2 ms·

> Parent sounds so bad because he seems to grade security by seeing how many CVE's the developer publishes, ignores the fact that browser exploits are often don

by lima 10y ago

> Parent sounds so bad because he seems to grade security by seeing how many CVE's the developer publishes, ignores the fact that browser exploits are often done by exploiting attack surface outside the browser (because all browsers are - relatively speaking to other software - secure), and conflating Chrome vs Chromium. By counting CVEs alone, Chrome would be the least secure since it has more CVEs than any other browser thanks to Google's bug bounty and fuzzing, most of them harmless. What I counted were real-world browser exploits which is an excellent measure of security. > such problems are rather rare these days In Chrome, yes. They happen rather often with Firefox. > conflating Chrome vs Chromium Their security features are identical. It's the same code.

gcp 10y ago
In Chrome, yes. They happen rather often with Firefox. Shrug, I disagree. The fuss made here illustrates it: 0-days are rare enough that "rather often" is a serious mischaracterisation. Their security features are identical. It's the same code. You said: "And it being open source means that I can use without worrying about backdoors or data leakage." Which has nothing to do with security. Inspecting Chromium tells you nothing about what Chrome does, and using Chromium means you miss features that Chrome has (H264, Netflix, ...)
- lima 10y ago
  > The fuss made here illustrates it: 0-days are rare enough that "rather often" is a serious mischaracterisation. A RCE in a browser is literally the worst possible case and Firefox had multiple of them, most trivially exploitable with JavaScript. This simply doesn't happen with Chrome. > Chromium means you miss features that Chrome has (H264, Netflix, ...) Google made an effort to open-source everything, including their PDFium PDF reader. The only remaining bits are the Pepper flash player and the Encrypted Media Extensions. Both are closed source in Firefox as well. You can use them with Chromium just fine and both are sandboxed. They cannot be distributed with Chromium for licensing reasons, but nothing prevents you from downloading the Chrome package and extracting those two files. Many Linux distros have scripts which automate this.
  - gcp 10y ago
    I specifically pointed out H264 support (and you ignored it) because it's an annoyance when using Chromium. And yes, that's due to licensing reasons as well.
    - lima 10y ago
      That's up to the distribution policy/packaging. Fedora refuses to add H264, on Ubuntu you can install chromium-codecs-ffmpeg-extra and it works fine. The code is there in Chromium and it's fully open source.

by lima 10y ago

gcp 10y ago

In Chrome, yes. They happen rather often with Firefox. Shrug, I disagree. The fuss made here illustrates it: 0-days are rare enough that "rather often" is a serious mischaracterisation. Their security features are identical. It's the same code. You said: "And it being open source means that I can use without worrying about backdoors or data leakage." Which has nothing to do with security. Inspecting Chromium tells you nothing about what Chrome does, and using Chromium means you miss features that Chrome has (H264, Netflix, ...)

lima 10y ago
> The fuss made here illustrates it: 0-days are rare enough that "rather often" is a serious mischaracterisation. A RCE in a browser is literally the worst possible case and Firefox had multiple of them, most trivially exploitable with JavaScript. This simply doesn't happen with Chrome. > Chromium means you miss features that Chrome has (H264, Netflix, ...) Google made an effort to open-source everything, including their PDFium PDF reader. The only remaining bits are the Pepper flash player and the Encrypted Media Extensions. Both are closed source in Firefox as well. You can use them with Chromium just fine and both are sandboxed. They cannot be distributed with Chromium for licensing reasons, but nothing prevents you from downloading the Chrome package and extracting those two files. Many Linux distros have scripts which automate this.
- gcp 10y ago
  I specifically pointed out H264 support (and you ignored it) because it's an annoyance when using Chromium. And yes, that's due to licensing reasons as well.
  - lima 10y ago
    That's up to the distribution policy/packaging. Fedora refuses to add H264, on Ubuntu you can install chromium-codecs-ffmpeg-extra and it works fine. The code is there in Chromium and it's fully open source.