4 ms·

Why wouldn't they be allowed to use Firefox?

therein 7y ago
They are not allowed actually. However maybe a few were anyway? As far as I can tell, this attack was fully unsuccessful anyway. They probably discovered phishing attempts with a link to a page deploying a curious payload. Regardless of my post above, keep in mind I do use Firefox primarily and see nothing wrong with it.
xtalh 7y ago
It's worse than Chrome in every way. For example the privsep system is a joke. That's not to say that Chrome can't have an RCE but of course you don't have the same chances if the browser is much more secure. And if you work in an environment like Coinbase's you really should not take chances.
- ga-vu 7y ago
  Probably because 85% of the browser market it's Chromium-based, while the rest is not. Hence, a smaller attack surface.
  - icebraining 7y ago
    That's not what "attack surface" means. Firefox would have a smaller attack surface if it supported fewer file formats or protocols or such than Chrome.
    - ga-vu 7y ago
      True. A smaller target base would have been the correct term.
- wlesieutre 7y ago
  Are we forgetting that Chrome had a zero-day literally three months ago? https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/analysis-of-a-chrome-zero-day-cve-2019-5786/ https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/... > Google is aware of reports that an exploit for CVE-2019-5786 exists in the wild.
  - deleted 7y ago
    [deleted]
  - deleted 7y ago
    [deleted]
  - icebraining 7y ago
    While I'm a Firefox user, that's actually evidence to xtalh's point: that bug by itself is useless, because Chrome's sandbox meant that taking over the rendering process is not enough. They only managed to escape on Windows 7, thanks to another bug (in Windows itself - CVE-2019-0808).
    - pcwalton 7y ago
      Note that Firefox has a sandbox too (in fact, it shares a good bit of code with that of Chrome), and therefore a sandbox escape is necessary to elevate privileges. (NB: I have no knowledge of the details of this specific bug.)
    - laughinghan 7y ago
      Leaving aside whether it makes sense to call something "useless" that was actually used in the wild, the original article specifically mentions (twice) that the Firefox RCE 0-day was also sandboxed and also only managed to escape thanks to another 0-day. (And I'm actually a Chrome user, for now.)
- _wmd 7y ago
  You almost make it sound like Chrome weren't written in C++, or that the typical Chrome install weren't hosted on a few 10s of millions of lines of C/C++
  - xtalh 7y ago
    I make it sound like Chrome has privsev while Firefox has shit.

They are not allowed actually. However maybe a few were anyway? As far as I can tell, this attack was fully unsuccessful anyway. They probably discovered phishing attempts with a link to a page deploying a curious payload. Regardless of my post above, keep in mind I do use Firefox primarily and see nothing wrong with it.

xtalh 7y ago

It's worse than Chrome in every way. For example the privsep system is a joke. That's not to say that Chrome can't have an RCE but of course you don't have the same chances if the browser is much more secure. And if you work in an environment like Coinbase's you really should not take chances.

ga-vu 7y ago
Probably because 85% of the browser market it's Chromium-based, while the rest is not. Hence, a smaller attack surface.
- icebraining 7y ago
  That's not what "attack surface" means. Firefox would have a smaller attack surface if it supported fewer file formats or protocols or such than Chrome.
  - ga-vu 7y ago
    True. A smaller target base would have been the correct term.
wlesieutre 7y ago
Are we forgetting that Chrome had a zero-day literally three months ago? https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/analysis-of-a-chrome-zero-day-cve-2019-5786/ https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/... > Google is aware of reports that an exploit for CVE-2019-5786 exists in the wild.
- deleted 7y ago
  [deleted]
- deleted 7y ago
  [deleted]
- icebraining 7y ago
  While I'm a Firefox user, that's actually evidence to xtalh's point: that bug by itself is useless, because Chrome's sandbox meant that taking over the rendering process is not enough. They only managed to escape on Windows 7, thanks to another bug (in Windows itself - CVE-2019-0808).
  - pcwalton 7y ago
    Note that Firefox has a sandbox too (in fact, it shares a good bit of code with that of Chrome), and therefore a sandbox escape is necessary to elevate privileges. (NB: I have no knowledge of the details of this specific bug.)
  - laughinghan 7y ago
    Leaving aside whether it makes sense to call something "useless" that was actually used in the wild, the original article specifically mentions (twice) that the Firefox RCE 0-day was also sandboxed and also only managed to escape thanks to another 0-day. (And I'm actually a Chrome user, for now.)
_wmd 7y ago
You almost make it sound like Chrome weren't written in C++, or that the typical Chrome install weren't hosted on a few 10s of millions of lines of C/C++
- xtalh 7y ago
  I make it sound like Chrome has privsev while Firefox has shit.