29 ms·

So basically, Edge, Brave and any other browser built on Chromium. Nice.

by snorbleck 28d ago

anonymars 28d ago
Monocultures are great!
- strenholme 28d ago
  There’s a reason I use Firefox (Gecko). Also, Ladybird—another completely different web engine—is really promising. I spent five hours building it from source, having it take about 8 gigabytes of space, and it perfectly renders my own webpages and blogs. I have a feeling someone’s going to make an open source browser using Ladybird’s engine before Ladybird has official binaries.
  - tkot 27d ago
    Is Firefox actually safer than Chromium-based browsers though? I know this is old: https://madaidans-insecurities.github.io/firefox-chromium.html#security-researcher-views https://madaidans-insecurities.github.io/firefox-chromium.ht... but has the situation changed substantially in favor of Firefox?
    - armadyl 27d ago
      No. The post applies to Android, but the situation is significantly worse on desktop platforms since Android at least has OS-level sandboxing, etc. https://www.reddit.com/r/GrapheneOS/comments/1unhtxu/initial_response_to_a_blog_post_claiming_to/ https://www.reddit.com/r/GrapheneOS/comments/1unhtxu/initial...
    - strenholme 27d ago
      It looks like more of Firefox has been ported over to Rust since then: https://www.wilderssecurity.com/threads/security-chromium-versus-firefox.450867/#post-3136787 https://www.wilderssecurity.com/threads/security-chromium-ve... The reason why I support Gecko and Ladybird’s engine is because I am opposed to monoculture, however. Even if Gecko (Firefox) is less secure than Chromium (Chrome, Edge, etc.), by not having a monoculture, a Chrome exploit will only take down the subset of people using the Chromium ecosystem, and not affect Gecko users. Alas, most people are in the Chromium ecosystem right now so that means malicious hackers only need to target one codebase. It’s the same reason I wrote MaraDNS back in 2001—back then, there was only one open source DNS server[1,2] so I wrote another one.[3] [1] Djbdns was around back then but wasn’t open source, which limited its adoption. [2] https://lwn.net/2001/0208/ https://lwn.net/2001/0208/ [2] MaraDNS was and is optimized for running at most a few dozen domains on a system running a bunch of other services, where one does not want the DNS server causing security problems for the server, and where the DNS server needs to be lightweight as possible.
chinathrow 28d ago
Running Firefox on all my OSes. Nice.

So basically, Edge, Brave and any other browser built on Chromium. Nice.

anonymars 28d ago

Monocultures are great!

strenholme 28d ago
There’s a reason I use Firefox (Gecko). Also, Ladybird—another completely different web engine—is really promising. I spent five hours building it from source, having it take about 8 gigabytes of space, and it perfectly renders my own webpages and blogs. I have a feeling someone’s going to make an open source browser using Ladybird’s engine before Ladybird has official binaries.
- tkot 27d ago
  Is Firefox actually safer than Chromium-based browsers though? I know this is old: https://madaidans-insecurities.github.io/firefox-chromium.html#security-researcher-views https://madaidans-insecurities.github.io/firefox-chromium.ht... but has the situation changed substantially in favor of Firefox?
  - armadyl 27d ago
    No. The post applies to Android, but the situation is significantly worse on desktop platforms since Android at least has OS-level sandboxing, etc. https://www.reddit.com/r/GrapheneOS/comments/1unhtxu/initial_response_to_a_blog_post_claiming_to/ https://www.reddit.com/r/GrapheneOS/comments/1unhtxu/initial...
  - strenholme 27d ago
    It looks like more of Firefox has been ported over to Rust since then: https://www.wilderssecurity.com/threads/security-chromium-versus-firefox.450867/#post-3136787 https://www.wilderssecurity.com/threads/security-chromium-ve... The reason why I support Gecko and Ladybird’s engine is because I am opposed to monoculture, however. Even if Gecko (Firefox) is less secure than Chromium (Chrome, Edge, etc.), by not having a monoculture, a Chrome exploit will only take down the subset of people using the Chromium ecosystem, and not affect Gecko users. Alas, most people are in the Chromium ecosystem right now so that means malicious hackers only need to target one codebase. It’s the same reason I wrote MaraDNS back in 2001—back then, there was only one open source DNS server[1,2] so I wrote another one.[3] [1] Djbdns was around back then but wasn’t open source, which limited its adoption. [2] https://lwn.net/2001/0208/ https://lwn.net/2001/0208/ [2] MaraDNS was and is optimized for running at most a few dozen domains on a system running a bunch of other services, where one does not want the DNS server causing security problems for the server, and where the DNS server needs to be lightweight as possible.

chinathrow 28d ago

Running Firefox on all my OSes. Nice.