5 ms·

>Justin Schuh is not the same as Google (even though he works there) Does Justin Schuh write and ship a web browser that isn't Chrome? > privacy is not the sa

by wang_li 10y ago

>Justin Schuh is not the same as Google (even though he works there) Does Justin Schuh write and ship a web browser that isn't Chrome? > privacy is not the same as security. If someone says "Here's my program, it's great, it's shiny, it's awesome, it's wonderful, it'll cure acne, and feed teh poor. But then tells me that if it does none of those things, it's not their problem." Then I'm not going to believe their blah blah blah as long as they retain their disclaimer. If Google wants to step up and start writing checks every time a defect in their software causes someone else money, then I'll start listening and trusting their statements.

tptacek 10y ago
Justin Schuh is security for Chrome. If you find a software security person anywhere in the industry who believes that users are safer with Safari, Firefox, or Internet Explorer, let me know about them. "Switch to Chrome" is pretty close to the first bit of endpoint advice most security people provide in 2016. That doesn't make Chrome the best browser or apologize for any of the things Google has done to make the web more proprietary or less reliable. But none of those things are Justin's job: Justin's job is to solve the single hardest problem in software security (securing the world's most complicated inner platform), and by pretty much all accounts anywhere, the Chrome team has done an amazing job of it.
- wang_li 10y ago
  >If you find a software security person anywhere in the industry who believes that users are safer with Safari, Firefox, or Internet Explorer, let me know about them. This is not the same statement as "shipping a secure browser." Also doesn't refute the reality that Google still has a disclaimer of warranty in their EULA. As such that is a specific statement that they do not believe their product to be secure.
  - tptacek 10y ago
    What a head-explodey argument: for Google's security team to be taken seriously, you require that Google alter their liability posture in a way that no other software company would. The first public company to do this would face shareholder lawsuits. Who could possibly find such an argument convincing?
    - wang_li 10y ago
      > for Google's security team to be taken seriously, you require that Google alter their liability posture If they seriously believe that they have the ability to ship a secure browser what would it matter? The other question I have is if they have this capability, why haven't they? Here's what I believe. Google will never ship a modern, full featured, standards compliant, and secure browser. Specifically they will never ship a secure browser. >Who could possibly find such an argument convincing? Pretty much the entirety of the rest of trade across the entire world. When was the last time your grocery store was allowed to sell you rotten food liability free? Companies, in fact, routinely are sued and fined for fraud and false claims. Chipotle just got sued for advertising a 300 calorie burrito that wasn't 300 calories. Why should Google (and Google employees) be able to make false claims and then later insist in their EULAs that they don't actually have to abide by.
      - ThrustVectoring 10y ago
        Having a secure browser doesn't protect you from people thinking that your browser is insecure and blaming you for unrelated security failures. Like, have you read /r/talesfromtechsupport or done any user-facing tech support?

by wang_li 10y ago

tptacek 10y ago

Justin Schuh is security for Chrome. If you find a software security person anywhere in the industry who believes that users are safer with Safari, Firefox, or Internet Explorer, let me know about them. "Switch to Chrome" is pretty close to the first bit of endpoint advice most security people provide in 2016. That doesn't make Chrome the best browser or apologize for any of the things Google has done to make the web more proprietary or less reliable. But none of those things are Justin's job: Justin's job is to solve the single hardest problem in software security (securing the world's most complicated inner platform), and by pretty much all accounts anywhere, the Chrome team has done an amazing job of it.

wang_li 10y ago
>If you find a software security person anywhere in the industry who believes that users are safer with Safari, Firefox, or Internet Explorer, let me know about them. This is not the same statement as "shipping a secure browser." Also doesn't refute the reality that Google still has a disclaimer of warranty in their EULA. As such that is a specific statement that they do not believe their product to be secure.
- tptacek 10y ago
  What a head-explodey argument: for Google's security team to be taken seriously, you require that Google alter their liability posture in a way that no other software company would. The first public company to do this would face shareholder lawsuits. Who could possibly find such an argument convincing?
  - wang_li 10y ago
    > for Google's security team to be taken seriously, you require that Google alter their liability posture If they seriously believe that they have the ability to ship a secure browser what would it matter? The other question I have is if they have this capability, why haven't they? Here's what I believe. Google will never ship a modern, full featured, standards compliant, and secure browser. Specifically they will never ship a secure browser. >Who could possibly find such an argument convincing? Pretty much the entirety of the rest of trade across the entire world. When was the last time your grocery store was allowed to sell you rotten food liability free? Companies, in fact, routinely are sued and fined for fraud and false claims. Chipotle just got sued for advertising a 300 calorie burrito that wasn't 300 calories. Why should Google (and Google employees) be able to make false claims and then later insist in their EULAs that they don't actually have to abide by.
    - ThrustVectoring 10y ago
      Having a secure browser doesn't protect you from people thinking that your browser is insecure and blaming you for unrelated security failures. Like, have you read /r/talesfromtechsupport or done any user-facing tech support?