3 ms·
Firefox had no process isolation or web content sandboxing for years. It still doesn't in a lot of places even today. That meant that every little bug became a
by nikcub 10y ago
Firefox had no process isolation or web content sandboxing for years. It still doesn't in a lot of places even today. That meant that every little bug became a serious bug.
In contrast, RCE's for Chrome and Safari require chaining together a number of exploits - the most valuable of which is the sandbox escape.
Firefox are years behind on security - and in the meantime large number of people have abandoned it and you have an entire security community openly advocating against using or deploying it.
Yes, the security model is improving now (thanks in large part to code from Chromium) - but it's improved in the same way Adobe Flash security has improved, or Java security has improved - it will always have that huge weight of a bad reputation to carry, and it is still a far way from catching up to the norm in browsers today (check the incomplete features, bugs and open issues of e10s)
Firefox missed a huge opportunity in becoming the defacto secure and private browser - I know I don't love running Chrome/Chromium but I kinda have to
- kebolio 10y ago>thanks in large part to code from Chromium This is false and misleading. The only bits Firefox plans to nick from Chromium are things like the C++ PDF reader which is a regression compared to pdf.js running in a nominally memory-safe runtime. The browser itself doesn't use code lifted from Chromium.
- nikcub 10y agoIPC code: https://dxr.mozilla.org/mozilla-central/source/ipc/chromium https://dxr.mozilla.org/mozilla-central/source/ipc/chromium Sanbox code: https://dxr.mozilla.org/mozilla-central/source/security/ https://dxr.mozilla.org/mozilla-central/source/security/ ppapi: https://dxr.mozilla.org/mozilla-central/source/browser/extensions/mortar/ppapi https://dxr.mozilla.org/mozilla-central/source/browser/exten... extensions: https://dxr.mozilla.org/mozilla-central/source/browser/components/extensions https://dxr.mozilla.org/mozilla-central/source/browser/compo...