3 ms·

Google have certainly done a great job of maximizing the PR benefit from their security researchers. And it’s a great thing they’re doing. But regardless of how

Google have certainly done a great job of maximizing the PR benefit from their security researchers. And it’s a great thing they’re doing. But regardless of how well individual companies market their respective security teams, Firefox has a comparable reputation for their browser engine. Yes some of that might be thanks to PZ, but that’s beside the point, isn’t it? Choosing Mozilla’s platform would have been better for code diversity, which has its own distinct security benefits.

rtpg 7y ago
I can understand value in multiple browsers for experimenting with new things (see Rust integration into Mozilla's engine), but what are the security benefits? Like if you have 3 different crypto imlpementations, you have times more teams that have to get a thing right. It seems way easier to try and get it right just once. Perhaps there's a holistic idea of "if one browser has an issue, at least it doesn't affect 100% of them" but given what CVEs look like in reality (often variations of the same attack across multiple programs) it seems like the cost/benefit would not be in our favor
- core-questions 7y ago
  > what are the security benefits? Not everyone gets hit with every attack. Biological systems work this way too.
- kortilla 7y ago
  Multiple implementations is a great way to highlight issues in the spec vs reality (assumptions, unspecified behavior, etc). If you only have one implementation, the implementation becomes the spec and you end up with people targeting compatibility for that rather than a specification. This happened with Cisco routers back in the day, Juniper had to add a flag to make a routing protocol compatible with Cisco because Cisco implemented it wrong but had so much dominance that Juniper had no choice if they wanted to get in the game.
- sjwright 7y ago
  The biggest security benefit is that competition motivates everyone to work harder, to explore alternative solutions, to raise expectations. Competition means investing in ideas like Rust and Servo. Without serious competition you eventually get IE6.
Scarbutt 7y ago
* Firefox has a comparable reputation for their browser engine.* Is this really true? someone posted somewhere(can't find it) where it shows Firefox has a worst security record compared to Chrome. Also, in the past, Firefox was left out from hacking browser competitions because it was to easy to hack.
asiachick 7y ago
This is flatly not true. Just dig through the CVEs and you'll see while they have a similar number of bugs Chrome's are mostly in the harmless category (browser got DOSed) where as Firefox's has had like 10x the bad category (code got executed outside the sandbox).

rtpg 7y ago

I can understand value in multiple browsers for experimenting with new things (see Rust integration into Mozilla's engine), but what are the security benefits? Like if you have 3 different crypto imlpementations, you have times more teams that have to get a thing right. It seems way easier to try and get it right just once. Perhaps there's a holistic idea of "if one browser has an issue, at least it doesn't affect 100% of them" but given what CVEs look like in reality (often variations of the same attack across multiple programs) it seems like the cost/benefit would not be in our favor

core-questions 7y ago
> what are the security benefits? Not everyone gets hit with every attack. Biological systems work this way too.
kortilla 7y ago
Multiple implementations is a great way to highlight issues in the spec vs reality (assumptions, unspecified behavior, etc). If you only have one implementation, the implementation becomes the spec and you end up with people targeting compatibility for that rather than a specification. This happened with Cisco routers back in the day, Juniper had to add a flag to make a routing protocol compatible with Cisco because Cisco implemented it wrong but had so much dominance that Juniper had no choice if they wanted to get in the game.
sjwright 7y ago
The biggest security benefit is that competition motivates everyone to work harder, to explore alternative solutions, to raise expectations. Competition means investing in ideas like Rust and Servo. Without serious competition you eventually get IE6.

Scarbutt 7y ago

* Firefox has a comparable reputation for their browser engine.* Is this really true? someone posted somewhere(can't find it) where it shows Firefox has a worst security record compared to Chrome. Also, in the past, Firefox was left out from hacking browser competitions because it was to easy to hack.

asiachick 7y ago

This is flatly not true. Just dig through the CVEs and you'll see while they have a similar number of bugs Chrome's are mostly in the harmless category (browser got DOSed) where as Firefox's has had like 10x the bad category (code got executed outside the sandbox).