4 ms·

Browser security doesn't work either. JS offers a huge attack surface by itself and it's difficult to disable it as web developers are lazy and won't want to d

by blub 10y ago

Browser security doesn't work either. JS offers a huge attack surface by itself and it's difficult to disable it as web developers are lazy and won't want to develop a website which works without it. Every time someone complains here about mandatory-JS websites they're more or less called a luddite. More and more APIs are piled on in the (foolish) quest for native-like web apps. Plugins such as Flash, Java or various document viewers are notorious for being exploit magnets. Let's say we manage to disable JS and plugins though. The browser is written in C++ - and please correct me if I'm wrong - not particularly modern and safety-conscious C++. I am familiar with e.g. Firefox updates and most of them contain security fixed in said code. Underneath we have C libraries for image processing, font management, etc - it's expected that they are vulnerable. So a browser is basically a set of sieves on top of eachother that during the best of times can go several weeks without leaking. It doesn't seem that their biggest problem is AV, it's that their code and the code they rely on is riddled with holes.

tptacek 10y ago
First, this is a category error. Browsers are a significant security challenge (probably the most significant, due to the fact that the web is the industry's largest inner platform) because they do lots of things users want. Justin's job protecting Chrome is to take a product millions of people demand, and make it as secure as possible. That's not what antivirus is. The antivirus pitch is "install this thing that nobody wants, and it will keep bad things from happening". Second: compare the cost of a Chrome exploit to that of an antivirus exploit. A reliable Chrome drive-by is into the six figures. An AV bug is a Sunday project for Tavis Ormandy.
- blub 10y ago
  I didn't mention antivirus quality and don't care much about the topic nowadays. Browsers do a lot of things web developers and browser developers want, that's why they transformed into a frankenstein OS that at this point is probably impossible to secure. I disagree that they do "a lot" of things users want. They can show web sites, more or less like 16 years ago except with more ads, animations, tracking. They like to pretend that websites are apps, but that always fails sooner or later. My point was: browsers are probably the number one attack vector today. It doesn't matter that it costs a lot or that antiviruses are crap at security. Very few are likely going to get compromised through their antivirus. A whole lot will be compromised through their browsers, irrespective of the existence of antivirus. The push to web apps, insecure core OS elements and browsers guarantee this. P.S: I don't use Chrome, so the fact that it's above avarage at security leaves me cold. I get it that it perhaps offers better protection than Firefox, but what's the point of that if everything one does is uploaded to Google anyway? From that point of view, the whole discussion is quite repugnant. Google worrying that others will install spyware on the systems that they spy on through Chrome, analytics, docs, gmail, etc.
  - tptacek 10y ago
    We're saying the same thing.

by blub 10y ago

tptacek 10y ago

First, this is a category error. Browsers are a significant security challenge (probably the most significant, due to the fact that the web is the industry's largest inner platform) because they do lots of things users want. Justin's job protecting Chrome is to take a product millions of people demand, and make it as secure as possible. That's not what antivirus is. The antivirus pitch is "install this thing that nobody wants, and it will keep bad things from happening". Second: compare the cost of a Chrome exploit to that of an antivirus exploit. A reliable Chrome drive-by is into the six figures. An AV bug is a Sunday project for Tavis Ormandy.

blub 10y ago
I didn't mention antivirus quality and don't care much about the topic nowadays. Browsers do a lot of things web developers and browser developers want, that's why they transformed into a frankenstein OS that at this point is probably impossible to secure. I disagree that they do "a lot" of things users want. They can show web sites, more or less like 16 years ago except with more ads, animations, tracking. They like to pretend that websites are apps, but that always fails sooner or later. My point was: browsers are probably the number one attack vector today. It doesn't matter that it costs a lot or that antiviruses are crap at security. Very few are likely going to get compromised through their antivirus. A whole lot will be compromised through their browsers, irrespective of the existence of antivirus. The push to web apps, insecure core OS elements and browsers guarantee this. P.S: I don't use Chrome, so the fact that it's above avarage at security leaves me cold. I get it that it perhaps offers better protection than Firefox, but what's the point of that if everything one does is uploaded to Google anyway? From that point of view, the whole discussion is quite repugnant. Google worrying that others will install spyware on the systems that they spy on through Chrome, analytics, docs, gmail, etc.
- tptacek 10y ago
  We're saying the same thing.