Mozilla Celebrates a Year of Shrinking Firefox Memory

One year ago Mozilla launched MemShrink, an aggressive campaign to trim Firefox’s then much larger memory footprint. Since then not only has the browser’s overall memory use dropped considerably, but the effort has been expanded to tackle add-ons, a common source of Firefox memory woes.

Mozilla programmer Nicholas Nethercote, head of the MemShrink effort, takes a look back at the progress and some of MemShrink’s “big wins,” including better JavaScript performance, fewer memory leaks in add-ons and the new about:memory page, which is, according to Nethercote, “the single most important tool we’ve created, and has driven a lot of the MemShrink improvements.”

If you’re interested in the finer details about everything that’s been done to reduce Firefox’s memory over the last year, be sure to read through Nethercote’s full post.

As for the future, look for MemShrink to keep bringing down the memory overhead. “There’s no real secret to MemShrink,” writes Nethercote, “so far it’s basically been a long, steady grind, gradually improving tools, fixing leaks, slimming down data structures, and responding to user’s problems…. there are no plans to change that.”

If you’d like to get on the leading edge of MemShrink improvements, you can switch from Firefox’s stable channel to either the Beta or Aurora channels, which include any new features, as well as any memory improvements, much sooner.

Chrome is the most secured browser – new study — Firefox finishes last in 3 browser security race

Sandboxing is the issue, ie isolating the running process from system tasks.  Not all sandboxes are equal.

In much the way traditional sandboxes prevent sand from mixing with grass on a playground, security sandboxes isolate application code inside a perimeter that’s confined from sensitive OS functions. By placing severe restrictions on an application’s ability to read and write to the hard drive and interact with other peripheral resources, sandboxes are designed to lessen the damage attackers can do when they successfully exploit a vulnerability in the underlying code base.

Google Chrome offers more protection against online attacks than any other mainstream browser, according to an evaluation that compares exploit mitigations, malicious link detection, and other safety features offered in Chrome, Internet Explorer, and Firefox.

The 102-page report, prepared by researchers from security firm Accuvant, started with the premise that buffer overflow bugs and other security vulnerabilities were inevitable in any complex piece of software. Rather than relying on metrics such as the number of flaws fixed or the amount of time it took to release updates, the authors examined the practical effect protections included by default in each browser had on a wide class of exploits.

Their conclusion: Chrome is the most secured browser, followed closely by Microsoft IE. Mozilla’s open-source Firefox came in third, largely because of its omission of a security sandbox that shields vital parts of the Windows operating system from functions that parse JavaScript, images and other web content.

“We found that Google Chrome did the most sandboxing,” Chris Valasek, who is a senior research scientist for Accuvant, told The Register. “It restricted the movements more than any other browser. Internet Explorer came up a close second because it implemented a sandbox where you could do certain things but you were allowed to do more things than you could in Chrome. Lastly, Firefox came in last because it didn’t implement a sandbox yet.”

The report was commissioned by Google, but the authors insist they had complete autonomy in deciding what metrics to use and what conclusions they made. The researchers have released more than 20MB worth of data, software tools, and methodologyso peers may review or build upon the research. The study focused solely on the security offered by Chrome, IE, and Firefox, which when combined account for more than 93 percent of web users, according to the report. All three browsers tested were run on Windows 7.