News for hackers. Stuff that matters.

A comment on A uBlock Origin update was rejected from the Chrome Web Store. Parent comment

Re:A uBlock Origin update was rejected from the Chrome Web S... by mwcampbell on Saturday October 12, 2019 @03:22PM (#21235559)
I like Mozilla's principles in theory, but this warning from the user guide for GrapheneOS [1] (successor to CopperheadOS) is alarming, and applies to more than just Android:

> Avoid Gecko-based browsers like Firefox as they're currently much more vulnerable to exploitation and inherently add a huge amount of attack surface. Gecko doesn't have a WebView implementation (GeckoView is not a WebView implementation), so it has to be used alongside the Chromium-based WebView rather than instead of Chromium, which means having the remote attack surface of two separate browser engines instead of only one. Firefox / Gecko also bypass or cripple a fair bit of the upstream and GrapheneOS hardening work for apps. Worst of all, Firefox runs as a single process on mobile and has no sandbox beyond the OS sandbox. This is despite the fact that Chromium semantic sandbox layer on Android is implemented via the OS isolatedProcess feature, which is a very easy to use boolean property for app service processes to provide strong isolation with only the ability to communicate with the app running them via the standard service API. Even in the desktop version, Firefox's sandbox is still substantially weaker (especially on Linux, where it can hardly be considered a sandbox at all) and lacks support for isolating sites from each other rather than only containing content as a whole.

So, despite concerns about monoculture, I guess Chromium-based browsers other than Chrome are the most practical solution for now.

[1]: https://grapheneos.org/usage

[ Parent | on HN ]
Re:A uBlock Origin update was rejected from the Chrome Web S... by roca on Saturday October 12, 2019 @11:07PM (#21238074)
The Linux desktop Firefox sandbox is pretty strong AFAICT. All the usual namespace protection, pretty good seccomp filter. I wonder what the issue they're referring to is and whether that comment is up to date (the sandbox has improved a lot over the last few years).

The WebView argument is basically an argument for monoculture: you should only have one browser engine installed because that's less attack surface than two, and since Chromium must be installed for reasons, it must be Chromium. That's actually kind of a weak argument since it's not that common for users to load a specific attack in both browser engines.

[ Parent | on HN ]