This whole project appears to be a security disaster and nobody should use it.
Beautiful response.
If you absolutely must have an XUL-based Firefox derivative: 1) you don't, 2) stop, and 3) don't use this one if you don't listen to #1 or #2.
But I reject the square-peg premise you're trying to jam into that round hole anyway, as it's not a democracy, either. Your choices impact your neighbors without their consent. It's not about fucking over power users or whatever the weird little epistemic enclosure you come from wants to insist it is, it's about addressing technical debt both in terms of performance and security--and the latter matters quite a lot in terms of not enabling people who think they're power users to 1) blow their own leg off, and 2) blow the legs off the people next to them. That's why those "leftist fascist" evil scary Firefox people decided "hey, let's patch some of these up."
Customization, in and of itself, is fine (modulo the combinatoric explosion that leads to security holes). Few enough people would disagree with that, though I understand that the aforementioned epistemic closure holds as axiomatic that everybody just hates the tweaker types. On the other hand, customization at the expense of competent security development, which is what you get with Pale Moon, is not. And seeing as how there certainly doesn't seem to be much in the way of developer competence, to the point where "don't use the stuff that upstream has working just fine because we can't figure it out" is a legitimate attempt at "discussion", it ought to be dumpstered.
Somehow, this "power user" (god, I hate that term) gets by just fine with poor, benighted Firefox--having switched to it from Chrome/Safari after Quantum because it finally felt as pleasant to use as back in The Day. Clearly, though, that just makes me a radical-left SJW hater or something. But that's fine. Modern Firefox is heckin' great.
https://github.com/privacytoolsIO/privacytools.io/issues/375...
> There also seems to be a small group of devout followers who travel from the Palemoon forums to other parts of reddit, HN and github to spruik the project and derail criticism. I've observed (without naming names) it's the same names doing it over and over again.
They always use the same phrases too "nazi" and "fake news", "false narrative" etc. They tend to refer to themselves as "power users" with a clear tone of superiority to their comments.
I guess it must be the deep state! (sarcasm).
(And nobody is falling for your "leftist Nazi" shtick. It's quite telling that you can't even come up with terms for your imaginary opponents and have to fall back on misusing "fascist", "nazi", and "dictator", isn't it?
Here, in the interest of the English language, are some actual left-wing baddies you can use: Bolsheviki, Stalinist, Stasi, Politburo, Khmer Rouge, ETA (potential for puns here), (Popular|Democratic|Worker's) (Front|Army|Committee|Union) for (Liberation|Democracy|A Better Future|Legalisation)
Web applications are fully isolated and sandboxed, have fine-grained permissions, are easy to inspect, and the runtime is built with a modern threat model.
ChromeOS is probably the most secure desktop OS for this reason.
I want my browser to expose more functionality to web apps, because it means that I have to run less random unsandboxed code on my underlying OS.
An app on my smartphone or - much worse - an Electron app "sandboxed" in a flatpak on my desktop has access to far wider range of dangerous APIs than a web application. What's wrong with a browser as a high-level OS?
I don't mind Chrome OS and love my chromebook.
Some of this is aesthetic so I don't really expect to change minds, but if we lived in the world of "Life and Death of Javascript" and booted to some kind of Web OS I'd be annoyed at the loss of low level hackibility and get over it.
Booting to Linux, then booting a browser to get to a normal app that doesn't need network connectivity "feels" wrong.
If they took a Xerox approach, ChromeOS would have a tiny mikrokernel, hypervisor type 1 style, and jump directly into Chrome.
I value discoverability and comprehensibility of the underlying platform a bit more, and have recognized that isn't likely to happen any time soon.
Until they're delivery vehicles for obfuscated wasm to canvas rendering applications. Then nothing of the "web as graph of hypertext documents" will be left.
(also, wasm changes nothing here, you could always obfuscate js just as much)
It is a significant change because it lowers the bar to create a blackbox. wasm offers the performance, canvas provides an opaque, flexible render target. Without either you're limited to obfuscating your JS (which indeed already happens) and obfuscating your DOM (also happening). But the DOM still leaves enough surface for adblockers and other extensions to intervene. Perhaps throw in a websocket/webrtc to channel all your data over a single connection and you basically have created a single intransparent blob which extensions cannot interact with on the behalf of the user.
You turned the user agent into the site's agent.
> "DRM will be used even for text!!1" (wrt. EME especially)
I am not aware of EME offering a data path to bring encrypted text to the screen. Without such a path these claims have no merit, wasm + canvas on the other hand offer a clear path.
Once it's an application instead of a document the text just isn't there.
I would actively block Pale Moon if I thought I worked with people silly enough to use a slow single-process browser in 2020. (Instead of a moderately slow multi-process browser. But I digress.)
Somebody seems to be doing something right.
Provide evidence.
Here's the output:
$ sha256sum palemoon-bin
0b7f4ad73fc671e20bfb2366aa9d9ad81e82a3c8f63acde7f37063e73fda2141 palemoon-bin
$ checksec --file=./palemoon-bin --output=json --extended | jq
{
"./palemoon-bin": {
"relro": "partial",
"canary": "no",
"nx": "yes",
"pie": "no",
"clangcfi": "no",
"safestack": "no",
"rpath": "no",
"runpath": "no",
"symbols": "no",
"fortify_source": "no",
"fortified": "0",
"fortify-able": "15"
}
}
Mitigations and sandboxing are the difference between an exploit a CTF player can write on an afternoon, and a multi-month expert-level endeavour.
Care to name one web API that doesn’t require development work?
Web standards evolve, new APIs are introduced. News at 11.
Checks written, can't cash, etcetera.
See Google's own Web Api tracking page [1] Chrome adds almost 1000 new APIs per year Only last year they added over 500 APIs that are not present in other browsers, and pretend they are standard and will not remove them even if other browsers are not going to implement them due to multiple explicitly voiced concerns.
So yeah, no. Your news at eleven is misleading at best.
So there aren’t 1000 new Web Component specs coming out each year, no. And fewer make it into W3C/WHATWG specs.
And then despite all the objections from all the other browser vendors Google releases an API in production and will not mark it as experimental. Yes, a Web Components-related API (Adopted Stylesheets).
Even Mozilla is having problems with Google WebComponents. There are 100 bugs open in Bugzilla about it.
Anyway it's nevertheless troublesome that google has so much influence that they can just push new web features without much discussion of other developers/browser vendors. Due to differences in internal design some features can be simple to implement for google but hard for everyone else (or the other way around, in which case google can just reject them by simply not implementing them).
EDIT: Also the non-JS web is basically dead. People should to come and accept that even if it's not perfect.
No. I won't accept it. The JS web sucks. It's slow, bloated, provides nothing of value to me the user, and exists only to feed the maw of advertisers and platform providers who will never be satisfied with the tech we have.
HTML pages are still faster to use and 1000x easier to deploy than all this "modern" web crap that delivers less and less for more and more. Look at the site you are on!
I've never heard about this Webcomponents thing before today. I hate it already. No I'm not willing to give it a chance. I am certain, certain that it will deliver nothing but pages with 100K of actual content which need 10MB code downloads and 20s rendering times on an i5.
Web designers, developers, and especially browser developers are destroying the world wide web and replacing it with a glorified series of custom-flash apps. It's every bit as terrible as when flash was around no matter how much spin is put on these "standards". Google is the new Adobe and your website is awful again.
This is what it all comes to. Unparsable, terrible-to-use websites that are also not compatible with text-to-speech is the future because ad companies demand it. Users are complete non-entities in this decision.
Right now Gmail's HTML version is both faster and lighter than the regular version. The only advantage being not having to reload the entire page to load mails (which is still faster on the HTML version.)
Its a giant SSR machine, from what I can tell. Also web workers are leveraged to do alot of the heavy lifting when it can't be SSR'd
[0]https://github.com/WebReflection/document-register-element [1]https://preactjs.com/
Not alone that, they are rude and shit into the face of a big part of the Linux community with threatening them in the worst way possible.
Then we had a server hack with compromised binary files....
People should be made aware of Pale Moon and their amateurish activity, so they can immediately uninstall this danger-ware from their systems!
Pale Moon is a fork of Firefox made before the removal of XUL (as I believe is their selling point). They would have to back-port Web Components (which may be impossible due to Quantum) or write it from scratch. This is all really hard for them because they likely have fewer than 10 active developers.
"Fake news" accusations aren't welcome on HN, people here prefer to disagree amicably.
Without doubts - this will be Pale Moons final run - as the makers are fully unable to implement complex features on their own, as they do not have the tiniest bit of knowledge how to implement medium or highly complex Ecmascript features.
This link explains everything with all necessary details - also shared before: https://www.reddit.com/r/palemoon/comments/fk4fnl/attention_...
It's a tricky situation with no obvious solutions. The Pale Moon dev's plea to slow down isn't going to work; devs want these new features and they're not going to stop using them just because a smaller browser developer with no significant market share can't keep up.
There is, perhaps, the beginnings of a solution with the Extensible Web Manifesto[1], which aims to shift the focus of browsers from implementation of many high-level features to instead focus on smaller, simpler low-level features which high-level features can then be built on top of. (Though ironically, web components are a part of this movement.) CSS Houdini[2] is one such feature which seems like it might be relevant in this specific situation (though whether it's helpful I have no idea; in the short term I suspect it might just translate to a lot more work).
Devs wanted Flash and real-player plugins pack in the day too. They wanted ActiveX plugins too. No-one else wanted them and it was ultimately the downfall of IE.
> Microsoft sort of gave up and killed their browser engine This will be the downfall of chrome. Google will ultimately be fined under anti-trust, chrome funding will dry up and browsers will stop supporting these absurd features. Have a nice time rewriting all your webcomponents in javascript in 5 years.
The idea that users didn’t want Flash is laughable. It was enormously popular and enabled all kinds of multimedia presentation that the web couldn’t come close to rivalling.
> Have a nice time rewriting all your webcomponents in javascript in 5 years.
Web components are JavaScript. And it’s a standard agreed upon by all the major browser manufacturers. They aren’t going away, no matter what happens to Google.
Except that they didn't asked for them, as shown there (and note that Google removed <style scoped> from Chromium):
1. https://github.com/whatwg/html/issues/552#issuecomment-17810...
2. https://groups.google.com/a/chromium.org/forum/#!searchin/bl...
Also, even Mozilla is having problems with Google WebComponents. There are 100 bugs open in Bugzilla about it.
I can run Firefox or whatever for modern websites, and Pale Moon or 10 year old sites running deprecated technology.
No one will ever build a website using WebComponents and NPAPI, so what's the problem?
The only possible explanation I see is that Pale Moon team desires and thinks that Pale Moo can become more popular than Firefox or Chrome simply by hoarding their discarded old tech. It's delusional, like selling computers with parallel ports and VGA cables and begging people not to use DislayPort monitors.
WebComponents is adopted by Chromium (and with difficulty by Firefox).
It’s weird and cult-like, but without drugs, dancing, or women. It’s sort of alt-right, hating gays and foreigners just as much as post-2008 JavaScript, but there just isn’t any reasonable model explaining how that connects.
Result - they are going to die and losing hope and faith, like the link here describes. Read especially the IRC link where they discuss things like that with their "ecmascript guy" Gaming4JC - who has the task... WITHOUT ADDITIONAL HELP" to make Pale Moon "COMPATIBLE WITH TODAYS WEB" - honestly... what a joke....
More here: https://www.reddit.com/r/palemoon/comments/fk4fnl/attention_...
Why is this the truth? They failed in the past with implementing stuff on their own, and they had to use new Firefox variants to re-base their UI towards them.
As there is not a way of going forward anymore without losing all their customization abilities, they are screwed as webcomponents is such a breaking point in time again where they can't succeed on their own because of their team missing guys who successfully would be able to implement stuff like this - uses Rust/Stylo/Servo - and that is way too complicated to them and they miss all the necessary knowledge how to convert it to their current codebase of Firefox 52!
The author basically walked into a community of Pale Moon enthusiasts and shouted: "Hey Palemoon fans! Y'know that thing you love? It's going to die! Sorry!".
The legitimately-concerned version of this post would go something like: "If Palemoon can't implement web components, does the browser have a future?"
It is better that the fans are learning WHAT COULD HAPPEN - because if they would not learn the truth, they are suddenly sitting around with a dead and even more outdated browser.
This is too important than to ignore it or not to post about it.
It's a web API. Browsers implement it. Including Safari and FF. If the argument is that it's hard to implement and makes it harder for new browser implementations, the same could be said of new CSS features, other APIs like Web Audio, etc. Trying to brand Web Components as Google-only may have worked in the v0 prototype days in like 2014, but it's factually not the case today.