabilities as much. And while yes, if at some point Chrome becomes Internet Explorer 2.0 and webpages target nothing else anymore, that could cause Firefox to be hardly usable, but that's then an entirely different nightmare and not anymore relevant to the current situation.
      - kuschku 10y ago
        But it isn’t – the amount of open source devs working on FF depends on how many people use FF, and the amount of fulltime devs depends on funding, which depends on the amounts Yahoo or Google pay, which depend on how many users Firefox has. With no devs, you can’t implement those features or the security easily. And especially for security you’ll want fulltime employees. Also, you’ll have to pay more than Google pays their Chrome devs to ensure the people will keep working for you.
        asadotzler 10y ago
        We built Firefox 1.0 and shipped it to the world with zero revenue. Open Source is funny like that. Some people work on it because they love it, not because they're being paid.
        kuschku 10y ago
        Indeed, and one can surely maintain Firefox 1 or 2 easily with a bunch of volunteers. But maintaining a whole OS with a whole virtualization layer, a whole sandbox system, several supported scripting systems, its own scheduler, its own graphics stack, and support for compatibility with any bug a competing system has? Modern browser are reaching complexities we’ve only seen in whole operating systems before. You don’t see a bunch of volunteers maintain everything from Linux to KDE at once, it’s hundredthousands of people working in a very different way. To be able to compete against Google, be able to force them to implement features you pioneer, and force them to avoid implementing other features, to be able to keep up with them and reach better security than them, the current Firefox team is not enough.
dragonwriter 10y ago
> Chrome is at best visible source – Google controls development, not the community Chromium is open source, Chrome is open core. Chromium may also be cathedral (rather thean bazaar) development model, but that's only distantly related to open source or not (bazaar is facilitated by open source, but not required for it.)
- kuschku 10y ago
  Eh, it’s not really related. Google even openly discourages forks, or any contribution that doesn’t fit their ideals. It’s only truly open if development is controlled by a democratic community, or if it’s easily possible to be forked and competed with. Which isn’t the case. And for users open development is a lot more important than open source: Being able to get their own changes into the browser, ensuring the browser is made by the users, for the users.
  - kelnos 10y ago
    Google even openly discourages forks... Google may discourage forks, but there's nothing they can do to prevent one, and forking Chromium is no more difficult than forking any other project its size. ... or any contribution that doesn’t fit their ideals. That's one of an OSS project maintainer's more important jobs. I used to maintain some decent-sized open source projects, and part of my job was to say "no" when someone wanted to add something I didn't think belonged (for whatever reason).
    - kuschku 10y ago
      Forking Chrome is useless, Google can just take a bunch more of engineers to work on it, add some features to chrome, and extinguish your project again. Forking Chrome would be like fighting against Embrace, Extend, Extinguish after you’ve already lost (which we have with Chrome, compared to what KHTML used to be like)
      - kelnos 10y ago
        That's true of any large open source project, whether heavily backed by a company or not. You need both users and developers to make a fork successful. Regardless, though, there's nothing that says the hypothetical developers of a Chromium fork couldn't devote some time to merging reasonable fixes & new features from upstream.

vacri 10y ago

From further down the same page, one comment says that CVE counts for FF are better than Safari or Edge, though Chrome is still by far the best. https://it.slashdot.org/comments.pl?sid=8737473&cid=51495357 https://it.slashdot.org/comments.pl?sid=8737473&cid=51495357

Sylos 10y ago

That's nonsense. They did not target Firefox, because it has not made any major (architectural) changes in regards to security, since they've last targeted it. No major changes means that there will also likely not be any new security vulnerabilities and therefore they would almost certainly not find anything new. This does not mean that Firefox is less secure, it just means that Mozilla has not innovated much. And if you look at actual statistics, you'll see that Firefox is not behind at all. You could maybe make a separate case that this will lead to bad security in the future, as some innovation is inevitably going to be necessary, but with addon signing, E10s, WebExtensions and Servo all up and coming, you'll have a hard time to actually defend that case.