20 ms·

What’s Next for Multi-Process Firefox

355 points by cpeterso 10y ago

pecord 10y ago
Just makes me more excited for Servo
- eugeneionesco 10y ago
  Why? Servo is just a proof of concept, it won't be the future of Firefox.
  - highwind 10y ago
    It's definitely not a proof of concept. > Our long-term plan is to: > - Incrementally replace components in Gecko with ones written in Rust and shared with Servo. > - Determine product opportunities for a standalone Servo browser or embeddable library (e.g., for Android). https://github.com/servo/servo/wiki/Roadmap https://github.com/servo/servo/wiki/Roadmap
    - sp332 10y ago
      Servo is definitely going places but it's not Firefox. It's not looking to be a Gecko replacement, and Gecko is too deeply embedded in FF to swap it out. Sharing code sounds like a good idea though.
      - mintplant 10y ago
        For example, another Mozilla intern I know is working on the project to replace Gecko's CSS style system with Servo's (Stylo). Check the "Oxidation" page on the wiki: https://wiki.mozilla.org/Oxidation https://wiki.mozilla.org/Oxidation
ianlevesque 10y ago
It's ridiculous that they still don't have sandboxing years after Chrome, Safari, and IE shipped it. It's just negligent as a browser developer to not have that basic measure of security in place.
- nickpsecurity 10y ago
  It was common for security-savvy users of Firefox to combine it with third-party solutions like SandboxIE, DefenseWall, and AppGuard. Later browser VMs. A sandbox plus NoScript, Flasblock, Adblock, etc actually made it a stronger option than competitors that were just sandboxing renderers, JS, and do on.
- bioneuralnet 10y ago
  It's certainly unfortunate, but "ridiculous" is a bit much. It's just a fact of history. FF is based on a very old codebase, before sandboxing and multi-process arch. was a thing in browsers. Chrome is much younger, and was designed with those features in mind. And while IE is also an old codebase, MS can devote far more resources to making these complex changes than can Mozilla.
  - ivoras 10y ago
    Are there any studies which show process sandboxing to improve security in practice?
    - aseipp 10y ago
      I'm not sure about any studies, only my own observations and attempts at breaking browsers. It depends on how the sandbox is actually constructed, and what information/level of control the attacker is attempting to obtain. But, if we go by "Being able to spawn calc.exe on someone's computer" -- if you simply look at the amount of effort needed to attack a program like Chrome versus Firefox and successfully break out of the sandbox - yes, when done correctly, it adds a good layer of defense in depth. Chrome for example doesn't even let render processes touch OpenGL. All the rendering and layout logic for the page is computed in a separate process, and draw commands are sent over a IPC pipe instead to a controlled renderer, which actually issues draw commands to the GPU. (If my memory is still correct, anyway). Given the complex layout and rendering engines in browsers, this is good to have - they're almost purely computational logic, so they don't need many capabilities like "Open File" or "Spawn Process". It's sort of a forced realization of real capability based security, like Eros or Capsicum. Getting outright code execution (calc.exe) is only useful once you also have a way to escape the sandbox, after you've got code execution in the process you exploited. And on (all?) OSs, this is enforced pretty much by the kernel and many other things. So you need a kernel exploit, with a viable triggering mechanism from within the sandbox, on top of the browser exploit if you actually want to break out further. In contrast, in Firefox, etc, once you've exploited the singular process rendering your page, you have full access to the whole system, at the privilege level of the application. There are no restrictions on what your payload can do, so spawning calc.exe is trivial. This is also why multi-process is a necessary, but not sufficient, part of a sandboxed design. Firefox still has a huge, huge amount of ground to cover to catch up to Chrome, even once it's gone full multi-process. That said, none of these attacks are impossible, even with Chrome. They only mitigate/ban certain exploit mechanisms as a consequence of design, making things much harder, but fundamentally you can still get by. With a few infoleaks and one or two good bugs, you can take the cake. And, purely by the fact these projects are so large, those things exist. But Chrome has a much higher barrier to full compromise, I'd say, and it had the advantage of being designed that way from the start. The next step is to do things like enforce very fine-grained control flow integrity over the whole browser, which will help stop code-reuse attacks (e.g. ROP/JOP), thus killing a whole class of exploitation mechanisms outright. grsecurity's RAP work has already been tested on the whole of the Chromium code base, and has excellent performance in general. Hopefully in time something similar can come to a wider audience.
joaomsa 10y ago
Looking at https://areweslimyet.com https://areweslimyet.com it looks like memory consumption has been on a slight upward trend. Are these tests conducted with e10s or should we expect a massive increase? As one of those pathological users that often keeps 50+ tabs open (somewhat manageable with the tabgroups addon), I'd hate to see one of the principal Firefox advantages go away.
- nprescott 10y ago
  From the Are We Slim Yet FAQ: > For each change to Mozilla's inbound repository, our build infrastructure > generates a build which we test and include in the graphs here. Sounds to me like they are testing with e10s (since it is enabled in the newest releases)
- mccr8 10y ago
  Currently e10s is only using two processes, so there should not be a massive increase in memory. Particularly, if you have many tabs open, the pages are still all just stored in a single process, so there should not be much overhead. Part of the work towards having multiple content processes will be ensuring the memory overhead is not too high.
  - semi-extrinsic 10y ago
    > Currently e10s is only using two processes There is something that I've wondered about for a while on this Electrolysis fanciness: currently Firefox is said to be single-process. So why do I see tens of "firefox" threads in htop?
    - Etzos 10y ago
      You actually said it yourself without realizing it: because it's single process but multi-threaded.
      - semi-extrinsic 10y ago
        Ah, of course. So this means any performance increase will be coming from rewriting old code in a more efficient way, which could be done independently of e10s, right? I mean, since the new multiple processes will not share address space, there will have to be explicit communication between processes with corresponding overhead and blocking? So a priori one would expect the new code to be slightly slower? And use more memory, since some data needs to be duplicated between processes? What also comes to mind is that introducing e10s is like taking an OpenMP-parallel code and turning it into an MPI+OpenMP-parallel code.
binaryanomaly 10y ago
Multi-Process or not 48 definitely feels a lot faster here! Looking forward to more...
- mhurron 10y ago
  I forced e10s on 47, and it's still enabled in 48. In both I see random beachballs (OS X) hitting refresh in one tab and moving to another, and sometimes spinning wheels trying to navigate to a new tab. I don't think there are any real performance improvements in 48 other than the improvement you'll get from restarting a long running process.
  - binaryanomaly 10y ago
    I tried it on 49 Dev. Seemed to work nice and much faster than 47 when I was quickly testing. But this was just a quick impression. Unfortunately I couldn't use my addons with it and together with the constant updates it was a no go for me.
  - bwat48 10y ago
    Have you tried with addons disabled? Your experience with E10s largely revolves around which addons you're using. Some addons use compatibility shims with multi-process and this can significantly harm performance in some cases (even potentially making it worse than e10s disabled). This site is useful regarding the addon compatibility: http://arewee10syet.com/ http://arewee10syet.com/
kodablah 10y ago
Can anyone comment on what the future is for single-process FF? Will it remain the default for a long time to come, be behind a feature flag, or will it be unsupported like `--single-process` is in Chrome? As a personal preference, I like my browser (and most of my applications) to be a single process.
- RussianCow 10y ago
  > As a personal preference, I like my browser (and most of my applications) to be a single process. Honest question: Why is this your preference? What difference does it make whether an app is using 1 process or 10 behind the scenes?
  - kansface 10y ago
    I use tab tree and typically have a couple of hundred open tabs...
    - RussianCow 10y ago
      But that doesn't really answer my question: Why does it matter if each one uses its own process?
      - Sylos 10y ago
        A separate process has an overhead over just using a separate thread. If you put each individual tab into an individual process, you will have this overhead for each individual tab, meaning that you're much more limited in the total number of tabs that you can have, no matter what those tabs have loaded.
        RussianCow 10y ago
        Is that overhead inherently high, or does it just happen to be high given browsers' current implementations? My understanding is that the inherent overhead of an OS process is fairly low, and that it would be possible to implement process-per-tab in an efficient way, but I don't know enough about the low-level details of how that works.
dagaci 10y ago
Its quite shocking to think how we used to get by with such little amounts ram and Cpu power. Firefox is currently consuming 518.4 MB of ram (7 tabs) and using 0.6% of a 12 core 3.4 Ghz CPU. But i guess this is progress...
- dblohm7 10y ago
  We also didn't used to have nice things like JITs and hardware accelerated graphics.
  - azinman2 10y ago
    That and much of it is cache that is aware of total RAM.
  - MichaelGG 10y ago
    We didn't need them, since websites rendered just fine without all the shit they have today. I used a site that rendered a grid of images. Literally, that was the only user-visible function. It took 5s to render when throttled to 1GHz i5. Unthrottled i5 required 2.5s. It is lunacy. It is an artifact of having a terrible language (JS) and a terrible layout system (HTML) mixed up into a modern "standard". Plus naive developers abstracting so far away they have no idea what's going on, and partially don't care. Wasn't too long ago someone asked (I think unironically) why HN was so "fast". As if such a page shouldn't load basically instantly. Can you honestly say info browsing (not apps like GDocs) overall is better than it was 10-20 years ago? Ignore the increase in content. Images load faster, sure, but that's offset by all the other junk. Twitter, for instance - it's actually sluggish on a nice ThinkPad! WTF.
    - pixl97 10y ago
      >Can you honestly say info browsing overall is better than it was 10-20 years ago? Yes, just block ads.
      - MichaelGG 10y ago
thesimp 10y ago
Whoa! Firefox 48 opens the Windows proxy settings now! That is not good. I especially use Firefox so that in a corporate environment I can use different proxy settings than IE.
- nine_k 10y ago
  Does it still heed HTTP_PROXY env variable under Windows? The proxy dialog is (was?) convenient to swritch between proxies quickly; the env var, of course, cannot offer that.
- joaomsa 10y ago
  Was in the same corporate boat as you a while back. The FoxyProxy addon [1] is much more flexible, I recommend you switch to that since it enables quick toggling between the IE proxy and your configured ones. [1] https://addons.mozilla.org/en-US/firefox/addon/foxyproxy-standard/ https://addons.mozilla.org/en-US/firefox/addon/foxyproxy-sta...
  - semi-extrinsic 10y ago
    FoxyProxy also lets you set different proxies for different pages. So you can run one proxy to be able to access the corporate intranet from outside, and another to access a non-public testing webpage, etc.
- idsout 10y ago
  It does? I just upgraded to Firefox 48 and it's still the Firefox proxy settings dialog. Windows 10 here.
  - thesimp 10y ago
    Just did a quick test with a clean profile and then I get the normal proxy window. I previously had several add-on installed to do some more advanced proxy settings, that probably bit me with the upgrade to Firefox 48.
- drzaiusapelord 10y ago
gosukiwi 10y ago
I wonder where Rust and servo fit here. Will they be able to "swap" some parts of Firefox with others written in Rust?
- notanote 10y ago
  They have done so recently, mp4parse-rust is a replacement for the old mp4 metadata parser. https://github.com/mozilla/mp4parse-rust https://github.com/mozilla/mp4parse-rust
- mastax 10y ago
  There are already bits of Rust code in newer builds of firefox, I think they'll ship first in 47 or 48. https://wiki.mozilla.org/Oxidation https://wiki.mozilla.org/Oxidation Servo is a fantastic research project but it will be a while before it is "production ready".
  - steveklabnik 10y ago
    Ships on all platforms today. https://www.mozilla.org/en-US/firefox/48.0/releasenotes/ https://www.mozilla.org/en-US/firefox/48.0/releasenotes/
peterwwillis 10y ago
I'm waiting for someone to fork Firefox and strip out anything not totally necessary to strictly browse 99% of the web, to make it light, fast, simple and memory-efficient. They could even rename it something familiar... something that envisions lightness and speed... like "Fire Bird".... Or better yet, "Phoenix"!
- anthk 10y ago
  That's SeaMonkey, and paradoxically, it's the old full Mozilla suite pre Phoenix but with current features, and is much faster than Firefox.
  - yoasif_ 10y ago
    I love Seamonkey (I have to reinstall it on this machine as I haven't used it in a while), but it's also behind the Firefox dev cycle and doesn't offer the same level of extension coverage that Firefox does. It'd certainly be very interesting if the could maintain the latest browser fixes (even with less extension compatibility), but I doubt the team has the bandwidth to keep that up. Just installed it. It doesn't support High DPI displays on Mac OS X. Unfortunately, that's a bit of a blocker for modern Mac laptops (everything looks fuzzy).
    - anthk 10y ago
      Report a bug, or look at about:config settings. https://fedoramagazine.org/how-to-get-firefox-looking-right-on-a-high-dpi-display-and-fedora/ https://fedoramagazine.org/how-to-get-firefox-looking-right-... apply those to seamonkey.
- MichaelGG 10y ago
  What stuff can they remove to make Twitter.com fast and light? I'm guessing a lot of code is there to mitigate the insane shit modern "web developers" come up with.
- pcwalton 10y ago
  > I'm waiting for someone to fork Firefox and strip out anything not totally necessary to strictly browse 99% of the web, to make it light, fast, simple and memory-efficient. A version of Gecko that contains only the things necessary to browse 99% of the Web exists. It's called Gecko. Sites use the Web features.
ryuuchin 10y ago
Moving to a multi-process architechture has a number of benefits but security is certainly one of them. While currently it doesn't really add anything from a security perspective the ability to run rendering in a separate process will allow it to very naturally support a number of operating system mitigations that it otherwise would not have in addition to adding restrictions on the process itself (sandboxing). I believe this will allow Firefox to start to adapt to a more defense in depth philosophy although I admit it's probably still a long way to actually getting there. There's no getting around the fact that security in Firefox has been rather stale but e10s gives something to look forward too since the multi-process architecture allows you to do so much more for defense in depth.
- revelation 10y ago
  Honestly, I can't really come up with one reason that would make a multi-process Firefox more secure than a single-process one. The multi-process trend is sold as "crash-proof" which reads like "can't fix exception handling".
  - muizelaar 10y ago
    Did you not think of sandboxing?
  - duaneb 10y ago
    Multi-process is not crash proof, it contains any code execution vulnerabilities to the process that hit the edge case in question.
  - gcp 10y ago
    With multiple processes you can apply more strict OS controls to one of the processes. That doesn't work with threads.
    - revelation 10y ago
      Which are ...? See the problem is always local code execution. Once you have that, it's over. There are real mitigations (W^X, ASLR, stack cookies) and then there seems to be lore ("multi-process", "sandboxing").
suprgeek 10y ago
The annoying problem of being unable to select via Enter key the first item in the address bar that is shown while typing any text is back. Using OldBar on FF48 on a MAC type text into address bar - Key down to select first entry Hit enter - nothing happens
forgotpwtomain 10y ago
This probably isn't a direct response - but I've been thinking about it for a while. In my mind there are a few major reasons that Firefox is loosing market share to Google Chrome. 1) Performance These might be select regressions (Google Maps, Slack - so I'll skip the bugzilla references), but every-time a user has to open Slack or Google Maps or Google Docs in Chrome, they are that much more likely to switch from Firefox (ultimately due to Sync issues: bookmarks, history) it just makes so much sense to use a single browser. 2) Developer Tools I don't know how it is now, but half a year ago when I tried to switch to Firefox Developer tools (again for the Nth time) it would take 2-4 seconds for the console to open. Comparatively Chrome Dev tools opened < .5. As a result even trying to use Firefox for everything else, I still end up in Chromium almost daily. 3) Sync/Mobile Using Google Chrome has distinct advantages when syncing with an Android device and other Google services (performance issues aside) - most of the things that I considered to be an advantage in Firefox mobile (the top button with <number-of-tabs> for tab switching) Chrome has actually copied. Minor point - I'm almost sure there is some somewhat underhanded user-memory choice (it's just too smart and annoying to be a bug) - because as someone that is often in foreign countries my Firefox (where I am signed into Gmail btw) always tends to give search results in the native language search, while Chromium (where I'm not signed into anything displays English ones). Over all I really think Mozilla should focus on getting an advantage on 3) -- I don't think Google and definitely not pocket (which I wish they would unbundle from Firefox) provide a good service for syncing information / personal links / knowledge. There was a browser concept that floated by HN some-time ago allowing users to organize their tabs into sessions / subjects - that could be great! (e.g. check a button to sync only my places/people/events window to my phone and leave my work stuff out).
- superswordfish 10y ago
  Regarding language, I'm going to guess that you downloaded a localized build that set that locale as the preferred language, or that it is coming from your OS: https://support.mozilla.org/en-US/questions/949545 https://support.mozilla.org/en-US/questions/949545 Chrome has this also: https://support.google.com/chrome/answer/173424?hl=en https://support.google.com/chrome/answer/173424?hl=en Suggesting an "underhanded user-memory choice" is a serious claim. It might be worth comparing your browsers' language settings.
eagsalazar2 10y ago
Firefox is always fighting an uphill battle against IE and Chrome who have major advantages in both resources and integration with their respective platforms. Firefox thrived and grew in an environment where competitors where terrible. They lost the lead to Chrome and unless google really drops the ball I don't see how they can get it back by just being better. They'd have to dramatically leapfrog the competition in a very compelling way and since both MS and Google are investing heavily in their browsers, it isn't clear to me how they could ever do that.
- kilroy123 10y ago
  Sadly I agree. Which is a shame, because in my opinion they _do_ actually leapfrog them both in privacy.
  - HelloImDumb 10y ago
    I see your point, but they don't leapfrog Chrome in privacy when the browser is pwned and leaks its entire process state to an attacker. Any browser is a massive, rich attack surface with bugs, but Chrome has been cutting edge in its sandboxing, privilege separation, and overall security. True, Chrome is and has always been a Google marketing vehicle, where the user is the product. But has Mozilla always been at the forefront of privacy, even? Something as basic as private browsing, let's see: April 29, 2005 Safari 2.0 Private Browsing December 11, 2008 Google Chrome 1.0 Incognito March 19, 2009 Internet Explorer 8 InPrivate Browsing June 30, 2009 Mozilla Firefox 3.5 Private Browsing Apple, Google, and Microsoft all beat Mozilla to the punch.
    - smt88 10y ago
      Firefox had plugins for private browsing since 2008. Only Apple beat them. One of Chrome's many small victories was including sensible plugins by default, whereas Firefox's best functionality had to be downloaded separately.
      - HelloImDumb 10y ago
0xffff2 10y ago
I get how a multi-process architecture is good for stability, but why is multi-process necessary for UI responsiveness? Surely the UI is already rendered on its own thread; why would moving that thread to a separate process help anything?
- fl0wenol 10y ago
  Firefox has a UI that is rendered in web components and javascript just like the displayed pages in the tabs. This technology is called XUL. The Gecko layout engine renders both XUL and HTML styled with CSS. Traditionally this was all handled in one process. The tabs themselves are like fancier iframes. If javascript in a window did not yield, stuck in a tight loop, it could make the interactive elements of the UI non-responsive (menus, modal dialogs, right-click menu, etc.) To combat this, Firefox has a global timer in the whole-browser javascript that fires and interrupts long-running javascript to display that dialog box that says: "A script on this page may be busy, or it may have stopped responding. You can stop the script now, or you can continue to see if the script will complete." You might have even run into it. This lets you kill it which gives you the UI back, but may break the offending webpage. By making firefox multi-process, this hack is no longer needed. Also you can imagine that for a very javascript heavy web application like Google Docs, Slack, or Gmail, it fires so many JS events and runs so much code that when the tab is active on slower systems you find Firefox's own UI is lagging. This is because the web application is always doing something or doing it too frequently and Firefox is having a hard time getting a word in edgewise. Such heavy interactive pages will no longer negatively impact the browser, especially on multi-core systems.
- bzbarsky 10y ago
  Without e10s, the UI is in fact not rendered on its own thread. There was a lot of discussion about whether to try to move the UI to a separate thread or separate process, and the decision was that separate process has a _much_ lower risk of bugs due to racing memory accesses and whatnot. Basically, it removes a bunch of ways that you could accidentally shoot yourself in the foot while trying to retrofit threading onto a large existing C++ codebase....
sharmi 10y ago
I feel like my case is an anomaly compared to others on this thread, but this has been a consistent experience for me. I hoard tabs and easily reach 40 tabs in a single session. It is typical to have 60-100 tabs open at any point in time. I find that firefox handles this much better than chrome does. Any time the tab count exceeds 15 or so in Chrome, my whole system slows down and freezes. I am forced to close some tabs and restart chrome to get some sanity. Often system reboot is the only option. In firefox the same system slowdown happens, but rarer than chrome, usually I have nearly 200 tabs open and running for a long time. In such cases, I just have to restart firefox. Firefox presents me with the restore window which is a much saner way to select only the tabs I want. Even in that case, when I restore, it does not load all the tabs, only the active ones, so it does not impact system performance. The only time firefox becomes slow even on startup is when I have restore windows several levels deep (yes, there is such a thing :) ) and I believe I am wholly responsible for that and not firefox. So it really surprises me when people say Chrome is more performant. Also, maybe because of familiarity, I find firefox Developer Tools more usable than Chrome's. But what do I know? I am a server side person dabbling in UI for my personal projects, not a web designer :) I dread Firefox following the footsteps of Chrome! Oh, and not to mention the scores of chrome processes that pollute the process list! when I run the `ps` command or the `top` command, it is difficult to locate the process that I am actually looking for. Also, it is much, much harder to estimate how much memory and processor time Chrome is really consuming when there are so many processes of Chrome running. May be I am doing it wrong. Some one please enlighten me.
- cpeterso 10y ago
  I know many Mozilla developers are "tab hoarders" with hundreds of tabs, so I am confident that your use case will get plenty of attention. :)
  - Grue3 10y ago
    How do they manage all these tabs without Tab Groups then (which they removed)?
    - 10y ago
Jaruzel 10y ago
Default Firefox user here, although I do have Chrome installed on many of my machines. All around me people are now (or have been for some time) Chrome users. I just cannot make the switch. I don't know why - maybe it's the sharp angled tab UI, maybe it's the slightly 'off' font rendering. Maybe I don't trust google. Whatever it is, I keep using Firefox as my main Browser, and mostly I'm happy. A few things would make my Firefox life much easier though: - The ability to launch multiple Firefoxs with the same profile, but completely separate processes. So when one Firefox crashes, the others are left alone. At the moment, no matter how many Firefox windows you have open, they are all children of the first Firefox you started. - an equivalent of Chromes --APP=[URL] start up parameter (and the accompanying no-url-bar, custom icon, and unique window location/size settings) - this is a wonderful feature for web apps, and effectively transforms them into (almost) desktop apps in appearance. If firefox had that, I'd be over the moon. - A way of allocating a session when you start it for 'X project' and then be able to save off all those tabs in one action to a folder or tab 'startup list'. I'd like this to be native, and not an add-on I'd have to keep track of or suffer incompatibilities when the maintainer has lost interest in it. Finally, now that Windows and Linux roll with good default Browsers, and that Firefox (in the main) is a manual install, I can't see it recouping its percentage share. It feels like the slow death of the original Opera, all over again.
- bzbarsky 10y ago
  > - A way of allocating a session when you start it for 'X project' and then be able to save off all those tabs in one action to a folder or tab 'startup list'. The existing "Bookmark all tabs" option that creates a bookmark folder from all the tabs in a window and the existing option to open all the tabs in a bookmark folder sort of address this use case, unless 'X project' needs multiple windows...

355 points by cpeterso 10y ago

pecord 10y ago

Just makes me more excited for Servo

eugeneionesco 10y ago
Why? Servo is just a proof of concept, it won't be the future of Firefox.
- highwind 10y ago
  It's definitely not a proof of concept. > Our long-term plan is to: > - Incrementally replace components in Gecko with ones written in Rust and shared with Servo. > - Determine product opportunities for a standalone Servo browser or embeddable library (e.g., for Android). https://github.com/servo/servo/wiki/Roadmap https://github.com/servo/servo/wiki/Roadmap
  - sp332 10y ago
    Servo is definitely going places but it's not Firefox. It's not looking to be a Gecko replacement, and Gecko is too deeply embedded in FF to swap it out. Sharing code sounds like a good idea though.
    - mintplant 10y ago
      For example, another Mozilla intern I know is working on the project to replace Gecko's CSS style system with Servo's (Stylo). Check the "Oxidation" page on the wiki: https://wiki.mozilla.org/Oxidation https://wiki.mozilla.org/Oxidation

ianlevesque 10y ago

It's ridiculous that they still don't have sandboxing years after Chrome, Safari, and IE shipped it. It's just negligent as a browser developer to not have that basic measure of security in place.

nickpsecurity 10y ago
It was common for security-savvy users of Firefox to combine it with third-party solutions like SandboxIE, DefenseWall, and AppGuard. Later browser VMs. A sandbox plus NoScript, Flasblock, Adblock, etc actually made it a stronger option than competitors that were just sandboxing renderers, JS, and do on.
bioneuralnet 10y ago
It's certainly unfortunate, but "ridiculous" is a bit much. It's just a fact of history. FF is based on a very old codebase, before sandboxing and multi-process arch. was a thing in browsers. Chrome is much younger, and was designed with those features in mind. And while IE is also an old codebase, MS can devote far more resources to making these complex changes than can Mozilla.
- ivoras 10y ago
  Are there any studies which show process sandboxing to improve security in practice?
  - aseipp 10y ago
    I'm not sure about any studies, only my own observations and attempts at breaking browsers. It depends on how the sandbox is actually constructed, and what information/level of control the attacker is attempting to obtain. But, if we go by "Being able to spawn calc.exe on someone's computer" -- if you simply look at the amount of effort needed to attack a program like Chrome versus Firefox and successfully break out of the sandbox - yes, when done correctly, it adds a good layer of defense in depth. Chrome for example doesn't even let render processes touch OpenGL. All the rendering and layout logic for the page is computed in a separate process, and draw commands are sent over a IPC pipe instead to a controlled renderer, which actually issues draw commands to the GPU. (If my memory is still correct, anyway). Given the complex layout and rendering engines in browsers, this is good to have - they're almost purely computational logic, so they don't need many capabilities like "Open File" or "Spawn Process". It's sort of a forced realization of real capability based security, like Eros or Capsicum. Getting outright code execution (calc.exe) is only useful once you also have a way to escape the sandbox, after you've got code execution in the process you exploited. And on (all?) OSs, this is enforced pretty much by the kernel and many other things. So you need a kernel exploit, with a viable triggering mechanism from within the sandbox, on top of the browser exploit if you actually want to break out further. In contrast, in Firefox, etc, once you've exploited the singular process rendering your page, you have full access to the whole system, at the privilege level of the application. There are no restrictions on what your payload can do, so spawning calc.exe is trivial. This is also why multi-process is a necessary, but not sufficient, part of a sandboxed design. Firefox still has a huge, huge amount of ground to cover to catch up to Chrome, even once it's gone full multi-process. That said, none of these attacks are impossible, even with Chrome. They only mitigate/ban certain exploit mechanisms as a consequence of design, making things much harder, but fundamentally you can still get by. With a few infoleaks and one or two good bugs, you can take the cake. And, purely by the fact these projects are so large, those things exist. But Chrome has a much higher barrier to full compromise, I'd say, and it had the advantage of being designed that way from the start. The next step is to do things like enforce very fine-grained control flow integrity over the whole browser, which will help stop code-reuse attacks (e.g. ROP/JOP), thus killing a whole class of exploitation mechanisms outright. grsecurity's RAP work has already been tested on the whole of the Chromium code base, and has excellent performance in general. Hopefully in time something similar can come to a wider audience.

joaomsa 10y ago

Looking at https://areweslimyet.com https://areweslimyet.com it looks like memory consumption has been on a slight upward trend. Are these tests conducted with e10s or should we expect a massive increase? As one of those pathological users that often keeps 50+ tabs open (somewhat manageable with the tabgroups addon), I'd hate to see one of the principal Firefox advantages go away.

nprescott 10y ago
From the Are We Slim Yet FAQ: > For each change to Mozilla's inbound repository, our build infrastructure > generates a build which we test and include in the graphs here. Sounds to me like they are testing with e10s (since it is enabled in the newest releases)
mccr8 10y ago
Currently e10s is only using two processes, so there should not be a massive increase in memory. Particularly, if you have many tabs open, the pages are still all just stored in a single process, so there should not be much overhead. Part of the work towards having multiple content processes will be ensuring the memory overhead is not too high.
- semi-extrinsic 10y ago
  > Currently e10s is only using two processes There is something that I've wondered about for a while on this Electrolysis fanciness: currently Firefox is said to be single-process. So why do I see tens of "firefox" threads in htop?
  - Etzos 10y ago
    You actually said it yourself without realizing it: because it's single process but multi-threaded.
    - semi-extrinsic 10y ago
      Ah, of course. So this means any performance increase will be coming from rewriting old code in a more efficient way, which could be done independently of e10s, right? I mean, since the new multiple processes will not share address space, there will have to be explicit communication between processes with corresponding overhead and blocking? So a priori one would expect the new code to be slightly slower? And use more memory, since some data needs to be duplicated between processes? What also comes to mind is that introducing e10s is like taking an OpenMP-parallel code and turning it into an MPI+OpenMP-parallel code.

binaryanomaly 10y ago

Multi-Process or not 48 definitely feels a lot faster here! Looking forward to more...

mhurron 10y ago
I forced e10s on 47, and it's still enabled in 48. In both I see random beachballs (OS X) hitting refresh in one tab and moving to another, and sometimes spinning wheels trying to navigate to a new tab. I don't think there are any real performance improvements in 48 other than the improvement you'll get from restarting a long running process.
- binaryanomaly 10y ago
  I tried it on 49 Dev. Seemed to work nice and much faster than 47 when I was quickly testing. But this was just a quick impression. Unfortunately I couldn't use my addons with it and together with the constant updates it was a no go for me.
- bwat48 10y ago
  Have you tried with addons disabled? Your experience with E10s largely revolves around which addons you're using. Some addons use compatibility shims with multi-process and this can significantly harm performance in some cases (even potentially making it worse than e10s disabled). This site is useful regarding the addon compatibility: http://arewee10syet.com/ http://arewee10syet.com/

kodablah 10y ago

Can anyone comment on what the future is for single-process FF? Will it remain the default for a long time to come, be behind a feature flag, or will it be unsupported like `--single-process` is in Chrome? As a personal preference, I like my browser (and most of my applications) to be a single process.

RussianCow 10y ago
> As a personal preference, I like my browser (and most of my applications) to be a single process. Honest question: Why is this your preference? What difference does it make whether an app is using 1 process or 10 behind the scenes?
- kansface 10y ago
  I use tab tree and typically have a couple of hundred open tabs...
  - RussianCow 10y ago
    But that doesn't really answer my question: Why does it matter if each one uses its own process?
    - Sylos 10y ago
      A separate process has an overhead over just using a separate thread. If you put each individual tab into an individual process, you will have this overhead for each individual tab, meaning that you're much more limited in the total number of tabs that you can have, no matter what those tabs have loaded.
      - RussianCow 10y ago
        Is that overhead inherently high, or does it just happen to be high given browsers' current implementations? My understanding is that the inherent overhead of an OS process is fairly low, and that it would be possible to implement process-per-tab in an efficient way, but I don't know enough about the low-level details of how that works.

dagaci 10y ago

Its quite shocking to think how we used to get by with such little amounts ram and Cpu power. Firefox is currently consuming 518.4 MB of ram (7 tabs) and using 0.6% of a 12 core 3.4 Ghz CPU. But i guess this is progress...

dblohm7 10y ago
We also didn't used to have nice things like JITs and hardware accelerated graphics.
- azinman2 10y ago
  That and much of it is cache that is aware of total RAM.
- MichaelGG 10y ago
  We didn't need them, since websites rendered just fine without all the shit they have today. I used a site that rendered a grid of images. Literally, that was the only user-visible function. It took 5s to render when throttled to 1GHz i5. Unthrottled i5 required 2.5s. It is lunacy. It is an artifact of having a terrible language (JS) and a terrible layout system (HTML) mixed up into a modern "standard". Plus naive developers abstracting so far away they have no idea what's going on, and partially don't care. Wasn't too long ago someone asked (I think unironically) why HN was so "fast". As if such a page shouldn't load basically instantly. Can you honestly say info browsing (not apps like GDocs) overall is better than it was 10-20 years ago? Ignore the increase in content. Images load faster, sure, but that's offset by all the other junk. Twitter, for instance - it's actually sluggish on a nice ThinkPad! WTF.
  - pixl97 10y ago
    >Can you honestly say info browsing overall is better than it was 10-20 years ago? Yes, just block ads.
    - MichaelGG 10y ago

thesimp 10y ago

Whoa! Firefox 48 opens the Windows proxy settings now! That is not good. I especially use Firefox so that in a corporate environment I can use different proxy settings than IE.

nine_k 10y ago
Does it still heed HTTP_PROXY env variable under Windows? The proxy dialog is (was?) convenient to swritch between proxies quickly; the env var, of course, cannot offer that.
joaomsa 10y ago
Was in the same corporate boat as you a while back. The FoxyProxy addon [1] is much more flexible, I recommend you switch to that since it enables quick toggling between the IE proxy and your configured ones. [1] https://addons.mozilla.org/en-US/firefox/addon/foxyproxy-standard/ https://addons.mozilla.org/en-US/firefox/addon/foxyproxy-sta...
- semi-extrinsic 10y ago
  FoxyProxy also lets you set different proxies for different pages. So you can run one proxy to be able to access the corporate intranet from outside, and another to access a non-public testing webpage, etc.
idsout 10y ago
It does? I just upgraded to Firefox 48 and it's still the Firefox proxy settings dialog. Windows 10 here.
- thesimp 10y ago
  Just did a quick test with a clean profile and then I get the normal proxy window. I previously had several add-on installed to do some more advanced proxy settings, that probably bit me with the upgrade to Firefox 48.
drzaiusapelord 10y ago

gosukiwi 10y ago

I wonder where Rust and servo fit here. Will they be able to "swap" some parts of Firefox with others written in Rust?

notanote 10y ago
They have done so recently, mp4parse-rust is a replacement for the old mp4 metadata parser. https://github.com/mozilla/mp4parse-rust https://github.com/mozilla/mp4parse-rust
mastax 10y ago
There are already bits of Rust code in newer builds of firefox, I think they'll ship first in 47 or 48. https://wiki.mozilla.org/Oxidation https://wiki.mozilla.org/Oxidation Servo is a fantastic research project but it will be a while before it is "production ready".
- steveklabnik 10y ago
  Ships on all platforms today. https://www.mozilla.org/en-US/firefox/48.0/releasenotes/ https://www.mozilla.org/en-US/firefox/48.0/releasenotes/

peterwwillis 10y ago

I'm waiting for someone to fork Firefox and strip out anything not totally necessary to strictly browse 99% of the web, to make it light, fast, simple and memory-efficient. They could even rename it something familiar... something that envisions lightness and speed... like "Fire Bird".... Or better yet, "Phoenix"!

anthk 10y ago
That's SeaMonkey, and paradoxically, it's the old full Mozilla suite pre Phoenix but with current features, and is much faster than Firefox.
- yoasif_ 10y ago
  I love Seamonkey (I have to reinstall it on this machine as I haven't used it in a while), but it's also behind the Firefox dev cycle and doesn't offer the same level of extension coverage that Firefox does. It'd certainly be very interesting if the could maintain the latest browser fixes (even with less extension compatibility), but I doubt the team has the bandwidth to keep that up. Just installed it. It doesn't support High DPI displays on Mac OS X. Unfortunately, that's a bit of a blocker for modern Mac laptops (everything looks fuzzy).
  - anthk 10y ago
    Report a bug, or look at about:config settings. https://fedoramagazine.org/how-to-get-firefox-looking-right-on-a-high-dpi-display-and-fedora/ https://fedoramagazine.org/how-to-get-firefox-looking-right-... apply those to seamonkey.
MichaelGG 10y ago
What stuff can they remove to make Twitter.com fast and light? I'm guessing a lot of code is there to mitigate the insane shit modern "web developers" come up with.
pcwalton 10y ago
> I'm waiting for someone to fork Firefox and strip out anything not totally necessary to strictly browse 99% of the web, to make it light, fast, simple and memory-efficient. A version of Gecko that contains only the things necessary to browse 99% of the Web exists. It's called Gecko. Sites use the Web features.

ryuuchin 10y ago

Moving to a multi-process architechture has a number of benefits but security is certainly one of them. While currently it doesn't really add anything from a security perspective the ability to run rendering in a separate process will allow it to very naturally support a number of operating system mitigations that it otherwise would not have in addition to adding restrictions on the process itself (sandboxing). I believe this will allow Firefox to start to adapt to a more defense in depth philosophy although I admit it's probably still a long way to actually getting there. There's no getting around the fact that security in Firefox has been rather stale but e10s gives something to look forward too since the multi-process architecture allows you to do so much more for defense in depth.

revelation 10y ago
Honestly, I can't really come up with one reason that would make a multi-process Firefox more secure than a single-process one. The multi-process trend is sold as "crash-proof" which reads like "can't fix exception handling".
- muizelaar 10y ago
  Did you not think of sandboxing?
- duaneb 10y ago
  Multi-process is not crash proof, it contains any code execution vulnerabilities to the process that hit the edge case in question.
- gcp 10y ago
  With multiple processes you can apply more strict OS controls to one of the processes. That doesn't work with threads.
  - revelation 10y ago
    Which are ...? See the problem is always local code execution. Once you have that, it's over. There are real mitigations (W^X, ASLR, stack cookies) and then there seems to be lore ("multi-process", "sandboxing").

suprgeek 10y ago

The annoying problem of being unable to select via Enter key the first item in the address bar that is shown while typing any text is back. Using OldBar on FF48 on a MAC type text into address bar - Key down to select first entry Hit enter - nothing happens

forgotpwtomain 10y ago

This probably isn't a direct response - but I've been thinking about it for a while. In my mind there are a few major reasons that Firefox is loosing market share to Google Chrome. 1) Performance These might be select regressions (Google Maps, Slack - so I'll skip the bugzilla references), but every-time a user has to open Slack or Google Maps or Google Docs in Chrome, they are that much more likely to switch from Firefox (ultimately due to Sync issues: bookmarks, history) it just makes so much sense to use a single browser. 2) Developer Tools I don't know how it is now, but half a year ago when I tried to switch to Firefox Developer tools (again for the Nth time) it would take 2-4 seconds for the console to open. Comparatively Chrome Dev tools opened < .5. As a result even trying to use Firefox for everything else, I still end up in Chromium almost daily. 3) Sync/Mobile Using Google Chrome has distinct advantages when syncing with an Android device and other Google services (performance issues aside) - most of the things that I considered to be an advantage in Firefox mobile (the top button with <number-of-tabs> for tab switching) Chrome has actually copied. Minor point - I'm almost sure there is some somewhat underhanded user-memory choice (it's just too smart and annoying to be a bug) - because as someone that is often in foreign countries my Firefox (where I am signed into Gmail btw) always tends to give search results in the native language search, while Chromium (where I'm not signed into anything displays English ones). Over all I really think Mozilla should focus on getting an advantage on 3) -- I don't think Google and definitely not pocket (which I wish they would unbundle from Firefox) provide a good service for syncing information / personal links / knowledge. There was a browser concept that floated by HN some-time ago allowing users to organize their tabs into sessions / subjects - that could be great! (e.g. check a button to sync only my places/people/events window to my phone and leave my work stuff out).

superswordfish 10y ago
Regarding language, I'm going to guess that you downloaded a localized build that set that locale as the preferred language, or that it is coming from your OS: https://support.mozilla.org/en-US/questions/949545 https://support.mozilla.org/en-US/questions/949545 Chrome has this also: https://support.google.com/chrome/answer/173424?hl=en https://support.google.com/chrome/answer/173424?hl=en Suggesting an "underhanded user-memory choice" is a serious claim. It might be worth comparing your browsers' language settings.

eagsalazar2 10y ago

Firefox is always fighting an uphill battle against IE and Chrome who have major advantages in both resources and integration with their respective platforms. Firefox thrived and grew in an environment where competitors where terrible. They lost the lead to Chrome and unless google really drops the ball I don't see how they can get it back by just being better. They'd have to dramatically leapfrog the competition in a very compelling way and since both MS and Google are investing heavily in their browsers, it isn't clear to me how they could ever do that.

kilroy123 10y ago
Sadly I agree. Which is a shame, because in my opinion they _do_ actually leapfrog them both in privacy.
- HelloImDumb 10y ago
  I see your point, but they don't leapfrog Chrome in privacy when the browser is pwned and leaks its entire process state to an attacker. Any browser is a massive, rich attack surface with bugs, but Chrome has been cutting edge in its sandboxing, privilege separation, and overall security. True, Chrome is and has always been a Google marketing vehicle, where the user is the product. But has Mozilla always been at the forefront of privacy, even? Something as basic as private browsing, let's see: April 29, 2005 Safari 2.0 Private Browsing December 11, 2008 Google Chrome 1.0 Incognito March 19, 2009 Internet Explorer 8 InPrivate Browsing June 30, 2009 Mozilla Firefox 3.5 Private Browsing Apple, Google, and Microsoft all beat Mozilla to the punch.
  - smt88 10y ago
    Firefox had plugins for private browsing since 2008. Only Apple beat them. One of Chrome's many small victories was including sensible plugins by default, whereas Firefox's best functionality had to be downloaded separately.
    - HelloImDumb 10y ago

0xffff2 10y ago

I get how a multi-process architecture is good for stability, but why is multi-process necessary for UI responsiveness? Surely the UI is already rendered on its own thread; why would moving that thread to a separate process help anything?

fl0wenol 10y ago
Firefox has a UI that is rendered in web components and javascript just like the displayed pages in the tabs. This technology is called XUL. The Gecko layout engine renders both XUL and HTML styled with CSS. Traditionally this was all handled in one process. The tabs themselves are like fancier iframes. If javascript in a window did not yield, stuck in a tight loop, it could make the interactive elements of the UI non-responsive (menus, modal dialogs, right-click menu, etc.) To combat this, Firefox has a global timer in the whole-browser javascript that fires and interrupts long-running javascript to display that dialog box that says: "A script on this page may be busy, or it may have stopped responding. You can stop the script now, or you can continue to see if the script will complete." You might have even run into it. This lets you kill it which gives you the UI back, but may break the offending webpage. By making firefox multi-process, this hack is no longer needed. Also you can imagine that for a very javascript heavy web application like Google Docs, Slack, or Gmail, it fires so many JS events and runs so much code that when the tab is active on slower systems you find Firefox's own UI is lagging. This is because the web application is always doing something or doing it too frequently and Firefox is having a hard time getting a word in edgewise. Such heavy interactive pages will no longer negatively impact the browser, especially on multi-core systems.
bzbarsky 10y ago
Without e10s, the UI is in fact not rendered on its own thread. There was a lot of discussion about whether to try to move the UI to a separate thread or separate process, and the decision was that separate process has a _much_ lower risk of bugs due to racing memory accesses and whatnot. Basically, it removes a bunch of ways that you could accidentally shoot yourself in the foot while trying to retrofit threading onto a large existing C++ codebase....

sharmi 10y ago

I feel like my case is an anomaly compared to others on this thread, but this has been a consistent experience for me. I hoard tabs and easily reach 40 tabs in a single session. It is typical to have 60-100 tabs open at any point in time. I find that firefox handles this much better than chrome does. Any time the tab count exceeds 15 or so in Chrome, my whole system slows down and freezes. I am forced to close some tabs and restart chrome to get some sanity. Often system reboot is the only option. In firefox the same system slowdown happens, but rarer than chrome, usually I have nearly 200 tabs open and running for a long time. In such cases, I just have to restart firefox. Firefox presents me with the restore window which is a much saner way to select only the tabs I want. Even in that case, when I restore, it does not load all the tabs, only the active ones, so it does not impact system performance. The only time firefox becomes slow even on startup is when I have restore windows several levels deep (yes, there is such a thing :) ) and I believe I am wholly responsible for that and not firefox. So it really surprises me when people say Chrome is more performant. Also, maybe because of familiarity, I find firefox Developer Tools more usable than Chrome's. But what do I know? I am a server side person dabbling in UI for my personal projects, not a web designer :) I dread Firefox following the footsteps of Chrome! Oh, and not to mention the scores of chrome processes that pollute the process list! when I run the `ps` command or the `top` command, it is difficult to locate the process that I am actually looking for. Also, it is much, much harder to estimate how much memory and processor time Chrome is really consuming when there are so many processes of Chrome running. May be I am doing it wrong. Some one please enlighten me.

cpeterso 10y ago
I know many Mozilla developers are "tab hoarders" with hundreds of tabs, so I am confident that your use case will get plenty of attention. :)
- Grue3 10y ago
  How do they manage all these tabs without Tab Groups then (which they removed)?
  - 10y ago

Jaruzel 10y ago

Default Firefox user here, although I do have Chrome installed on many of my machines. All around me people are now (or have been for some time) Chrome users. I just cannot make the switch. I don't know why - maybe it's the sharp angled tab UI, maybe it's the slightly 'off' font rendering. Maybe I don't trust google. Whatever it is, I keep using Firefox as my main Browser, and mostly I'm happy. A few things would make my Firefox life much easier though: - The ability to launch multiple Firefoxs with the same profile, but completely separate processes. So when one Firefox crashes, the others are left alone. At the moment, no matter how many Firefox windows you have open, they are all children of the first Firefox you started. - an equivalent of Chromes --APP=[URL] start up parameter (and the accompanying no-url-bar, custom icon, and unique window location/size settings) - this is a wonderful feature for web apps, and effectively transforms them into (almost) desktop apps in appearance. If firefox had that, I'd be over the moon. - A way of allocating a session when you start it for 'X project' and then be able to save off all those tabs in one action to a folder or tab 'startup list'. I'd like this to be native, and not an add-on I'd have to keep track of or suffer incompatibilities when the maintainer has lost interest in it. Finally, now that Windows and Linux roll with good default Browsers, and that Firefox (in the main) is a manual install, I can't see it recouping its percentage share. It feels like the slow death of the original Opera, all over again.

bzbarsky 10y ago
> - A way of allocating a session when you start it for 'X project' and then be able to save off all those tabs in one action to a folder or tab 'startup list'. The existing "Bookmark all tabs" option that creates a bookmark folder from all the tabs in a window and the existing option to open all the tabs in a bookmark folder sort of address this use case, unless 'X project' needs multiple windows...