News for hackers. Stuff that matters.
Re:Mozilla lays off 250 employees while it refocuses on comm... by will4274 on Tuesday August 11, 2020 @06:06PM (#24126583)
Well, it's slower for one and web features lag for two. But the one that is really the most important to me is security and privacy features. Browsers have effectively made two majors improvements recently - Safari made third party tracking impossible by gradually fully segmenting everything - HTTP caches, LocalStorage, cookies, etc. - and Chrome made JIT exploitation and then Spectre attacks in JavaScript impossible by using process boundary separations and applying sandboxes to purpose built processes. On both fronts, Firefox is behind. Chrome devs are also engaged in active anti-fingerprinting efforts from minor efforts (like reducing the fingerprint-ability in Safari's new APIs, reducing the amount of available by default information in the user agent, or defining SameSite cookies).

I also see privacy issues sit in the Firefox bugtracker. I read about fuzz tests from project zero and elsewhere and realize Firefox is under-fuzzed, both DOM and JS. I finally stopped using Firefox because, as somebody who writes native code for a living and reads about bytecode VMs for fun in my spare time, I could no longer convince myself that it was satisfactorily secure.

What awesome technical choices do you think Mozilla has made recently? I'd love to hear an example. Throwing away the plug-in model to catch up for performance was an necessary technical choice (perhaps), but it was largely solving a self-made problem and catching up with the competition rather than bona fide innovation, so it falls short of "awesome" to me.

Re:Mozilla lays off 250 employees while it refocuses on comm... by lambda on Tuesday August 11, 2020 @08:01PM (#24127327)
> Safari made third party tracking impossible by gradually fully segmenting everything - HTTP caches, LocalStorage, cookies, etc. -

I haven't been following exact features between browsers too closely recently, but Firefox's Tracking Protection has been around for a while and improving for years; and of course, Firefox is where AdBlock/uBlock originated. What does Safari provide that Firefox does not? How does it affect web compat?

> and Chrome made JIT exploitation and then Spectre attacks in JavaScript impossible by using process boundary separations and applying sandboxes to purpose built processes.

This feature has been a long time coming in Firefox, and it's still not all the way there.

But Firefox did just release an opt-in process isolation feature for Firefox, which applies stricter cross-origin controls for a variety of content, and in exchange gives web developers access to SharedArrayBuffer, the feature that needed to be disabled to mitigate Spectre attacks.

So site isolation is progressing, and the first iteration of it has been released.

> What awesome technical choices do you think Mozilla has made recently?

The development of Rust. Servo, which acted as an experimental testbed for a parallel browser engine and has led to its CSS parser, WebRender, and a number of other components being used by Firefox. Asm.js as an alternative to NaCl, which led to the joint development of WASM.

Re:Mozilla lays off 250 employees while it refocuses on comm... by will4274 on Tuesday August 11, 2020 @08:42PM (#24127545)
I appreciate that site isolation is in progress in Firefox, but it came out in Chrome two years ago (three now?). You're telling me that the soon to be released IE7 will include a pop-up blocker, so I should switch back to IE from Firefox.

> I haven't been following exact features between browsers too closely recently, but Firefox's Tracking Protection has been around for a while and improving for years; and of course, Firefox is where AdBlock/uBlock originated. What does Safari provide that Firefox does not? How does it affect web compat?

Firefox, like uBlock and AdBlock is list based - it forbids known bad actors. Safari is changing web standards to make tracking impossible, regardless of whether or not you are a known actor, and doing it gradually and carefully enough enough where breakage is minor enough that users don't complain. And Safari has less market share than Firefox. Look at e.g. https://webkit.org/tracking-prevention-policy/ for the principles and the other posts on the blog for details about the implementation. It's an industry wide change that a non-advertising funded browser company needed to push, and it just needed a real leader to push it. And that person turned out to be John Wilander (https://twitter.com/johnwilander). For whatever reason (I've given my thoughts above), I think Mozilla struggles to attract these sort of talented experienced mid-career people.

Rust is pretty cool, but Servo is pretty immature, and it seems like Mozilla just fired all those people. I dunno. I don't see a bright future there.

Re:Mozilla lays off 250 employees while it refocuses on comm... by lambda on Tuesday August 11, 2020 @11:39PM (#24128394)
> Rust is pretty cool, but Servo is pretty immature, and it seems like Mozilla just fired all those people. I dunno. I don't see a bright future there.

Well, yeah, that's the problem.

Until now, I felt like despite its issues, Mozilla was mostly on the right track. There have been a few mistakes here and there, but it was fundamentally doing good work.

However, cutting Servo, and it looks like maybe Cranelift as well (not sure about that, but Dan Gohmen aka sunfishcode, who seemed to be one of the lead contributors, has been laid off) is a huge blow.

While Servo as a whole browser is pretty immature, a number of components of it were adopted by Firefox, such as its CSS parser, Webrender, its GPU accelerated parallel rendering engine, and more.

You had asked about what Mozilla had done recently, and I listed a few things. But it looks like they are cutting a lot of that. They mentioned focusing on wasmtime and the Bytecode alliance, but I don't see how cutting one of their lead contributors helps out with that.

And they seem to be slowly cutting the head count on Rust; it's less apparent because there are enough people not at Mozilla contributing, and some of the core contributors have been moved onto other projects which use Rust at Mozilla so while they're not contributing directly they are still somewhat involved; and some folks have left of their own accord.

But now it looks like some of those other teams are being cut, like Servo and at least some of the wasmtime team, so I really hope that more companies can put some more investment directly in Rust, as well as the WASM ecosystem.

Re:Mozilla lays off 250 employees while it refocuses on comm... by tinco on Tuesday August 11, 2020 @06:28PM (#24126741)
Their choice to move over to webrender I think is their most major awesome technical choice. It's not "just" building a GPU renderer, they actually made the decision to step into a language that was still being developed, because they anticipated trouble in the long term if they opted to just tack it on to the existing C++ codebase.

I don't know about web features lagging, I feel that's also just chrome pushing web features before they're fully ratified, but maybe there's some where firefox really lags. It was a bit painful for my project that they've held back on the shared buffers thing, but I think that's going to be turned on soon again.

Besides webrender, they've been really working at performance the last couple years, there's performance improvements in nearly every release.

If they're not fuzzing their interpreters that is worrying. If they really are doing bad, surely someone's gonna come and do it for them right? Or do you think Firefox is so small right now hackers aren't even bothering?

Re:Mozilla lays off 250 employees while it refocuses on comm... by will4274 on Tuesday August 11, 2020 @06:45PM (#24126872)
I don't think anybody will bother. Firefox fighting IE was successful because it allied three groups: people who cared about open source, people who cared about modern web standards, and people who cared about user-first free software and privacy. Security research like fuzzers and people who like to customize their software are really in the first group. Firefox vs Chromium only captures the third group. If what you think is cool is privacy and free speech, you don't know how to fuzz software; if what you think is cool is fuzzing, you'll fuzz Chromium because that's what everybody uses.

I think the future is a rebase on Chromium. With so many companies (Brave, Google, Microsoft) each shipping their own integrations in Chromium, integrations will naturally become plug-in based (or at least, have a fairly stable API), allowing each vendor to opt in or out of each customization. Then, projects like Tor will move the TorBrowser to Chromium with their own implementations that are tracker free and one of them will eventually take the place of Firefox as the rallying point for the free software ideologues.

Which is a shame because I have a lot of sympathy for the free software ideologues. I'd like to win the browser fight for user-first free software ideology, not just corporate directed free software. But I no longer see Mozilla or Firefox as a banner under which that can be done. At the same time, I'm not sure how next free banner gets started.