Slashdot Mirror
Microsoft Research Showcases New Browser Prototype, "Gazelle"
Ars Technica reports that Microsoft has opened up about "Gazelle," a new browser prototype of theirs that is modeled after the underlying concepts of operating system design. "A research team led by Microsoft's Helen Wang recently published a report about an experimental browser prototype called 'Gazelle' that uses processes to isolate page content elements originating from different domains. It builds on the concept of multiprocess browsing but uses more fine-grained isolation to expand on the security advantages that are already delivered by existing multiprocess browsing models. But is it an operating system, Microsoft Research's analogue to Google's Chrome OS? Not quite."
Oh boy! A more secure browser from the pros at secure browsing, Microsoft.
Microsoft focusing on developing a browser-based OS is directly opposed to their current business model, which involves forcing users to purchase an operating system. Microsoft's focus has always been on for-pay, offline applications. Taking a precautionary foray into Google's future business model seems to show that they are at the very least wary of Google's future plans.
"Going to war without the French is like going deer hunting without your accordion." ~General Norman Schwarzkopf
MS's idea is nice, but it's not going to help a lot of things very much. It'll help when plug-ins and helper apps go runaway, being in a separate process they won't be able to block the browser itself. But from a security standpoint the problem isn't that those embedded objects are in the same process, it's that they have access to the same page and the DOM elements in it and the data structures of the browser itself. And that won't be solved just by putting them in their own process, not without isolating them from the rest of the page and browser to a degree that'll break a lot of Microsoft's technologies.
After reading that article, I'm much less excited than I was. I had assumed it was something similar to Google Chrome OS, but it's not even something that seems like it turned out very well for Microsoft, or something that can have yet undiscovered major issues on the horizon. The idea seems to have turned out overly complex to work around the limitations with the approach, and all that in a resource hungry .NET application. It says they're hopeful to get the per-tab RAM usage down from 16 MB, but I have to wonder by how much? This approach doesn't seem much better than running a process-separated browser written in Java. Ugh.
I have a hard time understanding the decision to use .NET, but perhaps it was a security decision? Anyway, it doesn't sound like the optimal choice, when the project all revolves around low-level features like isolating the tabs even further.
Beware: In C++, your friends can see your privates!
Some of Microsoft's technologies - like data files that can execute code - need to be broken. It is sometimes necessary to sacrifice convenience for a degree of security. The personal computer industry has been slowly coming to terms with this for the last 10 years or so, it would be nice if we don't have to wait another 10 before it all works properly.
From scarped cliff or quarried stone she cries "A thousand types are gone, I care for nothing, no not one."
Unless if by new you mean:
From february at least, seems older to me: http://research.microsoft.com/apps/pubs/default.aspx?id=79655
Has already appeared on slashdot and a hundred other tech sites.
http://tech.slashdot.org/article.pl?sid=09/02/22/1724244
Its hard to google before you run to try and get a story submitted isn't it?
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
What they don't tell you is that the part of the gazelle it most closely emulates is the stomach; which, in ruminants, implements four-chambered process isolation in order to safely digest large quantities of low-quality input. This seemed like a valuable feature for a web browser.
Clearly they named it Gazelle because ultimately they expect it to be killed off by safari.
If we start buying CDs then the terrorists have already won.