3 orgs instead of 2, which is still a low count, does not at all invalidate the manpower shortage in comparison. Even if you include Igalia (who contribute to almost every somewhat major open source project, look it up), this is still not widespread organizational backing compared to what Chromium has behind it. Will include them going forward, I don’t think this fixes the basic issue of the Gecko code base maintenance. Firefox is to Chromium what Solana is to Ethereum, if you know what I mean. The project with more users and devs working on it will have more security issues discovered, doesn’t mean the security practices of competitors are better when they are not as used and tested. They don’t even have real site isolation (different parent domains can still share the same content process) or a sandbox over there, making escapes and exploits child’s play. Firefox has shoddy security practices and is 5 years behind Chromium minimum in terms of security. It’s easy to find nothing when nobody uses your shit or bases any kind of software on it. Who uses the Firefox codebase? Just Mozilla and the undermanned Tor Project, LOL. You know who works with Chromium code? Not just Google, but also Microsoft, Opera, Amazon, Brave Software, Vivaldi Technologies, Intel, and thousands upon thousands of Electron apps.
There’s a better chance to catch zero days if the codebase is actually being used and scrutinized. > if they’re patching 20 to 30 security exploits a month, and zero-day in-the-wild’s every month or two, just imagine how many they HAVEN’T caught The security issue that is patched in the new version of Chrome is rated high, the second highest rating after just another zero-day patch day at chromium you guys
The official post on the Chrome releases blog offers little information.
0 kommentar(er)
