5 ms·

Let's not talk about privacy (because there is no point in talking about it: Firefox is eons more private than Chrome - or any of it's based browsers - can ever

Let's not talk about privacy (because there is no point in talking about it: Firefox is eons more private than Chrome - or any of it's based browsers - can ever be) About security: Chrome has a biggest workforce, yes. but let's think about this a bit... First, let's not forget that chrome is also a bigger target. let's imagine this: Consider that 90% of the users worldwide use chromium-based browsers, and you are an hacker who wants to steal peoples data or access their computers. Would you bother targeting 10% of the users. Or would you just go after those 90%??? now add another detail into that thinking: people who use Firefox are mostly techies, people who know about computers, gnu/linux users, developers, more security-conscientious users, people who actually know and care about the tech that goes bellow, people that knows what's happening in the IT world, and people that simple don't go with the flock without studding it's path first... now... would you really bother targeting those when you have 90% of people - where probably 85% don't know anything about computers or just don't give a #$%& about it??? Would you go easy bait, or would you try to outsmart those who might be at the same level you are??? (sure, there is always exceptions!!!) but then again... maybe that's just me...

guerrilla 2y ago
This is exactly it. I used Linux on PowerPC for the same reason: Literally nobody was targeting it, especially compared to Windows on x86. Even now, why would anyone waste their time targeting desktop Linux on x86. Basically unheard of, because it's pointless (Except in targeted attacks.)
- deleted 2y ago
  [deleted]
- tuetuopay 2y ago
  Thing is, targeting Linux on x86 will target high value users. Either servers, developers, sysadmins and the like. Yes you will hit less people, but the value of each hit is magnitude higher. It’s the same reasons apps first target iOS rather than android: apple users have an easier wallet.
  - maverick74 2y ago
    > Linux on x86 will target high value users. I'm not sure i agree with all you said. Servers: mostly are not on x86. Also they are a lot more difficult to exploit due to the security nature of linux (yes, they go down very often and nothing is unhackable) developers, sysadmins: tend to have the hardest configs and thus making it a lot more difficult to hack. So, afaik, most of the hacks on this areas are more due to human flaws than the systems per se. Now, i do agree that for a group of hackers with profound knowledge and that is trying to hit really big, servers are more attractive. devs and sysadms alone/personally not that much! ... unless ... they are targeting the servers managed by those devs and sysadms and in this case, targeting the devs and sysadms personally make more sense - which tend to be one of the best/easiest ways to hack the servers - again, exploiting human flaw instead of system flaw) naturally, this is my personal view! I may be wrong here!
    - tuetuopay 2y ago
      > Servers: mostly are not on x86. Let's agree that we disagree. I'll just say that I work for a cloud provider and non-x86 servers are anecdotal :) but their media presence is not, as it's the new hot thing and that's free advertising. > developers, sysadmins: tend to have the hardest configs and thus making it a lot more difficult to hack. yet those people have a cognitive bias of "i'm too smart to fall". and those people will have some practices that are so detrimental to security it's laughable. how many developers will shutdown their laptop every day after work? compare this to the common practice of "just go to sleep" which will prevent browser updates, system updates, kernel updates, you name it. take a firefox that is months old with an unpatched ubuntu and you get the idea ground for a browser escape combined with an lpe. and even without lpe you'll grab many many credentials. imho those still are harder to trick, but not because the config is hardened, but because there is a config at all. for example a phishing that imitates a floating browser window with a fake login page would not work on me. not because i'm smart, not because my config is hardened or whatnot, but because good luck to the scam for finding the specific window decorations I have on my linux system. oh, and the fact that I use a tiling wm and thus floating windows don't exist. it's a side effect of nerds being nerds. > So, afaik, most of the hacks on this areas are more due to human flaws than the systems per se. This is not incompatible. "normies" will get tricked in downloading invoice.pdf.exe, but that's windows only. The payout for invoice.pdf.sh or whatever may be very high, but you need your rat or stealer or whatever to know linux. > unless ... they are targeting the servers managed by those devs and sysadms That was the precise reason I talked about devs and sysadmins. Infrastructure credentials, aws keys, you name it. And as a dev/sysadmin, you don't need targeted attacks to get pwned. A malicious package on npm/gems/cargo is all it takes. It's a spray and pray strategy, but if you catch even a handful of people this way it might be the jackpot.
- sneed_chucker 2y ago
  What hardware are you on?
- echoangle 2y ago
  Most servers use Linux so that’s probably a more valuable target than Windows.
cies 2y ago
> Firefox is eons more private than Chrome - or any of it's based browsers - can ever be Some progress is made though... Brave: https://brave.com https://brave.com Thorium: https://github.com/Alex313031/thorium https://github.com/Alex313031/thorium
- maverick74 2y ago
  Yes, Specially Brave (within the Chromium-spectrum only) is probably one of the best choices (if we ignore some details, of course...) Still, i actually have more faith in servo: https://servo.org https://servo.org
  - cies 2y ago
    > i actually have more faith in servo: https://servo.org https://servo.org Together with RedoxOS, COSMIC EPIC, and coreutils in Rust -- the future holds such great potential :)
    - maverick74 2y ago
      RedoxOS, yes... I like that!!! :) But i still prefer Genode/Sculpt + seL4 (https://genode.org https://genode.org) they are doing amazing work there!!! If only they had a nice GUI (say... LXQt, for example)
      - DEADMINCE 2y ago
        Significantly more than just a nice GUI would be needed for general use, but it's certainly a fascinating proof of concept.
- JumpCrisscross 2y ago
  Going off the top comment’s simplicity is security paradigm, it’s hard to pitch Brave as a secure browser given its non-core complexity. (This would be as true if it were running a protein-folding simulation in the background as it is with its crypto bits.)
pil0u 2y ago
10% of a couple of billions users is still a massive absolute amount of users.
collyw 2y ago
I find this to be a bit of a weak argument. What you make makes sense, but of for some reason a glaring security hole is noticed, people are going to take advantage of it.
- maverick74 2y ago
  naturally! There are always exceptions and there will always be people that will bother targeting those 10%. Even more: if they could create something that targets both platforms that will be even better... The question will always be of Work Vs Gain. Will your work result in gain. Does it justify targeting those 10%? (if it's an "easy thing to do" then we'll all get targeted)
jorvi 2y ago
> Let's not talk about privacy (because there is no point in talking about it: Firefox is eons more private than Chrome - or any of it's based browsers - can ever be) Firefox with its default settings is both less private and less secure than Brave. On iOS, Firefox has refused for years to implement an adblocker. It’s best to say nothing if you don’t know what you’re talking about.
- maverick74 2y ago
  yeap... i really don't know what i'm talking about, how would I... I also don't like to go with the flock... and... how cares about the defaults? You have the options you should care to configure things for yourself. if you don't know how you should search and instruct yourself to do it. About iOS... Have you even considered that Apple has forced their rendering engine ( https://gprivate.com/6btxx https://gprivate.com/6btxx ) and that alone makes it impossible to have an adblocker - yeah... apple is THAT great!!! (in fact, their products are the best of the best. You should keep using them...) but then again... i don't know what i'm talking about, do I!!! (also... you should learn how to be polite to others!!!)
  - jorvi 2y ago
    You are misleading people into making insecure choices. Go check Brave on iOS right now and tell me that it doesn’t have adblocking. Given that, telling you to be quiet is about as polite as it gets.
- DEADMINCE 2y ago
  Brave with its default settings is both less private and less secure than LibreWolf. > On iOS, Firefox has refused for years to implement an adblocker. Blame Apple.
  - account42 2y ago
    Mozilla deserves some of the blame for misleading users into thinking that Firefox is available on iOS when all they really provide is a Safari reskin.
hulitu 2y ago
> Firefox is eons more private than Chrome cough* safe browsing cough*. /s Enabled by default.
- mnahkies 2y ago
  My understanding of safe browsing is that a local database is maintained and lookups happen against that. Eg: no information about the sites you're visiting is leaked. Is this not the case / am I misunderstanding something? Ref: https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-in-firefox/ https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-...
  - account42 2y ago
    Your understanding is not (entirely) up to date. At some point they switched to downloading only a list of (partial) hashes. If an URL matches a partial hash then the browser asks Google for a lists of URLs for that hash. This does can let google get some information about what websites you visit. And those requests as well as the updates of the initial hash lists still ping Google with all the tracking posibilities that entails.

guerrilla 2y ago

This is exactly it. I used Linux on PowerPC for the same reason: Literally nobody was targeting it, especially compared to Windows on x86. Even now, why would anyone waste their time targeting desktop Linux on x86. Basically unheard of, because it's pointless (Except in targeted attacks.)

deleted 2y ago
[deleted]
tuetuopay 2y ago
Thing is, targeting Linux on x86 will target high value users. Either servers, developers, sysadmins and the like. Yes you will hit less people, but the value of each hit is magnitude higher. It’s the same reasons apps first target iOS rather than android: apple users have an easier wallet.
- maverick74 2y ago
  > Linux on x86 will target high value users. I'm not sure i agree with all you said. Servers: mostly are not on x86. Also they are a lot more difficult to exploit due to the security nature of linux (yes, they go down very often and nothing is unhackable) developers, sysadmins: tend to have the hardest configs and thus making it a lot more difficult to hack. So, afaik, most of the hacks on this areas are more due to human flaws than the systems per se. Now, i do agree that for a group of hackers with profound knowledge and that is trying to hit really big, servers are more attractive. devs and sysadms alone/personally not that much! ... unless ... they are targeting the servers managed by those devs and sysadms and in this case, targeting the devs and sysadms personally make more sense - which tend to be one of the best/easiest ways to hack the servers - again, exploiting human flaw instead of system flaw) naturally, this is my personal view! I may be wrong here!
  - tuetuopay 2y ago
    > Servers: mostly are not on x86. Let's agree that we disagree. I'll just say that I work for a cloud provider and non-x86 servers are anecdotal :) but their media presence is not, as it's the new hot thing and that's free advertising. > developers, sysadmins: tend to have the hardest configs and thus making it a lot more difficult to hack. yet those people have a cognitive bias of "i'm too smart to fall". and those people will have some practices that are so detrimental to security it's laughable. how many developers will shutdown their laptop every day after work? compare this to the common practice of "just go to sleep" which will prevent browser updates, system updates, kernel updates, you name it. take a firefox that is months old with an unpatched ubuntu and you get the idea ground for a browser escape combined with an lpe. and even without lpe you'll grab many many credentials. imho those still are harder to trick, but not because the config is hardened, but because there is a config at all. for example a phishing that imitates a floating browser window with a fake login page would not work on me. not because i'm smart, not because my config is hardened or whatnot, but because good luck to the scam for finding the specific window decorations I have on my linux system. oh, and the fact that I use a tiling wm and thus floating windows don't exist. it's a side effect of nerds being nerds. > So, afaik, most of the hacks on this areas are more due to human flaws than the systems per se. This is not incompatible. "normies" will get tricked in downloading invoice.pdf.exe, but that's windows only. The payout for invoice.pdf.sh or whatever may be very high, but you need your rat or stealer or whatever to know linux. > unless ... they are targeting the servers managed by those devs and sysadms That was the precise reason I talked about devs and sysadmins. Infrastructure credentials, aws keys, you name it. And as a dev/sysadmin, you don't need targeted attacks to get pwned. A malicious package on npm/gems/cargo is all it takes. It's a spray and pray strategy, but if you catch even a handful of people this way it might be the jackpot.
sneed_chucker 2y ago
What hardware are you on?
echoangle 2y ago
Most servers use Linux so that’s probably a more valuable target than Windows.

cies 2y ago

> Firefox is eons more private than Chrome - or any of it's based browsers - can ever be Some progress is made though... Brave: https://brave.com https://brave.com Thorium: https://github.com/Alex313031/thorium https://github.com/Alex313031/thorium

maverick74 2y ago
Yes, Specially Brave (within the Chromium-spectrum only) is probably one of the best choices (if we ignore some details, of course...) Still, i actually have more faith in servo: https://servo.org https://servo.org
- cies 2y ago
  > i actually have more faith in servo: https://servo.org https://servo.org Together with RedoxOS, COSMIC EPIC, and coreutils in Rust -- the future holds such great potential :)
  - maverick74 2y ago
    RedoxOS, yes... I like that!!! :) But i still prefer Genode/Sculpt + seL4 (https://genode.org https://genode.org) they are doing amazing work there!!! If only they had a nice GUI (say... LXQt, for example)
    - DEADMINCE 2y ago
      Significantly more than just a nice GUI would be needed for general use, but it's certainly a fascinating proof of concept.
JumpCrisscross 2y ago
Going off the top comment’s simplicity is security paradigm, it’s hard to pitch Brave as a secure browser given its non-core complexity. (This would be as true if it were running a protein-folding simulation in the background as it is with its crypto bits.)

pil0u 2y ago

10% of a couple of billions users is still a massive absolute amount of users.

collyw 2y ago

I find this to be a bit of a weak argument. What you make makes sense, but of for some reason a glaring security hole is noticed, people are going to take advantage of it.

maverick74 2y ago
naturally! There are always exceptions and there will always be people that will bother targeting those 10%. Even more: if they could create something that targets both platforms that will be even better... The question will always be of Work Vs Gain. Will your work result in gain. Does it justify targeting those 10%? (if it's an "easy thing to do" then we'll all get targeted)

jorvi 2y ago

> Let's not talk about privacy (because there is no point in talking about it: Firefox is eons more private than Chrome - or any of it's based browsers - can ever be) Firefox with its default settings is both less private and less secure than Brave. On iOS, Firefox has refused for years to implement an adblocker. It’s best to say nothing if you don’t know what you’re talking about.

maverick74 2y ago
yeap... i really don't know what i'm talking about, how would I... I also don't like to go with the flock... and... how cares about the defaults? You have the options you should care to configure things for yourself. if you don't know how you should search and instruct yourself to do it. About iOS... Have you even considered that Apple has forced their rendering engine ( https://gprivate.com/6btxx https://gprivate.com/6btxx ) and that alone makes it impossible to have an adblocker - yeah... apple is THAT great!!! (in fact, their products are the best of the best. You should keep using them...) but then again... i don't know what i'm talking about, do I!!! (also... you should learn how to be polite to others!!!)
- jorvi 2y ago
  You are misleading people into making insecure choices. Go check Brave on iOS right now and tell me that it doesn’t have adblocking. Given that, telling you to be quiet is about as polite as it gets.
DEADMINCE 2y ago
Brave with its default settings is both less private and less secure than LibreWolf. > On iOS, Firefox has refused for years to implement an adblocker. Blame Apple.
- account42 2y ago
  Mozilla deserves some of the blame for misleading users into thinking that Firefox is available on iOS when all they really provide is a Safari reskin.

hulitu 2y ago

> Firefox is eons more private than Chrome cough* safe browsing cough*. /s Enabled by default.

mnahkies 2y ago
My understanding of safe browsing is that a local database is maintained and lookups happen against that. Eg: no information about the sites you're visiting is leaked. Is this not the case / am I misunderstanding something? Ref: https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-in-firefox/ https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-...
- account42 2y ago
  Your understanding is not (entirely) up to date. At some point they switched to downloading only a list of (partial) hashes. If an URL matches a partial hash then the browser asks Google for a lists of URLs for that hash. This does can let google get some information about what websites you visit. And those requests as well as the updates of the initial hash lists still ping Google with all the tracking posibilities that entails.