3 ms·

It still is behind technically isn't it? Does Firefox support Site Isolation yet?

by cromwellian 8y ago

throwawaymath 8y ago
No, Firefox doesn't have Site Isolation. It's a planned feature addition.
deleted 8y ago
[deleted]
pcwalton 8y ago
There are features Chrome has that Firefox doesn't. There are also features that Firefox has that Chrome doesn't, such as Stylo and WebRender. You can argue that Site Isolation is more important than large performance improvements (I think that's a losing argument, given that Site Isolation as presently deployed in Chrome doesn't even defend against compromised renderers and as such is restricted to being another Spectre mitigation), but you're being way too glib here.
- cromwellian 8y ago
  I'm not being glib, my current work involves security and privacy, and so I'm more sensitive / concerned about those issues than rendering performance. Current JITs like V8 even give me the willies in terms of attack surface area, such that I'm willing to stomach something like a WASM interpreter for my use cases. I recognize that WebRender is a huge technique achievement and I absolutely love it when people achieve silky smooth 60fps renders, and if I was working on games or graphics or UX, I'd probably rank that over top of Site Isolation. The original post mentioned process isolation and flash, so my comment was more a long the lines of 'it's still behind chrome (in isolation)'
  - pcwalton 8y ago
    Even if all you care about is security, I don't think Site Isolation makes a real-world difference right now, as it's simply a defense-in-depth Spectre mitigation in case the first-line Spectre mitigations, which are deployed in both Chrome and Firefox, fail. At present, using Site Isolation to protect against compromised renderers is a TODO for both Chrome and Firefox. It's true that Chrome is closer to getting there, though.
    - readittwice 8y ago
      Please correct me if am wrong: But I think both Chrome and Safari have disabled/removed their Spectre-mitigations in the JS engine.
      - ripsawridge 8y ago
        For Chrome the TurboFan (jit optimizing compiler) Spectre mitigations are turned off when site isolation is on.

It still is behind technically isn't it? Does Firefox support Site Isolation yet?

throwawaymath 8y ago

No, Firefox doesn't have Site Isolation. It's a planned feature addition.

deleted 8y ago

[deleted]

pcwalton 8y ago

There are features Chrome has that Firefox doesn't. There are also features that Firefox has that Chrome doesn't, such as Stylo and WebRender. You can argue that Site Isolation is more important than large performance improvements (I think that's a losing argument, given that Site Isolation as presently deployed in Chrome doesn't even defend against compromised renderers and as such is restricted to being another Spectre mitigation), but you're being way too glib here.

cromwellian 8y ago
I'm not being glib, my current work involves security and privacy, and so I'm more sensitive / concerned about those issues than rendering performance. Current JITs like V8 even give me the willies in terms of attack surface area, such that I'm willing to stomach something like a WASM interpreter for my use cases. I recognize that WebRender is a huge technique achievement and I absolutely love it when people achieve silky smooth 60fps renders, and if I was working on games or graphics or UX, I'd probably rank that over top of Site Isolation. The original post mentioned process isolation and flash, so my comment was more a long the lines of 'it's still behind chrome (in isolation)'
- pcwalton 8y ago
  Even if all you care about is security, I don't think Site Isolation makes a real-world difference right now, as it's simply a defense-in-depth Spectre mitigation in case the first-line Spectre mitigations, which are deployed in both Chrome and Firefox, fail. At present, using Site Isolation to protect against compromised renderers is a TODO for both Chrome and Firefox. It's true that Chrome is closer to getting there, though.
  - readittwice 8y ago
    Please correct me if am wrong: But I think both Chrome and Safari have disabled/removed their Spectre-mitigations in the JS engine.
    - ripsawridge 8y ago
      For Chrome the TurboFan (jit optimizing compiler) Spectre mitigations are turned off when site isolation is on.