Related articles

• Alan: Speaking of other browsers born in the research lab, DARPABrowser was developed as part of a research contract from the Defense Advanced Research Projects Agency. If JavaScript were disabled, do you think Chrome could offer the same level of security? Adam: The DARPABrowser has very different security goals than Chromium. For example, the DAPRABrowser aims to limit the damage a compromised rendering engine can do while displaying an honest Web page. Worrying about these threats ends up making the privileged component as complex as the rendering engine, and it's not clear how much security that buys you. Alan: Let’s move onto commercially available Web browsers. How is Internet Explorer’s “Protected Mode” different from what Chromium does? Collin: Protected Mode is designed to protect local files from being overwritten by an attacker who exploits a browser vulnerability. This is a good start--it makes it harder for the attacker to install malware. But the attacker can still read all your files. There is a lot of important stuff on the file system and that's why the Chromium architecture is designed to protect the confidentiality of files as well. Alan: Opera has made a big deal about supporting NX bit and ASLR. These are also features supported by IE8. Are they also implemented in Chromium? Adam: Yes.  Chromium uses NX, ASLR, and StackCheck. Alan: While Mac OS X Leopard offers less security features than Windows Vista or Windows 7, it offers better safety because there are fewer threats. Dino A. Dai Zovi made the analogy of leaving your front door unlocked; whether or not you are safe depends on where you live. What are the technical challenges of implementing Chromium’s sandboxing on other operating systems, such as Mac OS X or Linux? Adam: Mac OS X has a powerful built-in sandboxing mechanism that Chromium can use to sandbox its rendering engine. My understanding is that there are some challenges with drawing to the screen in a multi-process application, but I expect the team will find a clever solution. Different distributions of Linux offer different sandboxing mechanisms, including SELinux and AppArmor. The Linux team is evaluating which of these best fits Chromium's security needs.

• Fifty years from now, historians will look back and realize the unparalleled impact Linux has had on human civilization. Most people don’t realize it, but the world in 2008 already runs on Linux. I’m not simply talking about how the majority of Internet servers run on Linux, but the ubiquitous use of Linux in embedded devices ranging from televisions to laser printers/copiers to military avionics. However, one area where Linux will never succeed is the desktop. Linux apologists can make any number of arguments why Linux should take off on the desktop. First of all, it’s a server-grade operating system that’s available for free. No Apple Tax. No Microsoft Tax. Companies such as Dell are now even shipping PCs from the factory with Linux installed, removing the uncertainty of support. Second, Linux is efficient, allowing you to breathe new life into old computers. Lastly, all of the trappings of a traditional desktop PC are now found in Linux, ranging from Xgl/compiz for Aero and Quartz-style visual effects to OpenOffice and even Firefox. The problem is that people like shiny things. While technology geeks may be interested in breathing new life into their older PCs, Moore’s Law continues to make the argument irrelevant. In the era where an entry-level PC was over $1,000, this may have made sense. Nowadays, an entry-level system has a dual- or even quad-core CPU for a fraction of that cost. The cost of Windows Vista is about $50 to a manufacturer such as Dell, less than a full tank of gas. The problem arises when the consumer decides to upgrade to get a new printer or a new HDTV tuner and suddenly discovers that Linux does not support the new hardware. Linux works for technology geeks because, when you have the time and inclination, it can be fun to tweak and fiddle with your PC. If you’re a technology geek, it’s fun to try out different window managers to get the perfect fit or to troubleshoot and debug your setup. However, most consumers want plug-and-play, and that’s where Linux fails. The Failed Sandbox Model To succeed in Linux, you have to play in the Linux sandbox. You have to research ahead of time to make sure that new hardware is fully compatible. While Linux promises oodles and oodles of applications (just look at any distribution), the options are far less when it comes to the stuff that really matters. Want a modern Web browser? You’re stuck with Firefox. On the PC, you’ve got the option of Google Chrome. Want to process RAW digital camera images in Linux? You can choose between Bibble- and dcraw-based applications. On a PC or Mac, you have a wider range of options. You can use Bibble and dcraw, but you also have Capture One, Lightroom, SilkyPix, Photoshop, and countless others. The problem is that for most consumers, Mac OS X offers most of the benefits of Linux with a better sandbox to play in. It’s just as stable as Linux and offers the same or even better out-of-the-box security, but has even wider software and hardware support and a set of best-of-breed native applications. Those requiring additional flexibility in hardware support can go with a PC on the desktop. While you have to deal with the security risk of Vista and the annoyance of Vista’s UAC, the trade-off is fair to most consumers in being able to avoid the idiosyncrasies of Linux. Even Linux’ temporary success with netbooks has been short lived. After initially embracing Linux for the cost savings, many netbook manufacturers such as MSI are backing away from Linux after recognizing a 4x higher return rate. The power management features in operating systems such as MacOS X or Windows XP are superior to those of Linux, and a Windows XP-powered Eee PC lasts longer than a Linux-powered Eee PC. Here’s another way to look at it: create a list of the best Linux applications for the desktop or home user. How many of those are also available for the PC or Mac? Now try creating a list of the best PC or Mac applications. How many of those are available for Linux? The very best applications that Linux has to offer are probably offered in a Mac OS X or Windows port as well. With OS X shipping with X11 and UNIX compliance, even custom software development can be achieved on a Mac.

• Alan: Let’s talk a little bit of tech. Mac owners are often smug about their system being "more secure" and yet it would seem as if Chrome/Vista offered the most secure solution this year. A lot has been said about Chrome's "Sandboxing" model. How is this different from IE7's Protected Mode? What does Sandboxing really mean when Chrome's first exploit allowed remote applications to be launched from Java? Charlie: Sandboxing helps quite a bit, if done properly. It’s one of the many exploit mitigation technologies being used. The idea is there will always be bugs and vulnerabilities in software, but you can make it difficult for attackers to get code running on the system and even if they do, limit the amount of damage that can be done. Basically, the attacker has to get code running and then figure out how to get out of (or break) the sandbox. Alan: Interrupt me if I’m wrong. My understanding of it is that you compartmentalize the different parts of the application. Historically, the Web renderer is the point of entry, since that’s what interacts with the rest of the Internet. Once code is arbitrarily run, that application can then do all sorts of stuff like track keystrokes, format your hard drive, etc. The idea behind sandboxing in a Web browser is that the application is split into different threads. The thread that manages user input/keystrokes is separated from the thread that deals with rendering the Web page. An application like Google Chrome will rely on the Windows security model to give the renderer zero privileges. That way, the randomly executed code by the “renderer thread” is blocked from accessing other stuff by the operating system. The “main browser thread” will only pull bitmaps from the renderer. So, even if you hacked into the renderer component, you couldn’t go any further than messing around with the text, pictures, etc. The main weakness with relying on the sandbox, though, is that I could hack the renderer so the next time I went to a legit Web site, it altered the HTML so that I had a realistic “You Need a Newer Version of Flash” message. All of a sudden, I’m downloading a Trojan Horse and now I’m screwed. Charlie: I don’t know the nuts and bolts of Chrome, but I imagine you could start a new renderer each time. I also think they use processes as opposed to threads. [Alan’s Comment: Charlie is correct. Chrome uses processes instead of threads. The difference is that the memory space for each process is different--better sandboxing]