Re:Firefox does not have a well-designed privsep model
by kevingadd on Monday June 11, 2018 @07:20PM
(#17289467)
Privsep is useful but I'm not sure I buy the argument that Firefox needs to go all in on it to be secure. Despite Chrome's engineering approach people still managed to privilege escalate all the way from their webassembly decoder (insecure C++) all the way to persistent root on Chromebooks, due to fundamental security engineering failures (multiple) that no amount of privilege separation could stop.
More precisely limited capabilities for content processes, etc, are good but you also just need to write more secure, more stable code and Rust is a great investment towards that. I don't think Firefox needs to go all the way to Chrome's horribly slow 37-million-process-types model. The Chrome approach has significant downsides - any use of the GPU has measurable overhead which turns into higher battery usage (this is the main reason Edge uses less battery on Windows for things like video playback), and their privilege isolation turns cache hits for web content loads from <1ms to 20-60ms because of the multiple RPC trips and context switches necessary to load things out of the cache Because Security. Every decision made in Chrome probably had a reasonable security motivation but I don't think that necessarily justifies turning a page load from 0.5s to 2.0s just to protect against a hypothetical attack.
DISCLAIMER: I got paid to work on Firefox and Chrome, so I have some sort of bias here
More precisely limited capabilities for content processes, etc, are good but you also just need to write more secure, more stable code and Rust is a great investment towards that. I don't think Firefox needs to go all the way to Chrome's horribly slow 37-million-process-types model. The Chrome approach has significant downsides - any use of the GPU has measurable overhead which turns into higher battery usage (this is the main reason Edge uses less battery on Windows for things like video playback), and their privilege isolation turns cache hits for web content loads from <1ms to 20-60ms because of the multiple RPC trips and context switches necessary to load things out of the cache Because Security. Every decision made in Chrome probably had a reasonable security motivation but I don't think that necessarily justifies turning a page load from 0.5s to 2.0s just to protect against a hypothetical attack.
DISCLAIMER: I got paid to work on Firefox and Chrome, so I have some sort of bias here