3 ms·
Last time I checked, it was just for process separation and did not provide any security guarantees. It's a separate project from e10s (though it depends on it
by gcp 10y ago
Last time I checked, it was just for process separation and did not provide any security guarantees.
It's a separate project from e10s (though it depends on it):
https://wiki.mozilla.org/Security/Sandbox https://wiki.mozilla.org/Security/Sandbox
Chromium had a fair bit of sandbox escapes during the first years, and there's no reason to believe this is going to be different with Firefox.
I agree. Note that people still find sandbox escapes against Chrome anyway. Yes, sometimes they use the OS, but due to how the sandboxing works that's to be expected.
Even Microsoft Edge is better at this.
CVE counting, especially the ones published by the developers themselves, aren't a very good measure of security.
- lima 10y ago> CVE counting See my reply below. Counting exploits, not CVEs. By CVE count, Chrome would be the worst.
- deleted 10y ago[deleted]
- codedokode 10y ago> Note that people still find sandbox escapes against Chrome anyway. Yes, sometimes they use the OS, but due to how the sandboxing works that's to be expected. Google developed special architecture to make browser safer. Other vendors did nothing, they just wait until exploit becomes public and patch the code (and yet they call their product "secure"). Google also motivated Microsoft to allow disabling potentially vulnerable kernel library. Google since long ago has their own PDF viewer (so people don't have to use Adobe viewer) and their own Flash plugin. As a result on contests like pwn2own exploits for Chrome are the most expensive. Regarding Tor I am not sure if JS is really necessary for a secure network. You don't need it to read sites like wikileaks bit it provides a large attack surface and it might be better to have it disabled by default.