7 ms·

You are right. I did and do not say every chrome user is stupid, there might be legitimate use-cases. But the vast amount of people just install chrome or get i

You are right. I did and do not say every chrome user is stupid, there might be legitimate use-cases. But the vast amount of people just install chrome or get it side-loaded with some freeware and don't even think about their options and the impact of their choice. Now that is less than smart.

pvg 10y ago
It's the most secure browser available. That's a not a 'might be legitimate' use case.
- smnscu 10y ago
  Citation needed. I found this [0] but maybe you have a better source. This was interesting though: > In the most recent Pwn2Own hacking competition, Chrome came out ahead of every other browser with only one exploit being successfully executed. 0: https://tiptopsecurity.com/what-is-the-most-secure-web-browser/ https://tiptopsecurity.com/what-is-the-most-secure-web-brows...
  - hackuser 10y ago
    FWIW, though I'm an avid supporter of Firefox and use it, my very consistent observation is that security experts believe, * Chrome/Chromium is more secure against attacks by governments or criminals (i.e., attacks against the integrity of the system; I can't think of the right word). * Firefox may be more secure against advertising and corporate confidentiality attacks. * Firefox with certain add-ons, too technical for most users, may be as secure as Chrome/Chromium.
    - pvg 10y ago
      The fundamental difference is that Google is a gigantic engineering organization that dedicates enormous resources to security, benefiting Chrome directly and indirectly. Over the years, lots of work has been done to ensure and improve its security at a design and architectural level. Firefox, as this announcement shows, is just getting around to freeing itself from design decisions which may have made sense over a decade ago when Mozilla had 'software suite' ambitions but we now know are a liability for something with the security demands of a browser.
      - johnsmith21006 10y ago
        Plus Google has much broader view and data to secure Chrome well beyond FF is going to be able to accomplish. Plus Google has far more to loose.
      - hackuser 10y ago
        > design decisions which may have made sense over a decade ago when Mozilla had 'software suite' ambitions It doesn't change your overall point, but I think this part is incorrect. AFAIK abandoning those ambitions was the reason they left Seamonkey behind and developed Firefox.
        pvg 10y ago
        Firefox started well before Seamonkey was spun out, and they continued with Thunderbird anyway. But the details of the history of the ambitions don't matter, what matters is that these architectural decisions were made a long, long time ago but their consequences are still there. You can decide you're not going make an app suite, that doesn't magically re-architect the internals of the product you have. Take a look at this announcement from Netscape, in 2000 (AD): https://gilbane.com/2000/03/netscape-announces-gecko-adoptees-xul-netscape-6/ https://gilbane.com/2000/03/netscape-announces-gecko-adoptee... Support for XUL addons is being dropped now. That's a long echo.
        hackuser 10y ago
        > You can decide you're not going make an app suite, that doesn't magically re-architect the internals of the product you have. I'm not sure how that applies. Firefox wasn't magic; Mozilla rewrote their browser intentionally and put a lot of resources into it. > Firefox started well before Seamonkey was spun out My understanding of that statement is that they didn't drop the old product until the new one was succeeding in the marketplace. I'm not sure how that impacts what I said.
        pvg 10y ago
        Firefox wasn't magic; Mozilla rewrote their browser intentionally and put a lot of resources into it. No no, they didn't. Firefox and Mozilla (and even later versions of Netscape) share the same architectural underpinnings. That's sort of the intent and cleverness of it, it's really an entire system for writing cross-platform apps, with its own 'language independent' component model, gui layer, etc. The things that made Firefox possible also made all-powerful Firefox extensions possible. Much of that architecture is still around. In the intervening years, it's become obvious this is not necessarily a good way to build a browser. Which is why they are dropping XUL/XPCOM extensions. If they'd 'rewritten' it, they wouldn't need to do that. My understanding of that statement is that they didn't drop the old product until the new one was succeeding in the marketplace. I'm talking about common architecture, not products. If you're unfamiliar with it, just scroll through this https://en.wikipedia.org/wiki/XPCOM https://en.wikipedia.org/wiki/XPCOM If you are familiar with it, I guess I don't understand what your objection is.
  - McCirculaire 10y ago
    http://www.cvedetails.com/product/3264/Mozilla-Firefox.html?.. http://www.cvedetails.com/product/3264/Mozilla-Firefox.html?.... http://www.cvedetails.com/product/15031/Google-Chrome.html?v.. http://www.cvedetails.com/product/15031/Google-Chrome.html?v.... Just compare the amount of code execution CVEs found on a yearly basis and the level of severity of each. Then think of how Firefox has much less marketshare than Chrome (FF sits around 8% and its share keeps going down year by year), so Chrome should be a more interesting target for hacking. Then come back and tell us which browser has the lesser amount, and when some are found, which is most likely to have the more severely exploitable vuln.
- josteink 10y ago
  > It's the most secure browser available. That's a not a 'might be legitimate' use case. It may be Jesus on a popsicle, but I'm not going to trust something distributed via drive-by-installers, marketed through SPAM and made by the world's biggest data-hoarder and privacy-invader no matter what. It's adware/malware short and simple. Make it 100% FOSS. Remove any technical connection to Google. Don't require Google-logon to sync. Only distribute it to users who actually asked to have it installed. Etc etc. At that point I might consider starting trusting it. Not before.
  - pvg 10y ago
    So, like https://www.chromium.org/Home https://www.chromium.org/Home Personally, I'd at definitely consider using Jesus on a popsicle, if the opportunity arose, just to see what it's like. Not that it has so far, sadly.
    - josteink 10y ago
      Chromium still requires you to log into a google account and share your private data with google to sync. Definitely not an option.
      - pvg 10y ago
        To sync what? I use Chrome and never log into a non-web google account. In fact, I'm able to browse the web without 'syncing' anything.
        josteink 10y ago
        Bookmarks, history, passwords etc. I don't want to give those to google. Is that unreasonable?
        pvg 10y ago
        No, not at all but by the vehemence of your reply, you make it sound like Chrome or Chromium force you to give these things to google. And I don't think they do.
greggman 10y ago
Go look at the CVE reports for each browser. Your taking a > 10x risk running anything other than Chrome. These changes Mozilla is making are to fix that.
- icebraining 10y ago
  If I want to reduce computing security risks I'll use a calculator. Everything else comes with tradeoffs, and for many of us, these aren't worth it.
  - aseipp 10y ago
    The answer to "This piece of software has a track record of being more secure than this one, due to its design, and these changes in part help fix that disparity" IS NOT "I'm going to use a calculator now because nothing can be secure so what's the point anyway stop trying to force me to eat my dinner vegetables i'm not listening". I don't even know why this needs to be said, because it's fairly obvious nobody on Earth actually does risk analysis this way. I mean, unless you're a programmer with some sort of brain worm infestation, who cannot read between the lines, and have an inability to understand how people in the real world do (and must) operate, clearly.
    - icebraining 10y ago
      From your other posts you seem like a reasonable person, so I'll try to explain myself better despite the verbal abuse. I realize that some software is more secure than others, and that changes can be made to make it more secure. My point is that you can't simply say "therefore these changes are necessarily good", because there is more to software than security, and those changes often involve tradeoffs in other areas, which have to be weighted. For some of us, in this case, those tradeoffs aren't worth it.
- michaelmrose 10y ago
  Making up numbers doesn't help the discussion. Can you prove that firefox users are at all more likely to be infected in practice? I doubt it. You surely can't prove they are 10x.

pvg 10y ago

It's the most secure browser available. That's a not a 'might be legitimate' use case.

smnscu 10y ago
Citation needed. I found this [0] but maybe you have a better source. This was interesting though: > In the most recent Pwn2Own hacking competition, Chrome came out ahead of every other browser with only one exploit being successfully executed. 0: https://tiptopsecurity.com/what-is-the-most-secure-web-browser/ https://tiptopsecurity.com/what-is-the-most-secure-web-brows...
- hackuser 10y ago
  FWIW, though I'm an avid supporter of Firefox and use it, my very consistent observation is that security experts believe, * Chrome/Chromium is more secure against attacks by governments or criminals (i.e., attacks against the integrity of the system; I can't think of the right word). * Firefox may be more secure against advertising and corporate confidentiality attacks. * Firefox with certain add-ons, too technical for most users, may be as secure as Chrome/Chromium.
  - pvg 10y ago
    The fundamental difference is that Google is a gigantic engineering organization that dedicates enormous resources to security, benefiting Chrome directly and indirectly. Over the years, lots of work has been done to ensure and improve its security at a design and architectural level. Firefox, as this announcement shows, is just getting around to freeing itself from design decisions which may have made sense over a decade ago when Mozilla had 'software suite' ambitions but we now know are a liability for something with the security demands of a browser.
    - johnsmith21006 10y ago
      Plus Google has much broader view and data to secure Chrome well beyond FF is going to be able to accomplish. Plus Google has far more to loose.
    - hackuser 10y ago
      > design decisions which may have made sense over a decade ago when Mozilla had 'software suite' ambitions It doesn't change your overall point, but I think this part is incorrect. AFAIK abandoning those ambitions was the reason they left Seamonkey behind and developed Firefox.
      - pvg 10y ago
        Firefox started well before Seamonkey was spun out, and they continued with Thunderbird anyway. But the details of the history of the ambitions don't matter, what matters is that these architectural decisions were made a long, long time ago but their consequences are still there. You can decide you're not going make an app suite, that doesn't magically re-architect the internals of the product you have. Take a look at this announcement from Netscape, in 2000 (AD): https://gilbane.com/2000/03/netscape-announces-gecko-adoptees-xul-netscape-6/ https://gilbane.com/2000/03/netscape-announces-gecko-adoptee... Support for XUL addons is being dropped now. That's a long echo.
        hackuser 10y ago
        > You can decide you're not going make an app suite, that doesn't magically re-architect the internals of the product you have. I'm not sure how that applies. Firefox wasn't magic; Mozilla rewrote their browser intentionally and put a lot of resources into it. > Firefox started well before Seamonkey was spun out My understanding of that statement is that they didn't drop the old product until the new one was succeeding in the marketplace. I'm not sure how that impacts what I said.
        pvg 10y ago
        Firefox wasn't magic; Mozilla rewrote their browser intentionally and put a lot of resources into it. No no, they didn't. Firefox and Mozilla (and even later versions of Netscape) share the same architectural underpinnings. That's sort of the intent and cleverness of it, it's really an entire system for writing cross-platform apps, with its own 'language independent' component model, gui layer, etc. The things that made Firefox possible also made all-powerful Firefox extensions possible. Much of that architecture is still around. In the intervening years, it's become obvious this is not necessarily a good way to build a browser. Which is why they are dropping XUL/XPCOM extensions. If they'd 'rewritten' it, they wouldn't need to do that. My understanding of that statement is that they didn't drop the old product until the new one was succeeding in the marketplace. I'm talking about common architecture, not products. If you're unfamiliar with it, just scroll through this https://en.wikipedia.org/wiki/XPCOM https://en.wikipedia.org/wiki/XPCOM If you are familiar with it, I guess I don't understand what your objection is.
- McCirculaire 10y ago
  http://www.cvedetails.com/product/3264/Mozilla-Firefox.html?.. http://www.cvedetails.com/product/3264/Mozilla-Firefox.html?.... http://www.cvedetails.com/product/15031/Google-Chrome.html?v.. http://www.cvedetails.com/product/15031/Google-Chrome.html?v.... Just compare the amount of code execution CVEs found on a yearly basis and the level of severity of each. Then think of how Firefox has much less marketshare than Chrome (FF sits around 8% and its share keeps going down year by year), so Chrome should be a more interesting target for hacking. Then come back and tell us which browser has the lesser amount, and when some are found, which is most likely to have the more severely exploitable vuln.
josteink 10y ago
> It's the most secure browser available. That's a not a 'might be legitimate' use case. It may be Jesus on a popsicle, but I'm not going to trust something distributed via drive-by-installers, marketed through SPAM and made by the world's biggest data-hoarder and privacy-invader no matter what. It's adware/malware short and simple. Make it 100% FOSS. Remove any technical connection to Google. Don't require Google-logon to sync. Only distribute it to users who actually asked to have it installed. Etc etc. At that point I might consider starting trusting it. Not before.
- pvg 10y ago
  So, like https://www.chromium.org/Home https://www.chromium.org/Home Personally, I'd at definitely consider using Jesus on a popsicle, if the opportunity arose, just to see what it's like. Not that it has so far, sadly.
  - josteink 10y ago
    Chromium still requires you to log into a google account and share your private data with google to sync. Definitely not an option.
    - pvg 10y ago
      To sync what? I use Chrome and never log into a non-web google account. In fact, I'm able to browse the web without 'syncing' anything.
      - josteink 10y ago
        Bookmarks, history, passwords etc. I don't want to give those to google. Is that unreasonable?
        pvg 10y ago
        No, not at all but by the vehemence of your reply, you make it sound like Chrome or Chromium force you to give these things to google. And I don't think they do.

greggman 10y ago

Go look at the CVE reports for each browser. Your taking a > 10x risk running anything other than Chrome. These changes Mozilla is making are to fix that.

icebraining 10y ago
If I want to reduce computing security risks I'll use a calculator. Everything else comes with tradeoffs, and for many of us, these aren't worth it.
- aseipp 10y ago
  The answer to "This piece of software has a track record of being more secure than this one, due to its design, and these changes in part help fix that disparity" IS NOT "I'm going to use a calculator now because nothing can be secure so what's the point anyway stop trying to force me to eat my dinner vegetables i'm not listening". I don't even know why this needs to be said, because it's fairly obvious nobody on Earth actually does risk analysis this way. I mean, unless you're a programmer with some sort of brain worm infestation, who cannot read between the lines, and have an inability to understand how people in the real world do (and must) operate, clearly.
  - icebraining 10y ago
    From your other posts you seem like a reasonable person, so I'll try to explain myself better despite the verbal abuse. I realize that some software is more secure than others, and that changes can be made to make it more secure. My point is that you can't simply say "therefore these changes are necessarily good", because there is more to software than security, and those changes often involve tradeoffs in other areas, which have to be weighted. For some of us, in this case, those tradeoffs aren't worth it.
michaelmrose 10y ago
Making up numbers doesn't help the discussion. Can you prove that firefox users are at all more likely to be infected in practice? I doubt it. You surely can't prove they are 10x.