Hacker News Reader

Comment by Santosh83 | Hacker News Reader

How do you know with such certainty that it is because it is too easy to hack and not because Chrome is the current "big fish" among browsers and Google gives monetary rewards to white hats, both of which could reasonably fuel disproportionate interest in breaking Chrome?

View on HN

For what it is worth, Firefox also has a security bounty program, one that is older than Chrome itself. :) Of course, the payouts are smaller than those from Pwn2Own, but on the other hand, reporters don't have to demonstrate a full exploit that can actually execute arbitrary code.

Reasons aside, the fact remains that when a group of white-hat hackers says they "won't bother" with a given target, it doesn't speak well to that target's security. There are no-doubt tons of exploits in Firefox still waiting to be found, as there are in Chrome, Opera, Edge, etc. Given that the Tor Browser is built on top of Firefox, it's a huge loss for everyone that Firefox is not being included in the attacks; the vulnerabilities that the white-hats find would be reported and promptly plugged, rather than left open for nefarious three-letter agencies to exploit.

> Reasons aside

No. Reasons not aside. Reasons are very important.

If we don't know what the reason was, and they won't elaborate on it, what importance does it have? Pwn2Own 2016 already happened. Firefox wasn't included, for whatever reason. The damage is already done at this point, as its exclusion created the impression that it was "not worth attacking".

If the guys had said, "We didn't bother with Firefox because they weren't willing to pay us as much as Google or Microsoft", okay. But they didn't. What they said was:

'We wanted to focus on the browsers that have made serious security improvements in the last year,' Brian Gorenc, manager of Vulnerability Research at HPE said."

And now Firefox looks weak by comparison.

> If the guys had said

Why would they have said that, even if it were true? What's the upside for them?

I agree the net result is the same whether they were honest or not, of course, which is again why there was no upside for them to say that if it were true.

Reply on news.ycombinator.com