Skip Navigation

InitialsDiceBearhttps://github.com/dicebear/dicebearhttps://creativecommons.org/publicdomain/zero/1.0/„Initials” (https://github.com/dicebear/dicebear) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)HE
Posts
7
Comments
80
Joined
2 yr. ago

  • As a security researcher, running each site in its own process isn't enough. Chrome has a much stronger multiprocessing model on most platforms. For example, Chrome on Android sandboxes between processes whereas Firefox simply relies on the built-in Android sandbox, which provides limited protection between these processes. It's much easier to break out of the sandbox in Firefox because it's easier to move laterally, for one. Those processes have to communicate with each other at some point.

    But, don't believe me just because I claim any sort of credential on the Internet. It's such a difference in security that GrapheneOS strongly discourages using Firefox for its weak implementation in addition to the link I provided above. From the link:

    Worst of all, Firefox does not have internal sandboxing on Android. This is despite the fact that Chromium semantic sandbox layer on Android is implemented via the OS isolatedProcess feature, which is a very easy to use boolean property for app service processes to provide strong isolation with only the ability to communicate with the app running them via the standard service API. Even in the desktop version, Firefox's sandbox is still substantially weaker (especially on Linux) and lacks full support for isolating sites from each other rather than only containing content as a whole.

    I love Firefox. I use it anyway. It's not insecure. But it's absolutely not as secure because it lacks modern exploit mitigations. Running process per site is an improvement but it's still less secure than the architecture used in Chrome.

    EDIT: Sound less entitled.

  • Great, now implement modern exploit mitigations and sandboxing like Chrome uses. Firefox is objectively less resistant to exploitation. Some Firefox security has improved since the article was written, such as some sandboxing on Windows, but it's definitely not as mature.

    I'm not writing that Firefox is insecure. Security is very important to Firefox! However, Chrome has had more work done in the realm of browser hardening.

  • They do, but Chrome is actively trying to remove support for most advanced ad-blocking capabilities. Further, Google has no financial incentive to make their browser hospitable to ad blockers as Google makes most of their money from advertising.

    Google has pushed some half-baked ideas for how the web could work without having to block ads. Ad blocks aren't best buddies with Google.

  • I'm not a huge movie buff so please excuse me if my opinion might be uneducated, but I feel like today's Blockbusters are so risk-averse. The movie has become such a product with clearly defined business goals and target audience.

  • I've thought about this question a lot, so I'm quite pleased to see that I'm not alone. I've been wondering myself when the great convergence will come--if it is destined to be, that is. I'm sorry to say that I think it's going to be an exceptionally long time because computing power, as you are realizing, is just one projection of a complex, high-dimensional computing space.

    The first major attraction of using almost any PC-like system is the ecosystem. If the software you want to use isn't available, then the platform is essentially useless to all but developers and hobbyists that see the platform as an end in itself. Linux has a fantastic server ecosystem, for example. Windows has a great gaming ecosystem and access to probably the largest pool of legacy software in binary distribution format.. These are just broad generalizations of course, but my point is that no real user uses a computer 'just because' but they use it because it is useful for some purpose implemented by applications and supported by an ecosystem. This area is partially addressed by emulators and compatibility layers, but not fully subsumes it because of the limitations of today's technology.

    The next major dimension that comes to mind is the form factor. I love the Steam Deck because it's handheld. I don't want it to be a Desktop gaming experience. Similarly, I don't really want to play Starcraft with a gaming controller. I really prefer a mouse and keyboard for maximum control. Users on smartphones prefer shorter, simpler experiences because it's less physically comfortable to spend long periods of time navigating a complex interface on a small screen. You might be able to address the form factor concern with new devices that allow the smarphone to interface with full-size screens and new user input devices, but this is not enough to push users who could benefit even more from another dimension such as access to another ecosystem, like office software on Desktop, that specializes in the kinds of tasks the user wishes to perform while also providing the perfect form factor.

    Can software compatibility be solved with enough time and resources? Certainly. Can we force a smartphone-like platform to take on any physical form factor? Of course, we can. And given enough time, the momentum will change and advanced tools will become more readily available on mobile. However, this is not the situation today, and it's going to take more than physical form factor flexibility or emulating a hardware platform to really unify the computing systems we use into the one true system of the future. It's got to be the best solution for all use cases if users aren't going to want for something in addition, and I think that's a lot to ask.

    TLDR; probably, but I think it's going to be a very long time because it's not enough to be functional. It has got to be a great solution, and that comes down to a lot more than just the size of the screen or the MHz in your CPU.