undefined | Better HN

0 pointspcwalton7y ago0 comments

There are features Chrome has that Firefox doesn't. There are also features that Firefox has that Chrome doesn't, such as Stylo and WebRender.

You can argue that Site Isolation is more important than large performance improvements (I think that's a losing argument, given that Site Isolation as presently deployed in Chrome doesn't even defend against compromised renderers and as such is restricted to being another Spectre mitigation), but you're being way too glib here.

0 comments

cromwellian7y ago

I'm not being glib, my current work involves security and privacy, and so I'm more sensitive / concerned about those issues than rendering performance. Current JITs like V8 even give me the willies in terms of attack surface area, such that I'm willing to stomach something like a WASM interpreter for my use cases.

I recognize that WebRender is a huge technique achievement and I absolutely love it when people achieve silky smooth 60fps renders, and if I was working on games or graphics or UX, I'd probably rank that over top of Site Isolation.

The original post mentioned process isolation and flash, so my comment was more a long the lines of 'it's still behind chrome (in isolation)'

pcwaltonOP7y ago

Even if all you care about is security, I don't think Site Isolation makes a real-world difference right now, as it's simply a defense-in-depth Spectre mitigation in case the first-line Spectre mitigations, which are deployed in both Chrome and Firefox, fail. At present, using Site Isolation to protect against compromised renderers is a TODO for both Chrome and Firefox. It's true that Chrome is closer to getting there, though.

readittwice7y ago

Please correct me if am wrong: But I think both Chrome and Safari have disabled/removed their Spectre-mitigations in the JS engine.

1 more reply

j / k navigate · click thread line to collapse