Hacker Newsnew | past | comments | ask | show | jobs | submit | lima's commentslogin

They may still train on it if you submit feedback or flag a safeguard. The terms are a bit fuzzy on this.

Inside the JS sandbox, not the browser's outer containment sandbox.

It would be chained with a separate 0day sandbox escape.

Which browser has a better security track record?

Despite what people are saying here, chrome has a really excellent track record. Nobody is perfect. Switching just because chrome got exploited one time will likely result in you switching to something worse.

If you're paranoid, disable JIT.


Or disable JS altogether, and enjoy many sites working much quicker. Many others fail & need to be selectively allowed, but it's been worth it.

If by quicker you mean blank content, I'll agree, it is worth it.

Actually thinking back, I get _more_ content, because there's a notable number of access screens that just don't function with JS off, leaving the whole article available.

Somehow I don't think you've tried, if you think all I get is blank content.

It's not about switching because chrome got exploited one time, it's about switching not to reward unethical behavior.

well one someone posts on an article about an exploit in chrome saying that the exploit is a reason to switch, i think its fair to say its not about "not reward[ing] unethical behaviour"

Firefox with uBlock Origin. It’s astonishing how many exploits uBO stops before they ever reach your browser engine. It’s the antivirus of the 2020s.

Brave would be a much better option if you want security and good adblocking.

Brave is just a wrapper on top of Chromium. Just like the many other “browsers” you can think of recommending.

Yes but I was responding to someone who wanted good ad blocking which could be helpful for the security of non-technical users at the minimum.

I suggest Zen browser (fork of FF), it feels closer to chrome.

I hear about Zen. Random q:

It can’t trick Canva into letting you use the color picker, or otherwise enable it, can it - if someone happens to know?

(What a dumb feature to be locked to the Googlesphere.)


I don’t know honestly.

What does it mean "closer to chrome"?

I should have been more specific. I meant the aesthetics. Zen mimics Arc Browser with vertical tabs and a hidden sidebar to maximize screen space.

In a good way?

Yes, in my opinion. I know a couple of people who actually jumped from Chrome to Zen because of it. In their mind, Firefox is something from the past and rough around the edges. Zen gave new attraction to FF. I am all for any opportunity to disrupt the Chrome monopoly we currently have.

uBlock Origin won't help with this kind of targeted exploit, and Firefox has a much worse security track record.

It absolutely does help, because it blocks hundreds of thousands of shady origins.

That blocks all sorts of abuse, but a targeted exploit would be delivered on a clean domain.

uBO stops exploits? Source?

malvertising is really a method of delivering exploits, but there is no reason to think its relavent to this situation.

For non technical users, scam adverts are probably the biggest threat.

So i agree ubo is an important security technology, but its probably irrelavent to the topic at hand.


It blocks many shady domains, which stops many exploits before they ever reach your browser.

[flagged]


The idea here is that uBlock filters the domains that may serve the malware in the first place. It basically works the same as a DNS filter.

You should be using a DNS filter ideally so it never hits the device in the first place. Adding an extension only increases browser attack surface.

Which you can also easily do with uBlock Origin Lite in Chrome/Chromium.

People pretend like uBoL doesn’t work at all

I'm willing to believe that stock chrome has a better record than stock Firefox, but

> and on top of it you’re recommending an extension as a security measure

... Yes? Why can a browser extension not be a security measure/improvement?


Because extensions especially MV2 ones only increase attack surface.

No, they don't only increase attack surface. In particular, uBo reduces attack surface a lot more than it increases it.

The only scenario in which one could possibly argue this is if the option is using MV3 uBlock Origin Lite in basic mode, where the browser handles the content blocking just reading rules from uBoL.

uBO MV2 and MV3 in any of the higher two modes objectively add more attack surface when the alternative is basic uBoL + DNS level filtering which is the most secure combination second to just DNS-only filtering.

And ultimately ad blocking is only badness enumeration which is a poor security measure to rely on, especially when the main application (Firefox) lacks proper security measures versus Chromium. It’s like the NVIDIA owners coming up with 3,000 different cable solutions to the burning connectors when its a problem with the card itself.


Vanadium makes improvements on Chromium. https://grapheneos.org/features#vanadium

Most of those are just changing flags, not really unique development. Like "disable JIT" is a Chromium flag. "Zero-init everything" is a Clang flag.

It's not even a build flag, it's a setting that you can just go and enable in Chrome's own settings menu (chrome://settings/content/v8).

Right, but it's value-add on a derivative, not its own standalone engine.

eID PKIs have very little in common with the web PKI. There's a national root of trust with strong attestation. It's a very simple trust relationship. You already trust the respective government to issue IDs.

Plenty of European countries have an eID CAs and it works fine. The PKI part is a solved problem.

Doesn't even need ZKP, the CA can just issue an attestation.


I've experienced this "solved problem" when visiting Germany during COVID. On every entrance to a mall there was somebody with a scanner device, and they only let you in if the scanner showed a green mark. I've been fully vaccinated (not EU) but my code didn't show a green mark on their scanner and I was promptly denied entry. The solution was to show them my German friend's code on my phone, this registered just fine, so I could enter anywhere.

So the whole "eID/CAs/ZKP/PKI" mumbo jumbo can be easily fooled by a gif file.


That part seems to qualify as an unsolved problem. But could anyone have taken the scanned data (or the GIF file) and used it to open a bank account in your friend's name? That seems like the main issue that is genuinely solved by correct implementation of this type of system.

Already today nobody can open a bank account in my name with just a picture of my passport, as the original would be required. My passport doesn't have any of the "eID/CAs/ZKP/PKI", so the question of "what exactly the addition of it solves" remains open.

My national ID card supposedly has some of it, the 17-year olds who want to pass as 18-year olds usually show a doctored gif file of their ID card, with a year of birth one or two years before the actual one; this works in ~98% of the cases.


Actually it does. Biometric passports (and IDs) have a chip which is read via NFC and the information the NFC provides is signed by a CA which is the government that issued the passport. ICAO compiles a database of public keys corresponding to each government (plus countries exchange their public keys via bilateral agreements). Unless somebody is doing purely visual inspection, any time a passport is scanned there's PKI involved to validate if the information is genuine.

None of that applies to my (non-biometric) passport, and we were talking about banks that don't have the passport-reading equipment to begin with.

That’s not what the new schemes are about, and they aren’t going to be based on a qr code you can just copy, no.

If you’re genuinely interested, look into things like OpenID credentials systems, and similar standards like w3c verifiable credentials.


yes, just as age verification can be fooled by an older friend who gets the check mark.

Reminds me of

   If you think cryptography can solve your problem, you don’t understand your problem and you don’t understand cryptography.
(Bruce Schneier dug into origins of this here: https://www.schneier.com/blog/archives/2026/05/laurie-anders...)

If the scan also included a picture, that was signed with your private key, then it would be harder to spoof.

Not really, the attacker would just need a picture of you which he could then sign (since we're assuming here that he gained access to your key IIUC). That's a pretty low bar compared to the first step of gaining the key.

You’re conflating the real life need of ID, with trust in the organisation.

Sorry. Wrong.


There's also the more fundamental issue that Postgres - unlike something like Yugabyte - does not use a distributed consensus algorithm for writes and can lose committed writes during network partitions.

But of course, neither does Tailscale's weird DIY contraption.


And tick-borne encephalitis, in regions where that is endemic.

No need to be rude, though!


Being rude to people spreading dangerous misinformation is mandatory on the internet, lima.

Do you kindly and charitably respond to antivaxxers and drug dealers?


HN has very specific rules for this: https://news.ycombinator.com/newsguidelines.html

You don't respond to them at all, flag the comment, and/or email the moderators.

Being snarky does not contribute to the discussion and gets your comments flagged.


So you (high karma user) are recommending that I (low karma user) simply flag (which I can't do) and not respond (leaving no trace) to misinformation?

I should respond to bad info by continuing to lurk. Very smart!


Yes, if you're unable to be polite about it, just don't comment and/or email the moderators. Your comment would have been informative and well-received without the snark.

You were right to call out the other person for trivializing the risks of tick bites, just assume good faith and be kind.


Ticks do not drop from trees.


On the Elizabeth Islands at Cape Cod MA we have huge numbers of ticks and all the allergies and illnesses that go along with them. We also have no pavement or vehicles so we are into tick habitat as soon as we step out the door. To defend ourselves we have developed an oversock to stop ticks on the foot and lower leg where they often hop on. We chose a tight-weave parachute fabric so that even the tiniest ticks can't get through, and found a fabric that is light and breathable but tough, and we used a turndown at the knee to stop ticks from climbing. We treat these at Insect Shield in NC so that they are double protection: repelling ticks with permethrin and blocking access to skin with an unbroken barrier over the foot to the knee. We had a lot of interest outside our island community so we sewed up a big batch in Fall River MA and have made them available. Search Ticktogs if you think they might help you like they have helped us. They have cut way back on our tick bites.


TIL about Ticktogs. Thanks!


Where is your proof?

They have thermal sensors on their forearms and are known to climb trees. Why wouldn't they approach from above?



Could you share the paper where every tick species was tested over a decade and none of them ever climbed up a tree and fell down on prey?


Ticks climb low vegetation (not just grass) and wait for a host to pass by ("questing").

If you're going to disagree with basic textbook biology knowledge, the burden of proof is on you.


Humans walk to Burger King (not just McDonalds), provide payment, and wait for a cashier to provide them a hamburger. Everyone knows humans aren't capable of "hunting" with a "bow and arrow."

You are taking the official, "please don't panic" story from CDC and trying to force it down everyone's throats while claiming it's as basic a fact of biology as chromosomes and the mitochondria. It's not. This is a contested area of animal behavior, not a microscopic process.

Are you persistent in being dense because you want somebody to engage with and correct you, or are you genuinely trying to get people infected?


Ticks don't exclusively hunt via questing. Some will actively pursue hosts if needed. The lone star tick is especially known for this: https://www.mdpi.com/1660-4601/15/3/478

> In contrast to D. variabilis, A. americanum is regarded as a hunter tick, which will walk/crawl rapidly across many meters when attracted by host odors. This behavior enhances its host range since these ticks do not have to wait for a passing host.


> But you would know whether you needed to even book an appointment.

Only if the test is sufficiently accurate to rule out transmission. Even molecular tests can't reliably predict that.


Yes, but this test cannot diagnose Lyme in humans.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: