Firefox does not have a well-designed privsep model

Re:Firefox does not have a well-designed privsep model by jchw on Monday June 11, 2018 @03:42PM (#17287820)

W^X is simply the idea that code segments are either writable or executable, never both simultaneously. It does limit some attack surface area. That being said, while it'd be a welcome addition to V8, it almost definitely would come with some performance cost and a complexity increase, whereas Chrome has focused on sandboxing the JIT in such a way that gaining access to the JIT would not get you very far. So, while layered security is almost never a bad thing, I think that it's possible this trade-off is not a terrible one for Chrome security.

[ Parent | on HN ]

Re:Firefox does not have a well-designed privsep model by ddtaylor on Monday June 11, 2018 @03:45PM (#17287841)

His email starts off with this claim:

> In a browser, there are 2 main security components you want: The main security advantage is privsep. The other is W^X jit. Other security effects will follow from those design choices, especially if you have privsep. For instance, the chrome privsep is nicely refined and pledge enforcements could be added.

EDIT: Just to be clear I'm not arguing against DEP/W^X but simply appears he is contradicting himself.

[ Parent | on HN ]

Re:Firefox does not have a well-designed privsep model by jchw on Monday June 11, 2018 @05:22PM (#17288713)

To be more particular, though:

- W^X defends against a subset of attacks that privsep defends against.

- Privsep is a bigger architectural impact than W^X. The entire app, almost everything, is impacted by privsep. Only the JIT is impacted by W^X.

So while it is nice that Firefox has been doing W^X, it doesn't mean they're closer to huge steps like Chrome-level privsep of processes. I hope they are, though.

[ Parent | on HN ]