3 ms·

One disturbing thing about Mozilla security is that most of the "Critical" flaws[1] in their list would be marked as "High" on Chrome because of Chrome's superi

by mda 13y ago

One disturbing thing about Mozilla security is that most of the "Critical" flaws[1] in their list would be marked as "High" on Chrome because of Chrome's superior security model. [1]https://www.mozilla.org/security/known-vulnerabilities/firefox.html https://www.mozilla.org/security/known-vulnerabilities/firef...

mccr8 13y ago
That is very unfortunate, but there is ongoing work on making Firefox multiprocess and sandboxed. https://wiki.mozilla.org/Electrolysis https://wiki.mozilla.org/Electrolysis https://wiki.mozilla.org/Security/Sandbox https://wiki.mozilla.org/Security/Sandbox
ris 13y ago
I think you put too much faith in the fables that surround what the chrome security model does and does not do. In short, no, they wouldn't.
- mda 13y ago
  Really? Care to give an example?
  - ris 13y ago
    I don't really want to have to go into process security from scratch, but I have previously commented on this https://news.ycombinator.com/item?id=6811368 https://news.ycombinator.com/item?id=6811368 "Sandboxing" and "process separation" are not magic smoke.
    - mda 13y ago
      Oh sure, they are not magic smoke indeed. Still, how do you explain that Use after free bugs are marked Critical in Firefox but High on Chrome? Seems like Chrome is doing a little bit better in security department. https://www.mozilla.org/security/known-vulnerabilities/firefox.html https://www.mozilla.org/security/known-vulnerabilities/firef... http://googlechromereleases.blogspot.ch/search/label/Stable%20updates http://googlechromereleases.blogspot.ch/search/label/Stable%...
      - ris 13y ago
        Because they have different classification systems/schemes? Are you really asking me this?
        mda 13y ago
        Security flaws browser vendors use do not have different classification schemes. They all use CVSS Severity scores, go ahead and check. Also definitions: Firefox Critical: Vulnerability can be used to run attacker code and install software, requiring no user interaction beyond normal browsing. High: Vulnerability can be used to gather sensitive data from sites in other windows or inject data or code into those sites, requiring no more than normal browsing actions Chrome Critical:Allows an attacker run arbitrary code with the user's privileges in the normal course of browsing. High: Allows an attacker to read or modify confidential data belonging to other web sites.

by mda 13y ago

mccr8 13y ago

That is very unfortunate, but there is ongoing work on making Firefox multiprocess and sandboxed. https://wiki.mozilla.org/Electrolysis https://wiki.mozilla.org/Electrolysis https://wiki.mozilla.org/Security/Sandbox https://wiki.mozilla.org/Security/Sandbox

ris 13y ago

I think you put too much faith in the fables that surround what the chrome security model does and does not do. In short, no, they wouldn't.

mda 13y ago
Really? Care to give an example?
- ris 13y ago
  I don't really want to have to go into process security from scratch, but I have previously commented on this https://news.ycombinator.com/item?id=6811368 https://news.ycombinator.com/item?id=6811368 "Sandboxing" and "process separation" are not magic smoke.
  - mda 13y ago
    Oh sure, they are not magic smoke indeed. Still, how do you explain that Use after free bugs are marked Critical in Firefox but High on Chrome? Seems like Chrome is doing a little bit better in security department. https://www.mozilla.org/security/known-vulnerabilities/firefox.html https://www.mozilla.org/security/known-vulnerabilities/firef... http://googlechromereleases.blogspot.ch/search/label/Stable%20updates http://googlechromereleases.blogspot.ch/search/label/Stable%...
    - ris 13y ago
      Because they have different classification systems/schemes? Are you really asking me this?
      - mda 13y ago
        Security flaws browser vendors use do not have different classification schemes. They all use CVSS Severity scores, go ahead and check. Also definitions: Firefox Critical: Vulnerability can be used to run attacker code and install software, requiring no user interaction beyond normal browsing. High: Vulnerability can be used to gather sensitive data from sites in other windows or inject data or code into those sites, requiring no more than normal browsing actions Chrome Critical:Allows an attacker run arbitrary code with the user's privileges in the normal course of browsing. High: Allows an attacker to read or modify confidential data belonging to other web sites.