5 ms·

This provides more technical details: <https://hacks.mozilla.org/2021/05/introducing-firefox-new-site-isolation-security-architecture/ https://hacks.mozilla.org

This provides more technical details: <https://hacks.mozilla.org/2021/05/introducing-firefox-new-site-isolation-security-architecture/ https://hacks.mozilla.org/2021/05/introducing-firefox-new-si...>, which should be more interesting to HN than a marketing announcement. In particular, it seems that "site" isn't precisely defined. It seems to be based on domains, but backed by a human-curated list of "sites": <https://github.com/publicsuffix/list https://github.com/publicsuffix/list>. So it's different than Chrome's "every webpage gets a separate process".

nly 5y ago
They've been using the public suffix list for scoping cookies for ages. It's an important list
JonathonW 5y ago
Chrome's policy is pretty much the same; while it can generate a process-per-tab under most conditions, the guarantee it actually makes (in modern versions of Chrome) is that sites (including different-origin iframes) are isolated into different processes. They use the PSL to determine which sites constitute a different origin, just like Firefox does.
- Dylan16807 5y ago
  I don't know if "most conditions" is even true. Even when it's only running a handful of processes and I have plenty of ram free I cannot convince it to use more than one process for twitch tabs.
  - lxgr 5y ago
    I think there are some restrictions on tab "navigation source". (Something about a fairly obscure JavaScript feature that links tabs opened via click navigation, if I recall correctly.) Does this also happen when you type the Twitch URL in a new tab?
    - Dylan16807 5y ago
      Yes. Or even if I have another tab on youtube or whatever and type in twitch, it will close the youtube process and switch to sharing the existing twitch process.
  - staticassertion 5y ago
    > I cannot convince it to use more than one process for twitch tabs. Do you actually want it to? Or are you just experimenting? FWIW There's a flag related to isolation in your chrome://flags that will do per-origin.
    - Dylan16807 5y ago
      The bug might be fixed right now but yes I definitely wanted it, because opening a twitch tab was consistently causing the video in the old tab to hang for a couple seconds. > There's a flag related to isolation in your chrome://flags that will do per-origin. What flag is that? I even tried setting --process-per-site-instance and it had no effect.
      - staticassertion 5y ago
        There's "--process-per-tab" and Strict-Origin-Isolation , dunno if that'll work though
SimeVidas 5y ago
“Site” is defined in the HTML Standard: https://html.spec.whatwg.org/multipage/origin.html#same-site https://html.spec.whatwg.org/multipage/origin.html#same-site
bugmen0t 5y ago
The definition of site in this case is <https://html.spec.whatwg.org/multipage/origin.html#sites https://html.spec.whatwg.org/multipage/origin.html#sites>, for both Firefox and Chrome. If you don't like reading specs, this blog post might be interesting to you <https://web.dev/same-site-same-origin/ https://web.dev/same-site-same-origin/>.
mastazi 5y ago
The public suffix list is also used by other browsers to determine whether resources are cross origin (see below), not just by Firefox. So, I think it's a pretty authoritative list, and also consider that domains are added by formal request of the domain holder, not as a result of someone's curation. That list is the reason why CORS behaves differently e.g. across two subdomains like [subdomain].herokuapp.com (requests are considered cross origin) in comparison with two subdomains of the type [subdomain].[myowndomain.ext] (requests are considered same origin)[1] - the reason for this difference is that herokuapps.com is part of that list. [1] unless you added your own domain to the public suffix list.
- tialaramex 5y ago
  One of the maintainers of the PSL (Ryan Sleevi) has written on HN before that they'd sure like it if people leant on the PSL less rather than more. It's a nasty hack, the successor to even worse proprietary hacks but still something we ought to strive to get rid of. I can see exactly why it was the choice here, and I don't blame Mozilla for choosing it, but we're not going to make things better if nobody gets out and pushes. That said, since we're stuck with the PSL for the foreseeable, I sure would like it if Mozilla shipped a way for extensions to just consult Firefox's built-in copy of the PSL, rather than needing to either build yet another awful hack or ship the entire PSL again in an extension.
  - mastazi 5y ago
    How do you propose getting rid of the PSL? I don't see alternatives to having an authoritative publicly available list, unless we change the current standards somehow? > I sure would like it if Mozilla shipped a way for extensions to just consult Firefox's built-in copy of the PSL the PSL is available at https://publicsuffix.org/list/public_suffix_list.dat https://publicsuffix.org/list/public_suffix_list.dat - as noted elsewhere in this tread it is also used by other browsers. I guess the one built into Firefox is just downloaded from there and cached? If so why would you want that over the other?
    - tialaramex 5y ago

nly 5y ago

They've been using the public suffix list for scoping cookies for ages. It's an important list

JonathonW 5y ago

Chrome's policy is pretty much the same; while it can generate a process-per-tab under most conditions, the guarantee it actually makes (in modern versions of Chrome) is that sites (including different-origin iframes) are isolated into different processes. They use the PSL to determine which sites constitute a different origin, just like Firefox does.

Dylan16807 5y ago
I don't know if "most conditions" is even true. Even when it's only running a handful of processes and I have plenty of ram free I cannot convince it to use more than one process for twitch tabs.
- lxgr 5y ago
  I think there are some restrictions on tab "navigation source". (Something about a fairly obscure JavaScript feature that links tabs opened via click navigation, if I recall correctly.) Does this also happen when you type the Twitch URL in a new tab?
  - Dylan16807 5y ago
    Yes. Or even if I have another tab on youtube or whatever and type in twitch, it will close the youtube process and switch to sharing the existing twitch process.
- staticassertion 5y ago
  > I cannot convince it to use more than one process for twitch tabs. Do you actually want it to? Or are you just experimenting? FWIW There's a flag related to isolation in your chrome://flags that will do per-origin.
  - Dylan16807 5y ago
    The bug might be fixed right now but yes I definitely wanted it, because opening a twitch tab was consistently causing the video in the old tab to hang for a couple seconds. > There's a flag related to isolation in your chrome://flags that will do per-origin. What flag is that? I even tried setting --process-per-site-instance and it had no effect.
    - staticassertion 5y ago
      There's "--process-per-tab" and Strict-Origin-Isolation , dunno if that'll work though

SimeVidas 5y ago

“Site” is defined in the HTML Standard: https://html.spec.whatwg.org/multipage/origin.html#same-site https://html.spec.whatwg.org/multipage/origin.html#same-site

bugmen0t 5y ago

The definition of site in this case is <https://html.spec.whatwg.org/multipage/origin.html#sites https://html.spec.whatwg.org/multipage/origin.html#sites>, for both Firefox and Chrome. If you don't like reading specs, this blog post might be interesting to you <https://web.dev/same-site-same-origin/ https://web.dev/same-site-same-origin/>.

mastazi 5y ago

The public suffix list is also used by other browsers to determine whether resources are cross origin (see below), not just by Firefox. So, I think it's a pretty authoritative list, and also consider that domains are added by formal request of the domain holder, not as a result of someone's curation. That list is the reason why CORS behaves differently e.g. across two subdomains like [subdomain].herokuapp.com (requests are considered cross origin) in comparison with two subdomains of the type [subdomain].[myowndomain.ext] (requests are considered same origin)[1] - the reason for this difference is that herokuapps.com is part of that list. [1] unless you added your own domain to the public suffix list.

tialaramex 5y ago
One of the maintainers of the PSL (Ryan Sleevi) has written on HN before that they'd sure like it if people leant on the PSL less rather than more. It's a nasty hack, the successor to even worse proprietary hacks but still something we ought to strive to get rid of. I can see exactly why it was the choice here, and I don't blame Mozilla for choosing it, but we're not going to make things better if nobody gets out and pushes. That said, since we're stuck with the PSL for the foreseeable, I sure would like it if Mozilla shipped a way for extensions to just consult Firefox's built-in copy of the PSL, rather than needing to either build yet another awful hack or ship the entire PSL again in an extension.
- mastazi 5y ago
  How do you propose getting rid of the PSL? I don't see alternatives to having an authoritative publicly available list, unless we change the current standards somehow? > I sure would like it if Mozilla shipped a way for extensions to just consult Firefox's built-in copy of the PSL the PSL is available at https://publicsuffix.org/list/public_suffix_list.dat https://publicsuffix.org/list/public_suffix_list.dat - as noted elsewhere in this tread it is also used by other browsers. I guess the one built into Firefox is just downloaded from there and cached? If so why would you want that over the other?
  - tialaramex 5y ago