7 ms·

I presume that I can I take it from the lack of comment on the Firefox angle that there are no concerns that Firefox is inherently less secure than Chrome?

larrik 7y ago
Chrome had a nasty one back in March, so your presumption seems correct. Really, the best way to protect yourself is to use an obscure OS, or a separate machine for web browsing. Sounds paranoid, but the web is THE main attack vector these days.
- mnw21cam 7y ago
  There are disadvantages to using an obscure OS too, in that it is likely slower to get security fixes, and may have more security flaws.
  - albertgoeswoof 7y ago
    The only logical answer is to write your own OS The ultimate security by obscurity
  - danieldk 7y ago
    You could use something like NixOS, which has interpreters, libc, etc. in non-canonical paths. And you still have the protections of Linux and speedy security updates. Of course, this is security by obscurity, an attacker could adjust the malware for such cases.
- 2a96eb7d685a49c 7y ago
  You could use Qubes OS[0] which will allow you to isolate different aspects of your computing into separate VMs easily. [0] https://www.qubes-os.org/ https://www.qubes-os.org/
- veeti 7y ago
  Or disable JavaScript, which is the cause of most RCE exploits.
  - sireat 7y ago
    Do you mean whitelist JavasScript to known good sites? HN is about the only site that I frequent that is usable without JS. The progressive enhancement ship has sailed into abyss.
danShumway 7y ago
Previous discussion about the zero-day itself: https://news.ycombinator.com/item?id=20233952 https://news.ycombinator.com/item?id=20233952 Browsers have zero-days sometimes; this is a valid question worth asking, but for now I wouldn't tell anyone to ditch Firefox over this, any more than I would tell someone to ditch MacOS over this.
Jwarder 7y ago
How common are browser 0-days? It seems like everyone makes mistakes. Eg Chrome patched CVE-2019-5786 last month.

larrik 7y ago

Chrome had a nasty one back in March, so your presumption seems correct. Really, the best way to protect yourself is to use an obscure OS, or a separate machine for web browsing. Sounds paranoid, but the web is THE main attack vector these days.

mnw21cam 7y ago
There are disadvantages to using an obscure OS too, in that it is likely slower to get security fixes, and may have more security flaws.
- albertgoeswoof 7y ago
  The only logical answer is to write your own OS The ultimate security by obscurity
- danieldk 7y ago
  You could use something like NixOS, which has interpreters, libc, etc. in non-canonical paths. And you still have the protections of Linux and speedy security updates. Of course, this is security by obscurity, an attacker could adjust the malware for such cases.
2a96eb7d685a49c 7y ago
You could use Qubes OS[0] which will allow you to isolate different aspects of your computing into separate VMs easily. [0] https://www.qubes-os.org/ https://www.qubes-os.org/
veeti 7y ago
Or disable JavaScript, which is the cause of most RCE exploits.
- sireat 7y ago
  Do you mean whitelist JavasScript to known good sites? HN is about the only site that I frequent that is usable without JS. The progressive enhancement ship has sailed into abyss.

danShumway 7y ago

Previous discussion about the zero-day itself: https://news.ycombinator.com/item?id=20233952 https://news.ycombinator.com/item?id=20233952 Browsers have zero-days sometimes; this is a valid question worth asking, but for now I wouldn't tell anyone to ditch Firefox over this, any more than I would tell someone to ditch MacOS over this.

Jwarder 7y ago

How common are browser 0-days? It seems like everyone makes mistakes. Eg Chrome patched CVE-2019-5786 last month.