Tell HN: When Firefox jumps the shark, the call to action is Ladybird
48 comments
Passing Acid3 is a nice milestone, but realistically that's a 16-year-old test without modern performance requirements. $1 million is wild for an open-source hobby project, but sadly it doesn't buy many person-years at competitive salaries.
For Google and Apple browsers are loss leaders for their bigger business, so they have infinitely deep pockets to play Fire and Motion[1] with each other by adding more and more stuff to the platform, and setting higher and higher performance and security/privacy goals. Once you implement the first 90%, there's the harder second 90% to implement, and the goal keeps moving. And that's before you even have to waste time fighting bug-compatibility caused by the Chromium monoculture and Google's "oopses" serving non-broken code only to Chrome.
[1]: https://www.joelonsoftware.com/2002/01/06/fire-and-motion/
For Google and Apple browsers are loss leaders for their bigger business, so they have infinitely deep pockets to play Fire and Motion[1] with each other by adding more and more stuff to the platform, and setting higher and higher performance and security/privacy goals. Once you implement the first 90%, there's the harder second 90% to implement, and the goal keeps moving. And that's before you even have to waste time fighting bug-compatibility caused by the Chromium monoculture and Google's "oopses" serving non-broken code only to Chrome.
[1]: https://www.joelonsoftware.com/2002/01/06/fire-and-motion/
it seems to me that, if we could clearly define and document a useful subset of browser features, and start targeting that, it would help tremendously with long term viability and sustainability of hobbyist browser implementations. maybe starting with what dillo supports today?
That’s terrible for developers though. It’s already a moving target and having several moving targets to pick from doesn’t sound fun
Sounds more like the subset would be a static target that you could confidently assume that works.
Which is sort of what I expected from AMP and Gemini.
Which is sort of what I expected from AMP and Gemini.
How could it be a static target though? That doesn't seem practical.
if it is a strict subset, why is that harder?
Don't forget Servo engine, it's supported by the Linux foundation and they had been achieving impressive milestones.
Project Page: https://servo.org/
Project Page: https://servo.org/
I don't want another browser. FF does exactly what I need, and websites are pretty much exactly what they were a decade ago feature-wise. I just need security updates. "Feature updates" these days are almost always unnecessary bloat.
it's falling apart unfortunately. I use FF daily but there are already websites that are crippled, so more and more have to fire up Chrome just to get around that. Heck, even PG&E website barfs up the "Your browser is unsupported" when I try to pay my utilities bill. Say what you want about PG&E, but unfortunately the majority of the world will not spend a second waiting for FF to get their stuff together, and I don't want to get locked out of my utility bill either....
a new browser is very likely to also be "unsupported", so it's not solving that problem
What sorcery is a utilities website running that it can't accept bill payments through Firefox?
The only 2 websites I've come across that struggle with Firefox are Youtube and Photopea.
The only 2 websites I've come across that struggle with Firefox are Youtube and Photopea.
Throughout the whole COVID epidemic it couldn't run Teams web, and still has issues with it now. It was a big deal in my country.
Just check webcompat if you want too see how many sites are not compatible It's partly due to the fact that Mozilla will stick to its 'ideals' if it means not fixing something.
Why not just fork Firefox? IIRC there are already several actively-developed forks.
Starting fresh with a competent, modern, minimal initial platform can provide many benefits in the realms of sustainability, security and performance. See: WireGuard vs. OpenVPN, Wayland vs. X.Org.
Sustainability wise, Firefox is not built for hackers. One example is the Haiku community has been working on porting Firefox for years, to varying degrees of success. The problem is that it's just so huge; there are so many things going on, so many libraries that each require porting efforts on their own, DRM standards built into the core platform that will likely never see support, so real "Firefox" is likely to never happen regardless of community effort.
Meanwhile, though it is in a quite early state, multiple people are already experimenting with their own working builds of Ladybird on Haiku.
I'm not trying to say I can guarantee this will continue being the case as the ladybird project reaches maturity, but I think they deserve an honest shot. Wouldn't it be nice to have a truly portable browser engine?
Sustainability wise, Firefox is not built for hackers. One example is the Haiku community has been working on porting Firefox for years, to varying degrees of success. The problem is that it's just so huge; there are so many things going on, so many libraries that each require porting efforts on their own, DRM standards built into the core platform that will likely never see support, so real "Firefox" is likely to never happen regardless of community effort.
Meanwhile, though it is in a quite early state, multiple people are already experimenting with their own working builds of Ladybird on Haiku.
I'm not trying to say I can guarantee this will continue being the case as the ladybird project reaches maturity, but I think they deserve an honest shot. Wouldn't it be nice to have a truly portable browser engine?
Fair point, but then, what about Servo? Being based on Rust and not C++ seems like a major plus point over Ladybird, IMO.
I'm going to look seriously at Ladybird. I'm completely neutral about Servo. I don't care if the language a thing is written in is Rust or not.
When ypu are talking web facing client full scale browser, C++ is impossible to secure as well as a safer language and most safer languages are impossible to optimize as well as C++. So rust is not so much exciting as not horrifying.
I agree with this, I love SerenityOS and LadyBird looks very interesting. But scaling that to a serious and safe browser with C++ is going to be hard.
Plus, I don't see how Firefox is really broken. Right now, forking and shipping with a custom user.js is sufficient to fix most annoyances.
Plus, I don't see how Firefox is really broken. Right now, forking and shipping with a custom user.js is sufficient to fix most annoyances.
Yes, I know the argument and it has some merit. I just don't find it very persuasive, so a thing being implemented in Rust doesn't make me any more or less willing to use it. To each their own.
Microsoft: 70% of all security bugs are memory safety issues: https://www.zdnet.com/article/microsoft-70-percent-of-all-se...
Chrome: 70% of all security bugs are memory safety issues: https://www.zdnet.com/article/chrome-70-of-all-security-bugs...
"Rust is an emerging programing language that aims at preventing memory-safety bugs without sacrificing much efficiency. The claimed property is very attractive to developers, and many projects start using the language. However, can Rust achieve the memory-safety promise? This paper studies the question by surveying 186 real-world bug reports collected from several origins which contain all existing Rust CVEs (common vulnerability and exposures) of memory-safety issues by 2020-12-31. We manually analyze each bug and extract their culprit patterns. Our analysis result shows that Rust can keep its promise that all memory-safety bugs require unsafe code...": https://arxiv.org/abs/2003.03296
Seems persuasive to me.
Chrome: 70% of all security bugs are memory safety issues: https://www.zdnet.com/article/chrome-70-of-all-security-bugs...
"Rust is an emerging programing language that aims at preventing memory-safety bugs without sacrificing much efficiency. The claimed property is very attractive to developers, and many projects start using the language. However, can Rust achieve the memory-safety promise? This paper studies the question by surveying 186 real-world bug reports collected from several origins which contain all existing Rust CVEs (common vulnerability and exposures) of memory-safety issues by 2020-12-31. We manually analyze each bug and extract their culprit patterns. Our analysis result shows that Rust can keep its promise that all memory-safety bugs require unsafe code...": https://arxiv.org/abs/2003.03296
Seems persuasive to me.
As I said, there is some merit to the argument. I do think that it's stretched a bit far, but that's neither here nor there. In any case, I'm not saying I'm opposed to applications being written in Rust. Use the language that suits your needs the best. All I'm saying is that the fact that something is implemented in Rust is not really a factor (either way) when I'm deciding whether or not to use a particular piece of software.
> I do think that it's stretched a bit far
How so?
> Rust is not really a factor (either way) when I'm deciding whether or not to use a particular piece of software.
For a five function calculator or alarm clock app, sure. Browsers have an immense attack surface, handle incredible amounts of untrusted data in hundreds of different formats, and are actively exploited regularly.
Cloudflare reports almost 7% of internet traffic is malicious: https://www.zdnet.com/article/cloudflare-reports-almost-7-pe...
Software which is expected to deal with such hostilities and complexities needs to be written in memory safe languages in 2024.
How so?
> Rust is not really a factor (either way) when I'm deciding whether or not to use a particular piece of software.
For a five function calculator or alarm clock app, sure. Browsers have an immense attack surface, handle incredible amounts of untrusted data in hundreds of different formats, and are actively exploited regularly.
Cloudflare reports almost 7% of internet traffic is malicious: https://www.zdnet.com/article/cloudflare-reports-almost-7-pe...
Software which is expected to deal with such hostilities and complexities needs to be written in memory safe languages in 2024.
>Starting fresh with a competent, modern, minimal initial platform can provide many benefits in the realms of sustainability, security and performance. See: WireGuard vs. OpenVPN, Wayland vs. X.Org.
Wayland's been in the works for well over a decade now and many Linux distros still haven't switched over yet. I don't think this is a great example.
Wayland's been in the works for well over a decade now and many Linux distros still haven't switched over yet. I don't think this is a great example.
I'm moving to a fork at first, but what's exciting to me about Ladybird is that it's got a new web engine. There's not really a lot of options in that space right now, so it's great to see a non-proprietary newcomer. I'm hoping it helps bring some more diversity to the ecosystem which is extremely Blink heavy at the moment.
I've also been looking at palemoon and midori, but not for sure yet on them. It just seems like firefox has reached a point where it's not going to get any better.
> It just seems like firefox has reached a point where it's not going to get any better.
I wish. To me it seems like Firefox is certain to only get worse and worse. For a while now it felt like every major update came with something new I had to disable, often for privacy reasons, but now that Mozilla is an ad tech company, Firefox users are their product and they're just getting started selling us to advertisers.
I wish. To me it seems like Firefox is certain to only get worse and worse. For a while now it felt like every major update came with something new I had to disable, often for privacy reasons, but now that Mozilla is an ad tech company, Firefox users are their product and they're just getting started selling us to advertisers.
Palemoon is just a fork of obsolete Firefox which is liable to suffer from vulnerabilities already fixed in Firefox. At this point it lacks support for a vibrant ecosystem of Firefox extensions.
It also lacks the substantial improvements to hardware accelerated decoding on linux within the last year or so and improvements in performance.
It does have a sync backend but inactive account data may be deleted and if the project is shuttered your data is kaput.
It also lacks Android and ios support meaning you lack the virtuos benefits of using the same tech on all platforms like syncing passwords and bookmarks.
They also recently improved integration by allowing you to browse open tabs on synced computers
Firefox in also has in the last while added privacy preserving local translation support and long ago added really good local reader mode.
Also my browsing would be less nice without addons like Sideberry and Tridactyl not to mention colorful via pywal.
Then we get to adblocking an arms race that Palemoon with its several year old (2021)version of uBlock that will never be updated stands to lose.
Also the lack of a mobile version means that your options for adblock on the go are meager unless you either run Firefox Mobile or look into a more complicated option like pihole with its own tradeoffs like not being able to turn it off for a site with a click.
Firefox has been making dumb communication mistakes and been too friendly with partners but it remains in my opinion the best choice. Dumb choices like this can easily be disabled and if that becomes onerous libreWolf unlike Palemoon is just Firefox with different privacy friendly defaults.
That said it also requires more setup as far as addons and sync which is why I prefer to simply configure Firefox.
It also lacks the substantial improvements to hardware accelerated decoding on linux within the last year or so and improvements in performance.
It does have a sync backend but inactive account data may be deleted and if the project is shuttered your data is kaput.
It also lacks Android and ios support meaning you lack the virtuos benefits of using the same tech on all platforms like syncing passwords and bookmarks.
They also recently improved integration by allowing you to browse open tabs on synced computers
Firefox in also has in the last while added privacy preserving local translation support and long ago added really good local reader mode.
Also my browsing would be less nice without addons like Sideberry and Tridactyl not to mention colorful via pywal.
Then we get to adblocking an arms race that Palemoon with its several year old (2021)version of uBlock that will never be updated stands to lose.
Also the lack of a mobile version means that your options for adblock on the go are meager unless you either run Firefox Mobile or look into a more complicated option like pihole with its own tradeoffs like not being able to turn it off for a site with a click.
Firefox has been making dumb communication mistakes and been too friendly with partners but it remains in my opinion the best choice. Dumb choices like this can easily be disabled and if that becomes onerous libreWolf unlike Palemoon is just Firefox with different privacy friendly defaults.
That said it also requires more setup as far as addons and sync which is why I prefer to simply configure Firefox.
Midori is very cool but in my experience is fairly unstable. I love it and wish it the best as well. I do feel Ladybird has a better shot at being a primary browser candidate in 2 years' time, though.
Ladybird and servo are not replacements for a feature full web browser and are years away from fulfilling that role if at all.
The hype is unfounded. Yet another browser engine designed using the same tools with the same methods isn't going to yield an organization resistant to the monetary and social problems that Mozilla has faced.
It's not about the tech. It's about the org making the tech. Dev time is expensive, and there isn't a way to pay for it. Eventually people get tired of working for free and begin to treat life realistically - f#@$ you, pay me. That is the correct and expected outcome.
Ladybird as a browser has nothing special going for it other than hype. It's a walking vulnerability that has to play catch-up to be a contender as a web browser.
Chromium was/is "the" open browser, and it only happened because google and friends footed the bill.
Where ladybird and servo could shine is as an embeddable renderer that doesn't have to have all the other features of a fully kitted browser.
The hype is unfounded. Yet another browser engine designed using the same tools with the same methods isn't going to yield an organization resistant to the monetary and social problems that Mozilla has faced.
It's not about the tech. It's about the org making the tech. Dev time is expensive, and there isn't a way to pay for it. Eventually people get tired of working for free and begin to treat life realistically - f#@$ you, pay me. That is the correct and expected outcome.
Ladybird as a browser has nothing special going for it other than hype. It's a walking vulnerability that has to play catch-up to be a contender as a web browser.
Chromium was/is "the" open browser, and it only happened because google and friends footed the bill.
Where ladybird and servo could shine is as an embeddable renderer that doesn't have to have all the other features of a fully kitted browser.
> Dev time is expensive, and there isn't a way to pay for it. Eventually people get tired of working for free and begin to treat life realistically - f#@$ you, pay me. That is the correct and expected outcome.
That must be why there are no successful open source projects in the world and nobody ever works on software for long unless it's for money (https://www.gnu.org/philosophy/fs-motives.html)
That must be why there are no successful open source projects in the world and nobody ever works on software for long unless it's for money (https://www.gnu.org/philosophy/fs-motives.html)
GNU, the org where the devs make money at corps where they use that software. Open source does not mean no money.
You forgot Chromium happened because of WebKit happened. WebKit happened because of KHTML.
But realistically, KHTML is no longer steering the boat. Is Konqueror a meaningful choice these days? Hell, even Apple isn't steering the boat with WebKit anymore.
If Ladybird gets big, what stops it from being captured by a major commercial contributor?
What we need to be thinking about is how to make browser components more embeddable, and I suspect the sensible target is Gecko at this point.
This gives us the wedge into the market. You have the Vivaldis, Edges, and Operas of the world who have figured out market fit and their technical needs, and the goal is to provide them a compelling alternative to building around WebKit/Blink. The offer you can present them is "building around Gecko or Ladybird means you don't have to spend half your time unwinding every stupid and self-serving choice Google made".
At least in the short-mid term, you're not cleaving off the people who actually LIKE Chrome, or simply download it because they don't know better, but you can at least capture that other 5%.
If Ladybird gets big, what stops it from being captured by a major commercial contributor?
What we need to be thinking about is how to make browser components more embeddable, and I suspect the sensible target is Gecko at this point.
This gives us the wedge into the market. You have the Vivaldis, Edges, and Operas of the world who have figured out market fit and their technical needs, and the goal is to provide them a compelling alternative to building around WebKit/Blink. The offer you can present them is "building around Gecko or Ladybird means you don't have to spend half your time unwinding every stupid and self-serving choice Google made".
At least in the short-mid term, you're not cleaving off the people who actually LIKE Chrome, or simply download it because they don't know better, but you can at least capture that other 5%.
If you're on macOS or iOS, then Kagi's Orion Browser seems like a reasonable option too:
https://kagi.com/orion/
Note that I've only used it on iOS personally, where I'm using it for everything.
Haven't tried the macOS version, as I'm no longer a macOS user.
https://kagi.com/orion/
Note that I've only used it on iOS personally, where I'm using it for everything.
Haven't tried the macOS version, as I'm no longer a macOS user.
I too use Orion but all iOS browsers run on WebKit due to Apple lockdown, though maybe if you are in EU you can now choose an alternative. (see: https://developer.apple.com/support/alternative-browser-engi...)
Orion seems to do ad blocking though. :)
Arent they just sharing metrics like ad x was seen y times in b place? If that's the case I think that's a good compromise. Sites that don't sell anything need to make money some way, if all they want to know is if an ad in a certain place about a certain product is working or not, that's fine by me.
No, the browser tracks what ads you see/click on, then monitors what you do online for signs the ad was successful, and if it thinks it found one it sends all that data to a third party who compiles a report to deliver to the ad company.
That might be okay to you, but a browser that snoops on my browsing history and reports it to third parties who will then use it to send reports to advertisers is totally unacceptable to me.
That might be okay to you, but a browser that snoops on my browsing history and reports it to third parties who will then use it to send reports to advertisers is totally unacceptable to me.
It only does that for websites that are funded by advertising. If you avoid those (e.g. HN) you should be fine?
I mean, if there are no paid ads on the site it won't track any.
That said, I don't expect this to be the end state of their user tracking. They could expand their system to track the kinds of ads we get here on HN too. Maybe eventually start ups will be able to pay Mozilla to track how many firefox users use their web apps after seeing a "Show HN" post or even just after seeing mentions of a product in comments. Right now it's hard to track the success of astroturf campaigns, but when a web browser is working for advertisers instead of being a user agent it becomes possible.
That said, I don't expect this to be the end state of their user tracking. They could expand their system to track the kinds of ads we get here on HN too. Maybe eventually start ups will be able to pay Mozilla to track how many firefox users use their web apps after seeing a "Show HN" post or even just after seeing mentions of a product in comments. Right now it's hard to track the success of astroturf campaigns, but when a web browser is working for advertisers instead of being a user agent it becomes possible.
I don’t get what you’re complaining about, federated learning for ads is a big step forward for privacy if it gets adopted, it will allow being way more strict with third parties on websites and other storage mechanisms.
middlefing(2)
Isn’t Ladybird Hank Hill’s racist dog?
That being said, there comes a time when we must explore our options. As Firefox shifts towards an advertising and tracking model, Ladybird, the first new browser engine since the 90's with the ability to pass the Acid3 JavaScript test suite, has secured a $1 million grant from the founder of GitHub. This is exciting news to put it lightly, and may very well be a small glimmer of light at the end of this tunnel.
In my opinion, if there is to be any hope for the future of the open web, we must put our full support in backing behind the Ladybird project by any means available to us. Please, spread the word, contribute, or donate whatever you can. I truly feel the future of the open web may depend on it.
Tell your friends!