4 ms·

I am curious to know why you say this considering Safari is just as sandboxed as Chrome?

• tptacek 9y ago
  No, it isn't.
  • dkonofalski 9y ago
    Oh ok.
  • om2 9y ago
    Safari sandbox isn't identical to Chrome's but it's pretty effective. I don't think your statement is a fair one without qualification. ETA: we'd appreciate info about specific info wrong with Safari's sandboxing. We are definitely looking to improve it.
    • tptacek 9y ago
      You work on the Apple Safari team. Are you really saying you feel like Safari's sandbox and anti-exploit features are comparable to those of Chrome? That would be a newsworthy claim.
      • om2 9y ago
        Safari's sandbox is weaker in some ways and stronger in others. Saying which is overall stronger would be a judgment call. I wouldn't make a claim like that without spelling out at least some of the details. This subthread is about the sandbox so I'm not sure why you threw in "and anti-exploit features". I'd probably say without qualification that Chrome has better memory corruption mitigations. I hoped you might have concrete feedback on what aspects of our sandbox we should shore up. We have our own ideas but of course an informed outside view would be valuable.
        • tptacek 9y ago
          In what ways would you say the Safari sandbox is stronger than Chrome's, on macOS? How would you compare Safari's anti-exploit technology (allocator hardening, Javascript engine hardening, &c) to that of Chrome? Do you think you do anything better than Chrome does on that front?
          • nthuser 9y ago
            Why don't you first answer the question that was asked?.
          • om2 9y ago
            Your original post here made a bold claim with no qualification and no supporting details. You're not providing any backing to your claim but at the same time you're asking me to give details. Plus you've repeatedly thrown in anti-exploit tech which wasn't the original point of contention. It would be easy to get the impression that you're trying to shift the burden of proof and move the goal posts. Despite this, I will try to assume good faith. I think you original post gave the impression that Safari either has no sandbox, or has a wildly ineffective sandbox. You didn't directly state it, but at least some users understandably took away that implication. I think this is inaccurate and unfair. One piece of evidence we have is grey market prices for end-to-end Safari exploits (with full sandbox escape). By this metric, breaking out of our sandbox on Mac or iOS is not trivial, and is at least comparable in difficulty to Chrome or Edge on Mac, Windows or Android. On the flip side, it seems to be significantly easier to get inside-the-sandbox remote code execution in Safari if you go by market prices, hacking contests, etc. That's something we're working on. Chrome and Edge definitely have materially better mitigations here (as I said in my earlier post). And finally, to answer your question: One small way Safari has better sandboxing is the we sandbox our network process (something that Chrome is still working on).
            • tptacek 9y ago
              My contention was that Safari is less safe than Chrome, not that Safari's sandbox was in particular worse than Chrome's. Nevertheless, on balance, Safari's sandbox is significantly worse than Chrome's. I think --- but you'd know better than I would --- that this is because browser security is a platform problem for Apple, and an application problem at Google. Apple's platform-level mitigations are very powerful on iOS, but substantially less powerful on general-purpose operating systems. Chrome's sandboxing is specific to Chrome itself, and thus finer grained and more powerful. I think if you create a breakdown of all the facets of browser security, it will look something like this: Isolation: Chrome > Edge | Safari > Firefox Anti-Exploit: Edge > Chrome > Firefox > Safari UX: Chrome > Firefox > Safari > Edge (U2F, password manager) TLS: Chrome > Firefox > Safari | Edge Library Security: Chrome > Edge > Firefox > Safari If you want to add privacy controls here, you'll get an easy win for Safari, but privacy isn't security. You're close to this stuff though, so if you disagree with any of these informal rankings, or think I've got the rankings wrong, please correct me.
  • moogleii 9y ago
    http://news.softpedia.com/news/Safari-5-1-Protects-Users-with-New-Sandbox-212723.shtml http://news.softpedia.com/news/Safari-5-1-Protects-Users-wit...
    • tptacek 9y ago
      Just because both features are named "sandbox" doesn't make them equivalent; the exact same argument says you should also be happy to run hostile Java applets, which, after all, are sandboxed.
      • moogleii 9y ago
        Oh, now you use your words?
  • 9935c101ab17a66 9y ago
    You make this claim over and over again and then double down on it when pressed (you literally call Chrome and macOS Safari "incomparable"), but you fail to provide any reason or evidence to support your claim and instead always insist on counter-evidence. When pressed (further down in this comment thread), the only thing you share is this vague idea that Apple isn't incentivized to make Safari secure on macOS. You also compare Safari/Chrome sandboxes several times after declaring them incomparable. You then, unprompted, create a comparison of all the major browsers again with no citations or supportive reasoning. It's all very strange.