3 ms·

Ehhh.. seems it is closed source, and if so, I am not exactly happy to try it at all... Browser, handling so much important stuff, being closed source is a bit

Ehhh.. seems it is closed source, and if so, I am not exactly happy to try it at all... Browser, handling so much important stuff, being closed source is a bit of... just no.

cedricr 5y ago
The rendering engine is Chromium so… that's the most important thing as far as I'm concerned. At least for this usage: it's a browser for web development, not for everyday use.
jve 5y ago
Is it you that audit the code or just having a piece of mind with the thought: "Someone MUST HAVE looked at that code and if I haven't stumbled upon any bad press, probably this is good to go!"? Maybe you are running some automated tools that identifies whether particular software accesses data it doesn't have to or makes network connections etc? Something being open source doesn't automatically mean it is secure. On the other hand, any software running on your pc requires you to put trust in the developers. I think it would be easier to just setup monitoring (like preventing outgoing traffic or identifying DNS lookups etc) and limiting permissions on what particular software can do, be it black or white box. White box of course allows running some analyzers, but... do any non-contributors actually do it? I remember seeing some tool here, don't remember - was it Microsoft made or what? That scanned the code and tried to identify what accesses software makes.
- marginalia_nu 5y ago
  If it is your intent, it's also disturbingly easy to hide behavior from code reviewers. The Underhanded C Coding Contest has a lot of examples of this type of stuff: http://www.underhanded-c.org/_page_id_25.html http://www.underhanded-c.org/_page_id_25.html I can already hear some of you starting to type a rant about how this actually is a C problem and not something that would happen in a modern language like ${YOUR_FAVORITE_LANGUAGE:-rust}; and to an extent it is true that C is especially vulnerable to this particular vector of attack, but like it or not a lot of open source software if it isn't written in C, depends on libraries that are. This includes the Linux kernel, OpenSSL, cURL. WebKit is written in C++ which might as well be C for the sake of this discussion. Other languages have other attack vectors, like the fractal-like dependency tree of NPM for example, something that has been demonstrated time and time again to be more than a hypothetical security risk.

Ehhh.. seems it is closed source, and if so, I am not exactly happy to try it at all... Browser, handling so much important stuff, being closed source is a bit of... just no.

cedricr 5y ago

The rendering engine is Chromium so… that's the most important thing as far as I'm concerned. At least for this usage: it's a browser for web development, not for everyday use.

jve 5y ago

Is it you that audit the code or just having a piece of mind with the thought: "Someone MUST HAVE looked at that code and if I haven't stumbled upon any bad press, probably this is good to go!"? Maybe you are running some automated tools that identifies whether particular software accesses data it doesn't have to or makes network connections etc? Something being open source doesn't automatically mean it is secure. On the other hand, any software running on your pc requires you to put trust in the developers. I think it would be easier to just setup monitoring (like preventing outgoing traffic or identifying DNS lookups etc) and limiting permissions on what particular software can do, be it black or white box. White box of course allows running some analyzers, but... do any non-contributors actually do it? I remember seeing some tool here, don't remember - was it Microsoft made or what? That scanned the code and tried to identify what accesses software makes.

marginalia_nu 5y ago
If it is your intent, it's also disturbingly easy to hide behavior from code reviewers. The Underhanded C Coding Contest has a lot of examples of this type of stuff: http://www.underhanded-c.org/_page_id_25.html http://www.underhanded-c.org/_page_id_25.html I can already hear some of you starting to type a rant about how this actually is a C problem and not something that would happen in a modern language like ${YOUR_FAVORITE_LANGUAGE:-rust}; and to an extent it is true that C is especially vulnerable to this particular vector of attack, but like it or not a lot of open source software if it isn't written in C, depends on libraries that are. This includes the Linux kernel, OpenSSL, cURL. WebKit is written in C++ which might as well be C for the sake of this discussion. Other languages have other attack vectors, like the fractal-like dependency tree of NPM for example, something that has been demonstrated time and time again to be more than a hypothetical security risk.