For web browsing, that almost makes no difference. As long as the browser is being updated, the most important attack vectors are closed. Even if there are any exploitable vulnerabilities on the OS, that will stop malware from even getting to them.
Absolute joke of a comment. You are assuming the browser is a holy grail completely isolating the internet from the operating system.
First of all. The browser runs on the operating system’s services. In particular, the isolation that you implicitly cite is done entirely by the kernel. (That’s for example why you cannot run chrome in an unprivileged docker container - the crucial isolation-centered system calls are not available) The whole network stack is managed by the operating system. Cryptography can also partially be done OS-sided. The simplest example is CSPRNG, which is usually provided by the OS. (Advanced systems may rely on external physical generators, see Cloudflare’s lava lamps).
Secondly. Completely and utterly wrong. The linked video displays the execution of Meltdown/Spectre within a browser. Using JavaScript. This allows the attacker to gain access to any data they want on your computer simply by running some JavaScript code. Easily remotely executed via XSS on a poorly written website. You may read the full article here. Or inform yourself about Meltdown and Spectre here. How is that relevant? Combating this vulnerability was primarily done via critical OS updates. The exploits are inherit to certain CPUs and are therefore not fully fixable. Still, the combination of BIOS, Chipset, OS, and browser updates help prevent very serious attack vectors. (That’s the reason why the browser’s time measurement is only accurate to about the millisecond.)
So no. Browsers aren’t the magic solution to everything (sorry Ubuntu Snap). They very much depend on the OS providing the assumed security guarantees. And even assuming no direct vulnerabilities in the OS, we can never exclude side-channel attacks, like what Meltdown and Spectre were (or still are if you refuse to update your system).
For web browsing, that almost makes no difference. As long as the browser is being updated, the most important attack vectors are closed. Even if there are any exploitable vulnerabilities on the OS, that will stop malware from even getting to them.
Absolute joke of a comment. You are assuming the browser is a holy grail completely isolating the internet from the operating system.
First of all. The browser runs on the operating system’s services. In particular, the isolation that you implicitly cite is done entirely by the kernel. (That’s for example why you cannot run chrome in an unprivileged docker container - the crucial isolation-centered system calls are not available) The whole network stack is managed by the operating system. Cryptography can also partially be done OS-sided. The simplest example is CSPRNG, which is usually provided by the OS. (Advanced systems may rely on external physical generators, see Cloudflare’s lava lamps).
Secondly. Completely and utterly wrong. The linked video displays the execution of Meltdown/Spectre within a browser. Using JavaScript. This allows the attacker to gain access to any data they want on your computer simply by running some JavaScript code. Easily remotely executed via XSS on a poorly written website. You may read the full article here. Or inform yourself about Meltdown and Spectre here. How is that relevant? Combating this vulnerability was primarily done via critical OS updates. The exploits are inherit to certain CPUs and are therefore not fully fixable. Still, the combination of BIOS, Chipset, OS, and browser updates help prevent very serious attack vectors. (That’s the reason why the browser’s time measurement is only accurate to about the millisecond.)
So no. Browsers aren’t the magic solution to everything (sorry Ubuntu Snap). They very much depend on the OS providing the assumed security guarantees. And even assuming no direct vulnerabilities in the OS, we can never exclude side-channel attacks, like what Meltdown and Spectre were (or still are if you refuse to update your system).
Here is an alternative Piped link(s):
Completely and utterly wrong.
Piped is a privacy-respecting open-source alternative frontend to YouTube.
I’m open-source; check me out at GitHub.