4 ms·

Your original comment sounded like (how I read it, at least) you think Chrome should be the default recommend in this (and similar) guides. Full stop, end of st

Your original comment sounded like (how I read it, at least) you think Chrome should be the default recommend in this (and similar) guides. Full stop, end of story. This comment sounds like you think guides should be more nuanced regarding the specific threat model that is trying to be mitigated. I agree with the second one.

tptacek 2y ago
No, I think people should use Chrome. But my actual docket of security advice wasn't the point; my point was: if they got this wrong (and by suggesting that Firefox is a categorically better choice than Chrome, they have), what else did they get wrong? As a security person, I have borne witness to many, many "which browser is really more secure?" or "has Firefox caught up to Chrome?" arguments. I have seen "you should use Chrome (or Chromium) no matter what" as responses; I have seen "it's complicated" as responses. I have never seen "you should use Firefox no matter what".
- ziddoap 2y ago
  As a security person, I agree that this guide is not great. I agree with pretty much everything you've said. However, I disagree with your original comment that a recommendation in favor of Firefox means writing off a guide entirely. But that's probably for some other time, I imagine we can leave it at agreeing "this guide is not great". I doubt it is good for my career to butt heads with the tptacek on a security topic.
  - tptacek 2y ago
    Oof. I just think it's an interesting way to think about these things. There are a couple recommendations these kinds of guides recurringly make that are "tells" that the people writing it aren't, let's say, super engaged with the communities of expertise the recommendations are meant to be drawn from. I learned last cycle not to waste too much energy red-penciling security guides; there will be more of them following this one. But I am interested in general rules of thumb for how to read any of them. For what it's worth, I comment here worrying that 'saurik and 'comex and 'pbsd are at any moment about to hand me my ass. Wherever I am in the heirarchy, it's not close to the top.
    - tptacek 2y ago
      except about SOC2

tptacek 2y ago

No, I think people should use Chrome. But my actual docket of security advice wasn't the point; my point was: if they got this wrong (and by suggesting that Firefox is a categorically better choice than Chrome, they have), what else did they get wrong? As a security person, I have borne witness to many, many "which browser is really more secure?" or "has Firefox caught up to Chrome?" arguments. I have seen "you should use Chrome (or Chromium) no matter what" as responses; I have seen "it's complicated" as responses. I have never seen "you should use Firefox no matter what".

ziddoap 2y ago
As a security person, I agree that this guide is not great. I agree with pretty much everything you've said. However, I disagree with your original comment that a recommendation in favor of Firefox means writing off a guide entirely. But that's probably for some other time, I imagine we can leave it at agreeing "this guide is not great". I doubt it is good for my career to butt heads with the tptacek on a security topic.
- tptacek 2y ago
  Oof. I just think it's an interesting way to think about these things. There are a couple recommendations these kinds of guides recurringly make that are "tells" that the people writing it aren't, let's say, super engaged with the communities of expertise the recommendations are meant to be drawn from. I learned last cycle not to waste too much energy red-penciling security guides; there will be more of them following this one. But I am interested in general rules of thumb for how to read any of them. For what it's worth, I comment here worrying that 'saurik and 'comex and 'pbsd are at any moment about to hand me my ass. Wherever I am in the heirarchy, it's not close to the top.
  - tptacek 2y ago
    except about SOC2