Hacker Timesnew | past | comments | ask | show | jobs | submitlogin

Firefox sandboxing does not use Rust. Servo sandboxing (work in progress) does.

It's not accurate to say that Firefox has no sandbox. Sandboxing work has been rolling out for many months now, and later versions have increasingly restrictive sandboxes. You can see the current status per version here: https://wiki.mozilla.org/Security/Sandbox#Current_Status

Hardening the sandbox is a constant work in progress, but it's not as simple as "compromise of browser engine automatically means arbitrary code execution as running user" any longer.



Sorry I didn't mean Sandboxing used Rust, It was a separate thing (That Rust is less susceptible to such class of errors, so the more code written in Rust the better) Also didn't mean it has no sandboxing (I knew about efforts), my point was its security is not a match for Chrome yet, as seen from the amount and type of critical errors.

When it is there I would definitely use it along with Chrome.


In case it wasn't clear, it is now the case that content process compromise is no longer critical unless combined with sandbox escape.

Looking at historical vulnerability reports can be misleading in this regard, as the sandboxing features are rather recent (pre-stable-version in some cases).


If I wasn't clear as well, As far as I can see from the link you gave It still does not match the level of security Chrome offers, it is getting there, but not yet.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: