4 ms·

Is this all solved by just spawning a new process for each browser tab? If so do it and spawn a single process for the browser window UI. Communicate between

Is this all solved by just spawning a new process for each browser tab? If so do it and spawn a single process for the browser window UI. Communicate between the browser window and tab processes with whatever flavor of IPC you desire, and secure it with whatever security layer you trust (TLS 1.3+ for example). We've basically reinvented the operating system desktop, which isn't that far off from how we treat browsers and the web today anyways...

saagarjha 6y ago
Creating processes ain’t cheap.
- qbasic_forever 6y ago
  Meh, my three year old phone has 8GB of DDR4 RAM and 8x cores clocked at over 2ghz. In the time it takes my brain to send signals to move my muscles to move my mouse to a different tab my computer has lived multiple lifetimes of operations. For handling unbelievable load at scale, sure processes will kill scaling. But for handling a user clicking and touching their inputs of dozens or hundreds of tabs.. I doubt anyone will notice on today's machines.
  - saagarjha 6y ago
    Processes use RAM, and a lot of people use a lot of tabs. This isn't to say that each website couldn't have a separate process (and this is true if you browse different websites already), but memory usage isn't something you can just freely ignore even on today's hardware.
- SilasX 6y ago
  Isn't it cheap compared to the typical browser bloat though?
  - saagarjha 6y ago
    What bloat are you talking about?
    - SilasX 6y ago
      Wait, what? You mean, you're claiming that browsers are aggressively written to minimize memory usage for a given unit of functionality? Because that would be a hard case to make. I just opened example.com (a tiny, static site) in Chrome. Chrome's task manager says that tab is using 16 MB. You're saying that the minimal overhead that a new process would add is significant compared to that? Because I see numerous processes in the OS task manager right now with a significantly smaller memory footprint. If you just dropped the /s, and I didn't get the joke, consider me whooshed :-p
      - saagarjha 6y ago
        I am a bit confused, the only thing I've claimed is that making processes isn't necessarily something you can do because they use up non-negligible amounts of RAM. Sure, for a small static site this amount may not be a lot, but for most websites a hundred MB or more is the norm per tab. When browsers first started going multi-process memory usage ballooned because of the overhead, and while improvements are continually being made keeping everything in the same process would still be of significant benefit to memory usage.
        SilasX 6y ago
        Yes, a tab might 100s of MB of RAM. The question is how much more a tab would use by virtue of being a separate process vs not. Do you have a figure for this, and a reason a process spawn inherently requires a significant amount as a percentage of what browsers are using anyway?
monocasa 6y ago
From reading the threat model though I think the issue they're bringing up is that even in browsers that use per tab processes (Chrome, Firefox, etc.), they don't ubiquitously use per iframe processes in each tab. And there's a non trivial amount of work needed to get to a point where you can rely on that. As an aside, you don't have to protect local IPC with TLS. Processes that can tap IPC generally have the tools to do brain surgery on the processes and pull the secrets out of their memory anyway. Your time is better spent understanding the local IPC security mechanisms that the kernel will enforce.
- qbasic_forever 6y ago
  Yeah it's more just defense in depth. The browser is already going to have a super optimized and battle-hardened TLS engine, so might as well use that IMHO. Today we can reasonably assume process IPC is secure... but who knows what exploits will surface tomorrow. It also opens up an interesting possibility where the tab process isn't on the same machine. That could be handy for power users, or even for interesting things like browser testing apps on different, remote devices.
  - monocasa 6y ago
    I'm all about defense in depth, but for speculative security stuff like that I like to see a well thought out threat model where you actually protected against anything. Otherwise you have unbounded amounts of work (both developer human/cognitive and compute time) dedicated to security that isn't actually helping your users in a meaningful way. The issue with not trusting that the kernel can protect IPC like it's supposed to is that so many ways to get root are ultimately protected by that same IPC protection scheme. If you don't trust the kernel, in the general case you've already lost with any scheme like TLS that ultimately relies on the kernel provided primitives to do stuff like hide the secrets in the first place. You're also opening a new can of worms around boot strapping local certificate distribution to make TLS meaningful that bring you right back to the original problems.
    - qbasic_forever 6y ago
SigmundA 6y ago
Isn't that exactly what Chrome does or at least did when it initially came out? https://www.google.com/googlebooks/chrome/small_04.html https://www.google.com/googlebooks/chrome/small_04.html
heavyset_go 6y ago
At least with Firefox, there is a content process pool of a fixed size that tabs share. You can adjust its size from the preference pane.

saagarjha 6y ago

Creating processes ain’t cheap.

qbasic_forever 6y ago
Meh, my three year old phone has 8GB of DDR4 RAM and 8x cores clocked at over 2ghz. In the time it takes my brain to send signals to move my muscles to move my mouse to a different tab my computer has lived multiple lifetimes of operations. For handling unbelievable load at scale, sure processes will kill scaling. But for handling a user clicking and touching their inputs of dozens or hundreds of tabs.. I doubt anyone will notice on today's machines.
- saagarjha 6y ago
  Processes use RAM, and a lot of people use a lot of tabs. This isn't to say that each website couldn't have a separate process (and this is true if you browse different websites already), but memory usage isn't something you can just freely ignore even on today's hardware.
SilasX 6y ago
Isn't it cheap compared to the typical browser bloat though?
- saagarjha 6y ago
  What bloat are you talking about?
  - SilasX 6y ago
    Wait, what? You mean, you're claiming that browsers are aggressively written to minimize memory usage for a given unit of functionality? Because that would be a hard case to make. I just opened example.com (a tiny, static site) in Chrome. Chrome's task manager says that tab is using 16 MB. You're saying that the minimal overhead that a new process would add is significant compared to that? Because I see numerous processes in the OS task manager right now with a significantly smaller memory footprint. If you just dropped the /s, and I didn't get the joke, consider me whooshed :-p
    - saagarjha 6y ago
      I am a bit confused, the only thing I've claimed is that making processes isn't necessarily something you can do because they use up non-negligible amounts of RAM. Sure, for a small static site this amount may not be a lot, but for most websites a hundred MB or more is the norm per tab. When browsers first started going multi-process memory usage ballooned because of the overhead, and while improvements are continually being made keeping everything in the same process would still be of significant benefit to memory usage.
      - SilasX 6y ago
        Yes, a tab might 100s of MB of RAM. The question is how much more a tab would use by virtue of being a separate process vs not. Do you have a figure for this, and a reason a process spawn inherently requires a significant amount as a percentage of what browsers are using anyway?

monocasa 6y ago

From reading the threat model though I think the issue they're bringing up is that even in browsers that use per tab processes (Chrome, Firefox, etc.), they don't ubiquitously use per iframe processes in each tab. And there's a non trivial amount of work needed to get to a point where you can rely on that. As an aside, you don't have to protect local IPC with TLS. Processes that can tap IPC generally have the tools to do brain surgery on the processes and pull the secrets out of their memory anyway. Your time is better spent understanding the local IPC security mechanisms that the kernel will enforce.

qbasic_forever 6y ago
Yeah it's more just defense in depth. The browser is already going to have a super optimized and battle-hardened TLS engine, so might as well use that IMHO. Today we can reasonably assume process IPC is secure... but who knows what exploits will surface tomorrow. It also opens up an interesting possibility where the tab process isn't on the same machine. That could be handy for power users, or even for interesting things like browser testing apps on different, remote devices.
- monocasa 6y ago
  I'm all about defense in depth, but for speculative security stuff like that I like to see a well thought out threat model where you actually protected against anything. Otherwise you have unbounded amounts of work (both developer human/cognitive and compute time) dedicated to security that isn't actually helping your users in a meaningful way. The issue with not trusting that the kernel can protect IPC like it's supposed to is that so many ways to get root are ultimately protected by that same IPC protection scheme. If you don't trust the kernel, in the general case you've already lost with any scheme like TLS that ultimately relies on the kernel provided primitives to do stuff like hide the secrets in the first place. You're also opening a new can of worms around boot strapping local certificate distribution to make TLS meaningful that bring you right back to the original problems.
  - qbasic_forever 6y ago

SigmundA 6y ago

Isn't that exactly what Chrome does or at least did when it initially came out? https://www.google.com/googlebooks/chrome/small_04.html https://www.google.com/googlebooks/chrome/small_04.html

heavyset_go 6y ago

At least with Firefox, there is a content process pool of a fixed size that tabs share. You can adjust its size from the preference pane.