3 ms·

Firefox is less secure, as has been said many times here already. You might dislike the Blink hegemony but they're the only ones who invest enough in security.

Firefox is less secure, as has been said many times here already. You might dislike the Blink hegemony but they're the only ones who invest enough in security. Vivaldi's closed source, and Firefox doesn't have site isolation on all platforms yet. (Neither does Safari). Chrome had it in 2018. 3 years is not excusable when a 0day can be the difference between freedom and jail (or worse). "Privacy" is defective when your exploit mitigation is deficient. You've got a lot worse privacy when your whole computer is owned, than when a few websites track which other websites you've been to. None of this is new. https://news.ycombinator.com/item?id=27219402 https://news.ycombinator.com/item?id=27219402 Brave has a top-notch team, uses Blink, and has some of the best fingerprinting protection I've seen in any browser, much better than Safari, and better than Firefox. They have good people working on it. The fact that an attempt to improve privacy [0] is being used to bring Brave bad PR is ironic. [0]: https://github.com/brave/brave-browser/wiki/Deviations-from-Chromium-(features-we-disable-or-remove)#services-we-proxy-through-brave-servers https://github.com/brave/brave-browser/wiki/Deviations-from-...

p1peridine 5y ago
Can you cite one real-world example of someone who's been infected using Firefox in newer times? The link you're referencing talks about NT kernel syscalls - if the computer is already infected it doesn't matter what browser is being used. If one is a high-value target for a nation state or something of that caliber I would agree with you - but that doesn't apply to regular users. Atleast to my knowledge. Another counter-argument here is that people looking for vulnerabilities would much rather spend their time looking for chrome exploits than firefox exploits (because of market share), no?
- concinds 5y ago
  > Can you cite one real-world example of someone who's been infected using Firefox in newer times? Coinbase was, and that wasn't long ago. If I were a sysadmin I'd blacklist Firefox from all my machines, no matter how I feel about the open web, about Mozilla or their mission statement, it's not a reasonable risk to take. > Another counter-argument here is that people looking for vulnerabilities would much rather spend their time looking for chrome exploits than firefox exploits (because of market share), no? People look for both. Firefox is a much higher value target to governments than Chrome, because that's what Tor Browser is. Tor is Firefox ESR, which only has big security fixes backported; other security flaws remain in Firefox ESR for much longer. But beyond that, the security fundamentals were never a part of the original Firefox project like they were for Chrome, and it still isn't. 13 years later, Chrome's still making faster progress with exploit mitigation than Firefox, and Firefox is the one that needed catching up. There's a reason why GrapheneOS, which people here trust, don't use Firefox. Check their website for a great readup[0]. On Zerodium, Chrome RCE+LPE goes for $500k, Firefox and Safari. People will argue that's marketshare, but get any exploit mitigation researcher in here and they'll tell you Firefox (and Safari) are fundamentally less secure than Chrome. Price isn't just determined by demand (by governments), it's supply too. I understand the "cyberpunk" love for Firefox, they're the good guys fighting big G. But that doesn't change what their codebase is. [0]: https://grapheneos.org/usage#web-browsing https://grapheneos.org/usage#web-browsing
- johncolanduoni 5y ago
  Once an exploit allows running arbitrary code in a sandboxed browser process, NT kernel syscalls become relevant even if your computer isn’t otherwise infected. See project zero for a rundown of NT kernel vulnerabilities actually exploited from sandboxed processes (Firefox uses the same sandbox as Chrome on Windows): https://googleprojectzero.blogspot.com/2021/01/in-wild-series-windows-exploits.html https://googleprojectzero.blogspot.com/2021/01/in-wild-serie... .
schleck8 5y ago
Only the UI layer of Vivaldi is closed source I think
- concinds 5y ago
  I don't want to diss Vivaldi, I just haven't researched the company behind it well enough to trust it for myself. I'll leave it to others to do the research and make up their opinions themselves.

p1peridine 5y ago

Can you cite one real-world example of someone who's been infected using Firefox in newer times? The link you're referencing talks about NT kernel syscalls - if the computer is already infected it doesn't matter what browser is being used. If one is a high-value target for a nation state or something of that caliber I would agree with you - but that doesn't apply to regular users. Atleast to my knowledge. Another counter-argument here is that people looking for vulnerabilities would much rather spend their time looking for chrome exploits than firefox exploits (because of market share), no?

concinds 5y ago
> Can you cite one real-world example of someone who's been infected using Firefox in newer times? Coinbase was, and that wasn't long ago. If I were a sysadmin I'd blacklist Firefox from all my machines, no matter how I feel about the open web, about Mozilla or their mission statement, it's not a reasonable risk to take. > Another counter-argument here is that people looking for vulnerabilities would much rather spend their time looking for chrome exploits than firefox exploits (because of market share), no? People look for both. Firefox is a much higher value target to governments than Chrome, because that's what Tor Browser is. Tor is Firefox ESR, which only has big security fixes backported; other security flaws remain in Firefox ESR for much longer. But beyond that, the security fundamentals were never a part of the original Firefox project like they were for Chrome, and it still isn't. 13 years later, Chrome's still making faster progress with exploit mitigation than Firefox, and Firefox is the one that needed catching up. There's a reason why GrapheneOS, which people here trust, don't use Firefox. Check their website for a great readup[0]. On Zerodium, Chrome RCE+LPE goes for $500k, Firefox and Safari. People will argue that's marketshare, but get any exploit mitigation researcher in here and they'll tell you Firefox (and Safari) are fundamentally less secure than Chrome. Price isn't just determined by demand (by governments), it's supply too. I understand the "cyberpunk" love for Firefox, they're the good guys fighting big G. But that doesn't change what their codebase is. [0]: https://grapheneos.org/usage#web-browsing https://grapheneos.org/usage#web-browsing
johncolanduoni 5y ago
Once an exploit allows running arbitrary code in a sandboxed browser process, NT kernel syscalls become relevant even if your computer isn’t otherwise infected. See project zero for a rundown of NT kernel vulnerabilities actually exploited from sandboxed processes (Firefox uses the same sandbox as Chrome on Windows): https://googleprojectzero.blogspot.com/2021/01/in-wild-series-windows-exploits.html https://googleprojectzero.blogspot.com/2021/01/in-wild-serie... .

schleck8 5y ago

Only the UI layer of Vivaldi is closed source I think

concinds 5y ago
I don't want to diss Vivaldi, I just haven't researched the company behind it well enough to trust it for myself. I'll leave it to others to do the research and make up their opinions themselves.