3 ms·

What do you think makes Chrome's sandbox "far superior" on Linux? AFAIK they're very similar.

by roca 5y ago

sneak 5y ago
The rate at which escapes are found (and publicly disclosed) suggests to me that the Chrome sandbox is substantially more advanced than any other browser's. Perhaps there are just as many escapes being found each quarter in Chrome as the other browsers and they are just being hoarded privately but I don't find that super plausible.
- roca 5y ago
  Where are you getting that data? I'm genuinely interested. FWIW I think it is probable that the IPC APIs into and out of the sandbox have been more thoroughly fuzzed and otherwise tested in Chrome than in Firefox. I don't know how that translates into actual security though.
genghizkhan 5y ago
This is typically what I cite when people ask me about FF vs Chrome security: https://madaidans-insecurities.github.io/firefox-chromium.html https://madaidans-insecurities.github.io/firefox-chromium.ht... And here's Theo de Raadt's opinion of Firefox from back in 2018: https://marc.info/?l=openbsd-misc&m=152872551609819&w=2 https://marc.info/?l=openbsd-misc&m=152872551609819&w=2
- aorth 5y ago
  Your first link is a good resource. Thanks! I'm not a security researcher, but perhaps I can add a few comments on their discussion for other users who might not be familiar with the specifics: > Firefox's sandboxing lacks any site isolation. Site isolation runs every website inside its own sandbox so that an exploit in one website cannot access the data from another. It does seem that Firefox's site isolation is becoming more ready. From a Mozilla blog post two days ago, with instructions how to manually enable it on Firefox stable, beta, or nightly: https://blog.mozilla.org/security/2021/05/18/introducing-site-isolation-in-firefox/ https://blog.mozilla.org/security/2021/05/18/introducing-sit... Also, from the same link, they mention X11: > One example of such sandbox escape flaws is X11 — X11 doesn't implement any GUI isolation which makes it very easy to escape sandboxes with it. Definitely true that X11 sucks (sorry NVIDIA users). So we have Wayland becoming more mainstream now. I've been using it for several years already, on GNOME and Sway. Working great... even Electron is native now (Signal, VS Code, etc). And lastly, they rightly mention Pulseaudio: > PulseAudio is a common sound server on Linux however, it was not written with isolation in mind, making it possible to escape sandboxes with it. In the last few months PipeWire became a mature drop-in substitute for Pulseaudio in my experience. It was designed with isolation in mind, and a whole bunch of other things. Hoping Firefox can bridge the gap in security with Chrome so we can wholeheartedly recommend it to people without caveats! We deserve a fast, full-featured, secure, and open source alternative to proprietary web browsers.
- roca 5y ago
  Your first link is a good resource, thanks; it points out many valid issues where Firefox needs to catch up. It is definitely slanted though; for example Firefox's Rust usage is compared to Chromium talking about maybe using Rust someday and the conclusion is "so that's a wash". Also, "the parts that are memory safe do not include important attack surfaces" isn't correct; all C++ code that manages dynamic memory is attack surface. A slightly tangential issue is that the mitigations section is not super compelling to me because I think many mitigations are low-value. Evaluation of mitigations typically does not ask the right questions: How much work is it for an attacker to bypass the mitigation, assuming they're aware of it? Can that work be packaged and reused in multiple exploits? And how many bugs become completely non-exploitable due to the mitigation?

What do you think makes Chrome's sandbox "far superior" on Linux? AFAIK they're very similar.

by roca 5y ago

What do you think makes Chrome's sandbox "far superior" on Linux? AFAIK they're very similar.

The rate at which escapes are found (and publicly disclosed) suggests to me that the Chrome sandbox is substantially more advanced than any other browser's. Perhaps there are just as many escapes being found each quarter in Chrome as the other browsers and they are just being hoarded privately but I don't find that super plausible.

roca 5y ago
Where are you getting that data? I'm genuinely interested. FWIW I think it is probable that the IPC APIs into and out of the sandbox have been more thoroughly fuzzed and otherwise tested in Chrome than in Firefox. I don't know how that translates into actual security though.

genghizkhan 5y ago

This is typically what I cite when people ask me about FF vs Chrome security: https://madaidans-insecurities.github.io/firefox-chromium.html https://madaidans-insecurities.github.io/firefox-chromium.ht... And here's Theo de Raadt's opinion of Firefox from back in 2018: https://marc.info/?l=openbsd-misc&m=152872551609819&w=2 https://marc.info/?l=openbsd-misc&m=152872551609819&w=2

aorth 5y ago
Your first link is a good resource. Thanks! I'm not a security researcher, but perhaps I can add a few comments on their discussion for other users who might not be familiar with the specifics: > Firefox's sandboxing lacks any site isolation. Site isolation runs every website inside its own sandbox so that an exploit in one website cannot access the data from another. It does seem that Firefox's site isolation is becoming more ready. From a Mozilla blog post two days ago, with instructions how to manually enable it on Firefox stable, beta, or nightly: https://blog.mozilla.org/security/2021/05/18/introducing-site-isolation-in-firefox/ https://blog.mozilla.org/security/2021/05/18/introducing-sit... Also, from the same link, they mention X11: > One example of such sandbox escape flaws is X11 — X11 doesn't implement any GUI isolation which makes it very easy to escape sandboxes with it. Definitely true that X11 sucks (sorry NVIDIA users). So we have Wayland becoming more mainstream now. I've been using it for several years already, on GNOME and Sway. Working great... even Electron is native now (Signal, VS Code, etc). And lastly, they rightly mention Pulseaudio: > PulseAudio is a common sound server on Linux however, it was not written with isolation in mind, making it possible to escape sandboxes with it. In the last few months PipeWire became a mature drop-in substitute for Pulseaudio in my experience. It was designed with isolation in mind, and a whole bunch of other things. Hoping Firefox can bridge the gap in security with Chrome so we can wholeheartedly recommend it to people without caveats! We deserve a fast, full-featured, secure, and open source alternative to proprietary web browsers.
roca 5y ago
Your first link is a good resource, thanks; it points out many valid issues where Firefox needs to catch up. It is definitely slanted though; for example Firefox's Rust usage is compared to Chromium talking about maybe using Rust someday and the conclusion is "so that's a wash". Also, "the parts that are memory safe do not include important attack surfaces" isn't correct; all C++ code that manages dynamic memory is attack surface. A slightly tangential issue is that the mitigations section is not super compelling to me because I think many mitigations are low-value. Evaluation of mitigations typically does not ask the right questions: How much work is it for an attacker to bypass the mitigation, assuming they're aware of it? Can that work be packaged and reused in multiple exploits? And how many bugs become completely non-exploitable due to the mitigation?