One huge advantage the Chromium has over Gecko is Google's Security Team (ie Project Zero).
For most users, the web browser is one of the biggest attack surfaces and having arguably the best security team behind the browser engine is a good thing.
For most users, the web browser is one of the biggest attack surfaces and having arguably the best security team behind the browser engine is a good thing.
Yes some of that might be thanks to PZ, but that’s beside the point, isn’t it?
Choosing Mozilla’s platform would have been better for code diversity, which has its own distinct security benefits.
Like if you have 3 different crypto imlpementations, you have times more teams that have to get a thing right. It seems way easier to try and get it right just once.
Perhaps there's a holistic idea of "if one browser has an issue, at least it doesn't affect 100% of them" but given what CVEs look like in reality (often variations of the same attack across multiple programs) it seems like the cost/benefit would not be in our favor
Not everyone gets hit with every attack. Biological systems work this way too.
This happened with Cisco routers back in the day, Juniper had to add a flag to make a routing protocol compatible with Cisco because Cisco implemented it wrong but had so much dominance that Juniper had no choice if they wanted to get in the game.
Without serious competition you eventually get IE6.
Is this really true? someone posted somewhere(can't find it) where it shows Firefox has a worst security record compared to Chrome.
Also, in the past, Firefox was left out from hacking browser competitions because it was to easy to hack.
Outside of the security teams, I think it's actually that Chromium is much better fuzzed and scrutinized. They just have so many more resources, including those for security.
Most of what I've read relates to Microsoft products - and I'm not saying that Microsoft is better/worse than the rest when it comes to security.
The web is the safest, most battle-tested sandbox environment to run apps in. It’s so safe that you click random links all day long, running 1000s of apps and never have to worry.
I’ll take web apps over native apps from a security perspective, thank you.
There are better ways to sandbox applications in 2020.
This is true despite the fact that on iOS, sideloading custom apps without a developer account is extraordinarily inconvenient.