6 ms·

Monocultures are great!

strenholme 12d ago
There’s a reason I use Firefox (Gecko). Also, Ladybird—another completely different web engine—is really promising. I spent five hours building it from source, having it take about 8 gigabytes of space, and it perfectly renders my own webpages and blogs. I have a feeling someone’s going to make an open source browser using Ladybird’s engine before Ladybird has official binaries.
- tkot 11d ago
  Is Firefox actually safer than Chromium-based browsers though? I know this is old: https://madaidans-insecurities.github.io/firefox-chromium.html#security-researcher-views https://madaidans-insecurities.github.io/firefox-chromium.ht... but has the situation changed substantially in favor of Firefox?
  - armadyl 11d ago
    No. The post applies to Android, but the situation is significantly worse on desktop platforms since Android at least has OS-level sandboxing, etc. https://www.reddit.com/r/GrapheneOS/comments/1unhtxu/initial_response_to_a_blog_post_claiming_to/ https://www.reddit.com/r/GrapheneOS/comments/1unhtxu/initial...
  - strenholme 11d ago
    It looks like more of Firefox has been ported over to Rust since then: https://www.wilderssecurity.com/threads/security-chromium-versus-firefox.450867/#post-3136787 https://www.wilderssecurity.com/threads/security-chromium-ve... The reason why I support Gecko and Ladybird’s engine is because I am opposed to monoculture, however. Even if Gecko (Firefox) is less secure than Chromium (Chrome, Edge, etc.), by not having a monoculture, a Chrome exploit will only take down the subset of people using the Chromium ecosystem, and not affect Gecko users. Alas, most people are in the Chromium ecosystem right now so that means malicious hackers only need to target one codebase. It’s the same reason I wrote MaraDNS back in 2001—back then, there was only one open source DNS server[1,2] so I wrote another one.[3] [1] Djbdns was around back then but wasn’t open source, which limited its adoption. [2] https://lwn.net/2001/0208/ https://lwn.net/2001/0208/ [2] MaraDNS was and is optimized for running at most a few dozen domains on a system running a bunch of other services, where one does not want the DNS server causing security problems for the server, and where the DNS server needs to be lightweight as possible.

There’s a reason I use Firefox (Gecko). Also, Ladybird—another completely different web engine—is really promising. I spent five hours building it from source, having it take about 8 gigabytes of space, and it perfectly renders my own webpages and blogs. I have a feeling someone’s going to make an open source browser using Ladybird’s engine before Ladybird has official binaries.

tkot 11d ago
Is Firefox actually safer than Chromium-based browsers though? I know this is old: https://madaidans-insecurities.github.io/firefox-chromium.html#security-researcher-views https://madaidans-insecurities.github.io/firefox-chromium.ht... but has the situation changed substantially in favor of Firefox?
- armadyl 11d ago
  No. The post applies to Android, but the situation is significantly worse on desktop platforms since Android at least has OS-level sandboxing, etc. https://www.reddit.com/r/GrapheneOS/comments/1unhtxu/initial_response_to_a_blog_post_claiming_to/ https://www.reddit.com/r/GrapheneOS/comments/1unhtxu/initial...
- strenholme 11d ago
  It looks like more of Firefox has been ported over to Rust since then: https://www.wilderssecurity.com/threads/security-chromium-versus-firefox.450867/#post-3136787 https://www.wilderssecurity.com/threads/security-chromium-ve... The reason why I support Gecko and Ladybird’s engine is because I am opposed to monoculture, however. Even if Gecko (Firefox) is less secure than Chromium (Chrome, Edge, etc.), by not having a monoculture, a Chrome exploit will only take down the subset of people using the Chromium ecosystem, and not affect Gecko users. Alas, most people are in the Chromium ecosystem right now so that means malicious hackers only need to target one codebase. It’s the same reason I wrote MaraDNS back in 2001—back then, there was only one open source DNS server[1,2] so I wrote another one.[3] [1] Djbdns was around back then but wasn’t open source, which limited its adoption. [2] https://lwn.net/2001/0208/ https://lwn.net/2001/0208/ [2] MaraDNS was and is optimized for running at most a few dozen domains on a system running a bunch of other services, where one does not want the DNS server causing security problems for the server, and where the DNS server needs to be lightweight as possible.