There’s actually a couple of illegal and socially unacceptable subjects that I’m interested in, but I’m afraid to Google them because I’m assuming I’ll show up on “the list”.
One thing Bray doesn’t bring up is that there is tension between the countermeasures. For example, security audits are over-burdensome if releases are too frequent, but release must be frequent if we are to have the most complete protection.
To satisfy both requirements, we need to finally accept that the browser is not a monolithic program anymore: it’s a small operating system, encompassing many modules and coordinating multiple processes, not the least of which is a virtual machine for running arbitrary code. If we want something that can sit still long enough to be audited but updated fast enough to cover gaps then we need to break up the browser into smaller, recognizable bits. Like an operating system, we need to write code to do one thing, do it well, and maintain a standard interface. Each of those modules can then be independently audited.
For example, we need to be able to update the javascript engine to fill holes at the same time we decide to hang back on a tried-and-true rendering engine. Alternatively, we need a browser where a hating recent changes to a UI module is no excuse for not having up-to-date encryption.
From a public Hotspot while running Tor, etc. 
This topic was automatically closed after 5 days. New replies are no longer allowed.
