4 ms·

Really? Care to give an example?

• ris 13y ago
  I don't really want to have to go into process security from scratch, but I have previously commented on this https://news.ycombinator.com/item?id=6811368 https://news.ycombinator.com/item?id=6811368 "Sandboxing" and "process separation" are not magic smoke.
  • mda 13y ago
    Oh sure, they are not magic smoke indeed. Still, how do you explain that Use after free bugs are marked Critical in Firefox but High on Chrome? Seems like Chrome is doing a little bit better in security department. https://www.mozilla.org/security/known-vulnerabilities/firefox.html https://www.mozilla.org/security/known-vulnerabilities/firef... http://googlechromereleases.blogspot.ch/search/label/Stable%20updates http://googlechromereleases.blogspot.ch/search/label/Stable%...
    • ris 13y ago
      Because they have different classification systems/schemes? Are you really asking me this?
      • mda 13y ago
        Security flaws browser vendors use do not have different classification schemes. They all use CVSS Severity scores, go ahead and check. Also definitions: Firefox Critical: Vulnerability can be used to run attacker code and install software, requiring no user interaction beyond normal browsing. High: Vulnerability can be used to gather sensitive data from sites in other windows or inject data or code into those sites, requiring no more than normal browsing actions Chrome Critical:Allows an attacker run arbitrary code with the user's privileges in the normal course of browsing. High: Allows an attacker to read or modify confidential data belonging to other web sites.