4 ms·

The reason why I want to see a virtualized web browser is because it is becoming an insanely complex piece of software with an insanely large attack surface. I

The reason why I want to see a virtualized web browser is because it is becoming an insanely complex piece of software with an insanely large attack surface. I do not want my browser to be able to talk to Bluetooth devices that are connected to my desktop. I do not want want my browser to be able to access random files on my file system simply because it is accessible to me. I do not want a web browser have ability to have GPU access outside the specific virtualized section of it that can only access the part of the screen and off-screen buffers associated with the window of a browser. I started localizing different web browsers into dedicated VMs that have just a minimal operating system and a web browser. It works well enough for my use case ( i can playback youtube video almost like I could do it on my 2015 laptop ) but it is definitely hacky.

MaxBarraclough 7y ago
> The reason why I want to see a virtualized web browser is because it is becoming an insanely complex piece of software with an insanely large attack surface. This is true, and it's the reason Chromium goes to great lengths to sandbox itself to contain the damage regarding JavaScript engine exploits. Annoyingly Firefox is lagging behind in that regard. > I do not want a web browser have ability to have GPU access outside the specific virtualized section of it that can only access the part of the screen and off-screen buffers associated with the window of a browser. Virtualisation will improve your general security, but it's isn't a perfect abstraction especially when it comes to GPUs, and it's not a rock-solid guarantee of the isolation assurances you want. [0] I believe cloud-computing providers never split a GPU between customers, for instance. Disabling sharing of the GPU with the VM would further improve your security at the price of performance. [0] https://www.hpcwire.com/2018/05/31/gpus-excellent-performance-but-what-about-security/ https://www.hpcwire.com/2018/05/31/gpus-excellent-performanc...
- fbender 7y ago
  > Annoyingly Firefox is lagging behind in that regard. This has not been true since quite a while. Firefox has employed sandboxing even before the multi-process work (which culminated in the Quantum branches of Fx releases that added more and more sandboxing with each release). Before that, Moz went a different way than OS level sandboxing by principal containerization (I forgot the correct term, sorry), which worked in terms of separation of execution contexts (of Web JS and other parts like the styling system, plus the browser internals). Elements of that implementation have been removed by now (iirc) since the multi-process split required different communication paths anyway (which also enabled per-origin/-tab/-window OS-Level sandboxing), so that code was no longer needed.
  - MaxBarraclough 7y ago
    Thanks for the reply, you know much more about it than I do. What could an attacker do if they were able to trick the JIT into emitting evil native code?
    - fbender 7y ago
      I would say there is no simple answer to your question. However, I am not able to give you an authoritative answer to your question anyway. If you are interested, you can start here[1] or try and ping the moz-security people [1] https://wiki.mozilla.org/Security/Sandbox https://wiki.mozilla.org/Security/Sandbox
      - MaxBarraclough 7y ago
        Thanks

MaxBarraclough 7y ago

> The reason why I want to see a virtualized web browser is because it is becoming an insanely complex piece of software with an insanely large attack surface. This is true, and it's the reason Chromium goes to great lengths to sandbox itself to contain the damage regarding JavaScript engine exploits. Annoyingly Firefox is lagging behind in that regard. > I do not want a web browser have ability to have GPU access outside the specific virtualized section of it that can only access the part of the screen and off-screen buffers associated with the window of a browser. Virtualisation will improve your general security, but it's isn't a perfect abstraction especially when it comes to GPUs, and it's not a rock-solid guarantee of the isolation assurances you want. [0] I believe cloud-computing providers never split a GPU between customers, for instance. Disabling sharing of the GPU with the VM would further improve your security at the price of performance. [0] https://www.hpcwire.com/2018/05/31/gpus-excellent-performance-but-what-about-security/ https://www.hpcwire.com/2018/05/31/gpus-excellent-performanc...

fbender 7y ago
> Annoyingly Firefox is lagging behind in that regard. This has not been true since quite a while. Firefox has employed sandboxing even before the multi-process work (which culminated in the Quantum branches of Fx releases that added more and more sandboxing with each release). Before that, Moz went a different way than OS level sandboxing by principal containerization (I forgot the correct term, sorry), which worked in terms of separation of execution contexts (of Web JS and other parts like the styling system, plus the browser internals). Elements of that implementation have been removed by now (iirc) since the multi-process split required different communication paths anyway (which also enabled per-origin/-tab/-window OS-Level sandboxing), so that code was no longer needed.
- MaxBarraclough 7y ago
  Thanks for the reply, you know much more about it than I do. What could an attacker do if they were able to trick the JIT into emitting evil native code?
  - fbender 7y ago
    I would say there is no simple answer to your question. However, I am not able to give you an authoritative answer to your question anyway. If you are interested, you can start here[1] or try and ping the moz-security people [1] https://wiki.mozilla.org/Security/Sandbox https://wiki.mozilla.org/Security/Sandbox
    - MaxBarraclough 7y ago
      Thanks