10 ms·

What a weird polemic. "With Google WebComponents here we mean the use of CustomElements and Shadow DOM, especially when used in combination, and in dynamically

What a weird polemic. "With Google WebComponents here we mean the use of CustomElements and Shadow DOM, especially when used in combination, and in dynamically created document structures (e.g. using module loading/unloading and/or slotted elements). ... WebComponents used "in full" (i.e. dynamically) inherently creates complex web page structures that cannot be saved, archived or even displayed outside of the designated targeted browsers (primarily Google Chrome)." It's a web API. Browsers implement it. Including Safari and FF. If the argument is that it's hard to implement and makes it harder for new browser implementations, the same could be said of new CSS features, other APIs like Web Audio, etc. Trying to brand Web Components as Google-only may have worked in the v0 prototype days in like 2014, but it's factually not the case today.

eropple 7y ago
It's a web API, but it's a web API that requires development work to do, and Goanna (Pale Moon's pre-multiprocess, pre-all-the-things-that-make-modern-Firefox-good Gecko fork) would need to implement those APIs.
- PunchTornado 7y ago
  the same can be said about any new CSS features and other new stuff that goes into the browser. browsers are evolving rapidly, either to make devs work easier or make users' work easier or just to make everything prettier or faster.
- lima 7y ago
  Just ran checksec on Pale Moon's Linux binary distribution - their binaries are built with no mitigations whatsoever. ASLR disabled, no stack canaries, no fortify. This whole project appears to be a security disaster and nobody should use it.
  - q3k 7y ago
    They're generally pretty unprofessional. https://github.com/jasperla/openbsd-wip/issues/86 https://github.com/jasperla/openbsd-wip/issues/86
    - drusepth 7y ago
      This read was amazing, and I would fully recommend it for someone self-isolating with a hot cup of coffee who wants a jolly read about how not to communicate with others.
    - oefrha 7y ago
      I feel for the OpenBSD developer who apparently expected the project lead to be a reasonable grown-up, but ended up slapped in the face.
    - cultus 7y ago
      yikes. That's about the most insane exchange I've seen on Github.
    - lsaferite 7y ago
      That exchange borders on unbelievable for me. How any project could be so tone deaf is beyond comprehension. And the initial message from the PM project is more than enough to set anyone off.
    - stickfigure 7y ago
      This issue is now officially resolved. There will be no Pale Moon browser, official or not. The port has been removed. Farewell, petulant children. Beautiful response.
      - lonelappde 7y ago
        Petulance is independent of age.
    - tya99 7y ago
      Then there's this one from privacytools.io where they disregard criticism as "Fake News" https://github.com/privacytoolsIO/privacytools.io/issues/375#issuecomment-454704963 https://github.com/privacytoolsIO/privacytools.io/issues/375... and get all upset at people for "shitting on them". (Note mattatobin is also one of their devs).
  - superkuh 7y ago
    The real security disaster on the modern web is commercial groups taking over setting standards and turning the web browser into an OS with all the security problems that entails.
    - lima 7y ago
      The opposite is the case - web applications are one of the best things to happen, security-wise, in a long time. Web applications are fully isolated and sandboxed, have fine-grained permissions, are easy to inspect, and the runtime is built with a modern threat model. ChromeOS is probably the most secure desktop OS for this reason. I want my browser to expose more functionality to web apps, because it means that I have to run less random unsandboxed code on my underlying OS.
      - ticviking 7y ago
        I'd like it more if my underlying OS provided these features instead of running an OS on my OS.
        lima 7y ago
        We need both - some kinds of applications need direct hardware access. But the kernel attack surface is huge, even with seccomp and friends. An app on my smartphone or - much worse - an Electron app "sandboxed" in a flatpak on my desktop has access to far wider range of dangerous APIs than a web application. What's wrong with a browser as a high-level OS?
        ticviking 7y ago
        It's mostly the layering that bothers me. I don't mind Chrome OS and love my chromebook. Some of this is aesthetic so I don't really expect to change minds, but if we lived in the world of "Life and Death of Javascript" and booted to some kind of Web OS I'd be annoyed at the loss of low level hackibility and get over it. Booting to Linux, then booting a browser to get to a normal app that doesn't need network connectivity "feels" wrong.
  - laurent123456 7y ago
    Why was it used at all if it's basically an old fork of Firefox? Just curious as I've never heard of it before.
    - eropple 7y ago
      "Customization." It retains the older, Firefox ~25-ish UI. They've since upgraded the backend to Firefox 52, which is still Really Old. And they've got a lot of culty behavior around their community, if that's your bag. If you absolutely must have an XUL-based Firefox derivative: 1) you don't, 2) stop, and 3) don't use this one if you don't listen to #1 or #2.
      - LordLestat 7y ago
        Customization is no crime. Simplicity and minimalism is way worse... You think that this is what power-users would accept? Why use people Vivaldi, Otter, Seamonkey for example? Because they WANT features. People HAVE THE RIGHT to demand THAT. Rather selfish opinion of yours, to deny power users rights! Is this a democracy or leftist fascist dictatorship? BC that is how the leftist fascists argue.... NO features which simple users do NOT understand as that would violate their safe space! Honestly...
        eropple 7y ago
        Yes, I have seen your frothing Reddit posts, you don't have to repeat them here. "Leftist fascist"--can I give you a bit of free advice? If you have to modify "fascist", everyone and their dog knows it's because you have to modify your slur to make the mirror a little more palatable. Maybe find some new ones. But I reject the square-peg premise you're trying to jam into that round hole anyway, as it's not a democracy, either. Your choices impact your neighbors without their consent. It's not about fucking over power users or whatever the weird little epistemic enclosure you come from wants to insist it is, it's about addressing technical debt both in terms of performance and security--and the latter matters quite a lot in terms of not enabling people who think they're power users to 1) blow their own leg off, and 2) blow the legs off the people next to them. That's why those "leftist fascist" evil scary Firefox people decided "hey, let's patch some of these up." Customization, in and of itself, is fine (modulo the combinatoric explosion that leads to security holes). Few enough people would disagree with that, though I understand that the aforementioned epistemic closure holds as axiomatic that everybody just hates the tweaker types. On the other hand, customization at the expense of competent security development, which is what you get with Pale Moon, is not. And seeing as how there certainly doesn't seem to be much in the way of developer competence, to the point where "don't use the stuff that upstream has working just fine because we can't figure it out" is a legitimate attempt at "discussion", it ought to be dumpstered. Somehow, this "power user" (god, I hate that term) gets by just fine with poor, benighted Firefox--having switched to it from Chrome/Safari after Quantum because it finally felt as pleasant to use as back in The Day. Clearly, though, that just makes me a radical-left SJW hater or something. But that's fine. Modern Firefox is heckin' great.
  - smnthermes 7y ago
    > their binaries are built with no mitigations whatsoever. ASLR disabled, no stack canaries, no fortify. Provide evidence.
    - lima 7y ago
      Anyone can easily verify this by downloading the binaries, and running checksec themselves. Here's the output: $ sha256sum palemoon-bin 0b7f4ad73fc671e20bfb2366aa9d9ad81e82a3c8f63acde7f37063e73fda2141 palemoon-bin $ checksec --file=./palemoon-bin --output=json --extended | jq { "./palemoon-bin": { "relro": "partial", "canary": "no", "nx": "yes", "pie": "no", "clangcfi": "no", "safestack": "no", "rpath": "no", "runpath": "no", "symbols": "no", "fortify_source": "no", "fortified": "0", "fortify-able": "15" } } Notably, the binary has not been compiled with -fPIE and -fstack-protector, which disables two very basic exploit mitigations - ASLR and stack canaries. Any self-respecting Linux distribution enables these compiler flags by default nowadays. -D_FORTIFY_SOURCE is also missing, unlike Chrome or Firefox. A modern browser uses dozens of custom binary exploitation mitigations in addition to this. Mitigations and sandboxing are the difference between an exploit a CTF player can write on an afternoon, and a multi-month expert-level endeavour.
      - fouric 7y ago
        Which version is the `palemoon-bin` that you have there?
        eropple 7y ago
        It's 28.8.4 x64, downloaded straight from the website. (I duplicated his efforts; tbf, you could have, too.)
- oefrha 7y ago
  > It's a web API, but it's a web API that requires development work Care to name one web API that doesn’t require development work? Web standards evolve, new APIs are introduced. News at 11.
  - eropple 7y ago
    Yeah, that's my point. Pale Moon's developers forked a complex project and are now asking people to not use things that the mainline project now supports just fine. Checks written, can't cash, etcetera.
    - oefrha 7y ago
      Fair enough, should have sensed the sarcasm.
  - dmitriid 7y ago
    There are too many APIs released at neck-breaking speed, often poorly designed and rushed. See Google's own Web Api tracking page [1] Chrome adds almost 1000 new APIs per year Only last year they added over 500 APIs that are not present in other browsers, and pretend they are standard and will not remove them even if other browsers are not going to implement them due to multiple explicitly voiced concerns. So yeah, no. Your news at eleven is misleading at best. [1] https://web-confluence.appspot.com/#!/confluence https://web-confluence.appspot.com/#!/confluence
    - oefrha 7y ago
      > Definition: API: For the purposes of these metrics, an “API” is an interface name + attribute or operation pair. So there aren’t 1000 new Web Component specs coming out each year, no. And fewer make it into W3C/WHATWG specs.
      - dmitriid 7y ago
        No. But there are 1000 new web APIs that you have to implement yearly just to keep up. And Web Component specs are a part of that. And then despite all the objections from all the other browser vendors Google releases an API in production and will not mark it as experimental. Yes, a Web Components-related API (Adopted Stylesheets).
superfist 7y ago
Exactly, I don't understand what do they mean by Google WebComponents. CustomElements v0? v1? both?
- floatboth 7y ago
  Both, anything, everything. They're an ancient outdated (==insecure) fork of Firefox and they can't implement any new feature themselves.
  - smnthermes 7y ago
    Fake news. Firefox had sandboxing (that was the excuse for deprecating XUL/XPCOM) before Chrom* and Electrolysis: 1. https://developer.mozilla.org/en-US/docs/Archive/Add-ons/Security_best_practices_in_extensions https://developer.mozilla.org/en-US/docs/Archive/Add-ons/Sec... 2. https://developer.mozilla.org/en-US/docs/Archive/Add-ons/Displaying_web_content_in_an_extension_without_security_issues https://developer.mozilla.org/en-US/docs/Archive/Add-ons/Dis... 3. https://developer.mozilla.org/en-US/docs/Archive/Add-ons/Interaction_between_privileged_and_non-privileged_pages https://developer.mozilla.org/en-US/docs/Archive/Add-ons/Int...
newsletterguy 7y ago
Simply an excuse for "We can't successfully implement it, our browser is becoming incompatible with a large part of current web, so please do not use it to make us happy"! Result - they are going to die and losing hope and faith, like the link here describes. Read especially the IRC link where they discuss things like that with their "ecmascript guy" Gaming4JC - who has the task... WITHOUT ADDITIONAL HELP" to make Pale Moon "COMPATIBLE WITH TODAYS WEB" - honestly... what a joke.... More here: https://www.reddit.com/r/palemoon/comments/fk4fnl/attention_palemoon_is_going_to_die_most_likely/ https://www.reddit.com/r/palemoon/comments/fk4fnl/attention_... Why is this the truth? They failed in the past with implementing stuff on their own, and they had to use new Firefox variants to re-base their UI towards them. As there is not a way of going forward anymore without losing all their customization abilities, they are screwed as webcomponents is such a breaking point in time again where they can't succeed on their own because of their team missing guys who successfully would be able to implement stuff like this - uses Rust/Stylo/Servo - and that is way too complicated to them and they miss all the necessary knowledge how to convert it to their current codebase of Firefox 52!
- Wowfunhappy 7y ago
  Even if that reddit post is 100% correct, the author's behavior strikes me as the epitome of trolling. So I'm not inclined to take their words particularly seriously. The author basically walked into a community of Pale Moon enthusiasts and shouted: "Hey Palemoon fans! Y'know that thing you love? It's going to die! Sorry!". The legitimately-concerned version of this post would go something like: "If Palemoon can't implement web components, does the browser have a future?"
  - newsletterguy 7y ago
    Well, it COULD mean the end of this browser, which i would not call a big loss, as it was always outdated and the makers ripped out vital security features like sandboxing or they have been unable to implement Mozilla implemented tor based privacy fixes! It is better that the fans are learning WHAT COULD HAPPEN - because if they would not learn the truth, they are suddenly sitting around with a dead and even more outdated browser. This is too important than to ignore it or not to post about it.
rickcrown 7y ago
Like it was said already... a lame excuse for "We can't successfully implement it, our browser is becoming incompatible with a large part of current web, so please do not use it to make us happy" Without doubts - this will be Pale Moons final run - as the makers are fully unable to implement complex features on their own, as they do not have the tiniest bit of knowledge how to implement medium or highly complex Ecmascript features. This link explains everything with all necessary details - also shared before: https://www.reddit.com/r/palemoon/comments/fk4fnl/attention_palemoon_is_going_to_die_most_likely/ https://www.reddit.com/r/palemoon/comments/fk4fnl/attention_...
- Ajedi32 7y ago
  Nonetheless, its still mildly concerning that smaller players in the browser space are finding it difficult to keep pace with all the new APIs being introduced to the web these days. Even Microsoft sort of gave up and killed their browser engine in favor of a Chromium fork. It's a tricky situation with no obvious solutions. The Pale Moon dev's plea to slow down isn't going to work; devs want these new features and they're not going to stop using them just because a smaller browser developer with no significant market share can't keep up. There is, perhaps, the beginnings of a solution with the Extensible Web Manifesto[1], which aims to shift the focus of browsers from implementation of many high-level features to instead focus on smaller, simpler low-level features which high-level features can then be built on top of. (Though ironically, web components are a part of this movement.) CSS Houdini[2] is one such feature which seems like it might be relevant in this specific situation (though whether it's helpful I have no idea; in the short term I suspect it might just translate to a lot more work). [1]: https://github.com/extensibleweb/manifesto https://github.com/extensibleweb/manifesto [2]: https://developer.mozilla.org/en-US/docs/Web/Houdini https://developer.mozilla.org/en-US/docs/Web/Houdini
  - esarbe 7y ago
    All the more reason to cherish Firefox.
    - stjohnswarts 7y ago
monadic2 7y ago
It’s a document api that, when used, can’t be saved as a document. Pretty simple.
deleted 7y ago
[deleted]
AnarchistNode7 7y ago
Even worse.. the Pale Moon guys are unskilled amateurs of the worst classification - the kind of developers which activity should be force-closed to protect others of their unintentionally spread incompetence which put tons of other people at high risks. Not alone that, they are rude and shit into the face of a big part of the Linux community with threatening them in the worst way possible. Then we had a server hack with compromised binary files.... People should be made aware of Pale Moon and their amateurish activity, so they can immediately uninstall this danger-ware from their systems!
- zamalek 7y ago
  They have blown things out of proportion (see parent comment). Only extremely minor browsers will be affected. Chromium (Chrome, Edge, Opera), Quantum (FF) will be fine. I suspect even the likes of KHTML will add support for it. Pale Moon is a fork of Firefox made before the removal of XUL (as I believe is their selling point). They would have to back-port Web Components (which may be impossible due to Quantum) or write it from scratch. This is all really hard for them because they likely have fewer than 10 active developers.
  - Udik 7y ago
    Can't they just ship the browser with js webcomponents polyfills?
- kevingadd 7y ago
  Back when I still had to support bleeding-edge web apps more than a few of my bug reports were from Pale Moon users because the devs couldn't configure their compiler properly and were always behind on bug fixes. Impossible to act on that stuff, though I tried. Once I realized how bad PM's security story was I gave up on supporting it, not gonna expose my development machines to that.
  - smnthermes 7y ago
    > Once I realized how bad PM's security story was I gave up on supporting it, not gonna expose my development machines to that. Fake news. Firefox had sandboxing (that was the excuse for deprecating XUL/XPCOM) before Chrom* and Electrolysis: 1. https://developer.mozilla.org/en-US/docs/Archive/Add-ons/Security_best_practices_in_extensions https://developer.mozilla.org/en-US/docs/Archive/Add-ons/Sec... 2. https://developer.mozilla.org/en-US/docs/Archive/Add-ons/Displaying_web_content_in_an_extension_without_security_issues https://developer.mozilla.org/en-US/docs/Archive/Add-ons/Dis... 3. https://developer.mozilla.org/en-US/docs/Archive/Add-ons/Interaction_between_privileged_and_non-privileged_pages https://developer.mozilla.org/en-US/docs/Archive/Add-ons/Int...
runarberg 7y ago
Thanks for clarifying. While reading this I was under the impression that they were referring to specific web components created and hosted by Google, and I further assumed that Google denied crawlers access to the web component modules (hence closed). Thanks for making it clear that is not the case.
smnthermes 7y ago
> Trying to brand Web Components as Google-only may have worked in the v0 prototype days in like 2014, but it's factually not the case today. Even Mozilla is having problems with Google WebComponents. There are 100 bugs open in Bugzilla about it.
- untog 7y ago
  Your comment doesn’t seem to be related to the text you’ve quoted. “It’s difficult to implement” is not related to “it is owned by Google”.
smnthermes 7y ago
YouTube uses WebComponents, and its pages are unviewable with Wayback Machine: http://web.archive.org/web/20200317150441/https://www.youtube.com/ http://web.archive.org/web/20200317150441/https://www.youtub...
dathinab 7y ago
Note sure, but doesn't AMP have "custom elements" which are not just CustomElement+Shadow DOM but google pseudo-proprietary "pre-loaded/created" elements? Anyway it's nevertheless troublesome that google has so much influence that they can just push new web features without much discussion of other developers/browser vendors. Due to differences in internal design some features can be simple to implement for google but hard for everyone else (or the other way around, in which case google can just reject them by simply not implementing them). EDIT: Also the non-JS web is basically dead. People should to come and accept that even if it's not perfect.
- no_wizard 7y ago
  All of that is window dressing over custom elements polyfilled by document-register-element[0] and Preact[1] Its a giant SSR machine, from what I can tell. Also web workers are leveraged to do alot of the heavy lifting when it can't be SSR'd [0]https://github.com/WebReflection/document-register-element https://github.com/WebReflection/document-register-element [1]https://preactjs.com/ https://preactjs.com/
- SickOfSlowSites 7y ago
  > EDIT: Also the non-JS web is basically dead. People should to come and accept that even if it's not perfect. No. I won't accept it. The JS web sucks. It's slow, bloated, provides nothing of value to me the user, and exists only to feed the maw of advertisers and platform providers who will never be satisfied with the tech we have. HTML pages are still faster to use and 1000x easier to deploy than all this "modern" web crap that delivers less and less for more and more. Look at the site you are on! I've never heard about this Webcomponents thing before today. I hate it already. No I'm not willing to give it a chance. I am certain, certain that it will deliver nothing but pages with 100K of actual content which need 10MB code downloads and 20s rendering times on an i5. Web designers, developers, and especially browser developers are destroying the world wide web and replacing it with a glorified series of custom-flash apps. It's every bit as terrible as when flash was around no matter how much spin is put on these "standards". Google is the new Adobe and your website is awful again.
  - 7y ago

eropple 7y ago

It's a web API, but it's a web API that requires development work to do, and Goanna (Pale Moon's pre-multiprocess, pre-all-the-things-that-make-modern-Firefox-good Gecko fork) would need to implement those APIs.

PunchTornado 7y ago
the same can be said about any new CSS features and other new stuff that goes into the browser. browsers are evolving rapidly, either to make devs work easier or make users' work easier or just to make everything prettier or faster.
lima 7y ago
Just ran checksec on Pale Moon's Linux binary distribution - their binaries are built with no mitigations whatsoever. ASLR disabled, no stack canaries, no fortify. This whole project appears to be a security disaster and nobody should use it.
- q3k 7y ago
  They're generally pretty unprofessional. https://github.com/jasperla/openbsd-wip/issues/86 https://github.com/jasperla/openbsd-wip/issues/86
  - drusepth 7y ago
    This read was amazing, and I would fully recommend it for someone self-isolating with a hot cup of coffee who wants a jolly read about how not to communicate with others.
  - oefrha 7y ago
    I feel for the OpenBSD developer who apparently expected the project lead to be a reasonable grown-up, but ended up slapped in the face.
  - cultus 7y ago
    yikes. That's about the most insane exchange I've seen on Github.
  - lsaferite 7y ago
    That exchange borders on unbelievable for me. How any project could be so tone deaf is beyond comprehension. And the initial message from the PM project is more than enough to set anyone off.
  - stickfigure 7y ago
    This issue is now officially resolved. There will be no Pale Moon browser, official or not. The port has been removed. Farewell, petulant children. Beautiful response.
    - lonelappde 7y ago
      Petulance is independent of age.
  - tya99 7y ago
    Then there's this one from privacytools.io where they disregard criticism as "Fake News" https://github.com/privacytoolsIO/privacytools.io/issues/375#issuecomment-454704963 https://github.com/privacytoolsIO/privacytools.io/issues/375... and get all upset at people for "shitting on them". (Note mattatobin is also one of their devs).
- superkuh 7y ago
  The real security disaster on the modern web is commercial groups taking over setting standards and turning the web browser into an OS with all the security problems that entails.
  - lima 7y ago
    The opposite is the case - web applications are one of the best things to happen, security-wise, in a long time. Web applications are fully isolated and sandboxed, have fine-grained permissions, are easy to inspect, and the runtime is built with a modern threat model. ChromeOS is probably the most secure desktop OS for this reason. I want my browser to expose more functionality to web apps, because it means that I have to run less random unsandboxed code on my underlying OS.
    - ticviking 7y ago
      I'd like it more if my underlying OS provided these features instead of running an OS on my OS.
      - lima 7y ago
        We need both - some kinds of applications need direct hardware access. But the kernel attack surface is huge, even with seccomp and friends. An app on my smartphone or - much worse - an Electron app "sandboxed" in a flatpak on my desktop has access to far wider range of dangerous APIs than a web application. What's wrong with a browser as a high-level OS?
        ticviking 7y ago
        It's mostly the layering that bothers me. I don't mind Chrome OS and love my chromebook. Some of this is aesthetic so I don't really expect to change minds, but if we lived in the world of "Life and Death of Javascript" and booted to some kind of Web OS I'd be annoyed at the loss of low level hackibility and get over it. Booting to Linux, then booting a browser to get to a normal app that doesn't need network connectivity "feels" wrong.
- laurent123456 7y ago
  Why was it used at all if it's basically an old fork of Firefox? Just curious as I've never heard of it before.
  - eropple 7y ago
    "Customization." It retains the older, Firefox ~25-ish UI. They've since upgraded the backend to Firefox 52, which is still Really Old. And they've got a lot of culty behavior around their community, if that's your bag. If you absolutely must have an XUL-based Firefox derivative: 1) you don't, 2) stop, and 3) don't use this one if you don't listen to #1 or #2.
    - LordLestat 7y ago
      Customization is no crime. Simplicity and minimalism is way worse... You think that this is what power-users would accept? Why use people Vivaldi, Otter, Seamonkey for example? Because they WANT features. People HAVE THE RIGHT to demand THAT. Rather selfish opinion of yours, to deny power users rights! Is this a democracy or leftist fascist dictatorship? BC that is how the leftist fascists argue.... NO features which simple users do NOT understand as that would violate their safe space! Honestly...
      - eropple 7y ago
        Yes, I have seen your frothing Reddit posts, you don't have to repeat them here. "Leftist fascist"--can I give you a bit of free advice? If you have to modify "fascist", everyone and their dog knows it's because you have to modify your slur to make the mirror a little more palatable. Maybe find some new ones. But I reject the square-peg premise you're trying to jam into that round hole anyway, as it's not a democracy, either. Your choices impact your neighbors without their consent. It's not about fucking over power users or whatever the weird little epistemic enclosure you come from wants to insist it is, it's about addressing technical debt both in terms of performance and security--and the latter matters quite a lot in terms of not enabling people who think they're power users to 1) blow their own leg off, and 2) blow the legs off the people next to them. That's why those "leftist fascist" evil scary Firefox people decided "hey, let's patch some of these up." Customization, in and of itself, is fine (modulo the combinatoric explosion that leads to security holes). Few enough people would disagree with that, though I understand that the aforementioned epistemic closure holds as axiomatic that everybody just hates the tweaker types. On the other hand, customization at the expense of competent security development, which is what you get with Pale Moon, is not. And seeing as how there certainly doesn't seem to be much in the way of developer competence, to the point where "don't use the stuff that upstream has working just fine because we can't figure it out" is a legitimate attempt at "discussion", it ought to be dumpstered. Somehow, this "power user" (god, I hate that term) gets by just fine with poor, benighted Firefox--having switched to it from Chrome/Safari after Quantum because it finally felt as pleasant to use as back in The Day. Clearly, though, that just makes me a radical-left SJW hater or something. But that's fine. Modern Firefox is heckin' great.
- smnthermes 7y ago
  > their binaries are built with no mitigations whatsoever. ASLR disabled, no stack canaries, no fortify. Provide evidence.
  - lima 7y ago
    Anyone can easily verify this by downloading the binaries, and running checksec themselves. Here's the output: $ sha256sum palemoon-bin 0b7f4ad73fc671e20bfb2366aa9d9ad81e82a3c8f63acde7f37063e73fda2141 palemoon-bin $ checksec --file=./palemoon-bin --output=json --extended | jq { "./palemoon-bin": { "relro": "partial", "canary": "no", "nx": "yes", "pie": "no", "clangcfi": "no", "safestack": "no", "rpath": "no", "runpath": "no", "symbols": "no", "fortify_source": "no", "fortified": "0", "fortify-able": "15" } } Notably, the binary has not been compiled with -fPIE and -fstack-protector, which disables two very basic exploit mitigations - ASLR and stack canaries. Any self-respecting Linux distribution enables these compiler flags by default nowadays. -D_FORTIFY_SOURCE is also missing, unlike Chrome or Firefox. A modern browser uses dozens of custom binary exploitation mitigations in addition to this. Mitigations and sandboxing are the difference between an exploit a CTF player can write on an afternoon, and a multi-month expert-level endeavour.
    - fouric 7y ago
      Which version is the `palemoon-bin` that you have there?
      - eropple 7y ago
        It's 28.8.4 x64, downloaded straight from the website. (I duplicated his efforts; tbf, you could have, too.)
oefrha 7y ago
> It's a web API, but it's a web API that requires development work Care to name one web API that doesn’t require development work? Web standards evolve, new APIs are introduced. News at 11.
- eropple 7y ago
  Yeah, that's my point. Pale Moon's developers forked a complex project and are now asking people to not use things that the mainline project now supports just fine. Checks written, can't cash, etcetera.
  - oefrha 7y ago
    Fair enough, should have sensed the sarcasm.
- dmitriid 7y ago
  There are too many APIs released at neck-breaking speed, often poorly designed and rushed. See Google's own Web Api tracking page [1] Chrome adds almost 1000 new APIs per year Only last year they added over 500 APIs that are not present in other browsers, and pretend they are standard and will not remove them even if other browsers are not going to implement them due to multiple explicitly voiced concerns. So yeah, no. Your news at eleven is misleading at best. [1] https://web-confluence.appspot.com/#!/confluence https://web-confluence.appspot.com/#!/confluence
  - oefrha 7y ago
    > Definition: API: For the purposes of these metrics, an “API” is an interface name + attribute or operation pair. So there aren’t 1000 new Web Component specs coming out each year, no. And fewer make it into W3C/WHATWG specs.
    - dmitriid 7y ago
      No. But there are 1000 new web APIs that you have to implement yearly just to keep up. And Web Component specs are a part of that. And then despite all the objections from all the other browser vendors Google releases an API in production and will not mark it as experimental. Yes, a Web Components-related API (Adopted Stylesheets).

superfist 7y ago

Exactly, I don't understand what do they mean by Google WebComponents. CustomElements v0? v1? both?

floatboth 7y ago
Both, anything, everything. They're an ancient outdated (==insecure) fork of Firefox and they can't implement any new feature themselves.
- smnthermes 7y ago
  Fake news. Firefox had sandboxing (that was the excuse for deprecating XUL/XPCOM) before Chrom* and Electrolysis: 1. https://developer.mozilla.org/en-US/docs/Archive/Add-ons/Security_best_practices_in_extensions https://developer.mozilla.org/en-US/docs/Archive/Add-ons/Sec... 2. https://developer.mozilla.org/en-US/docs/Archive/Add-ons/Displaying_web_content_in_an_extension_without_security_issues https://developer.mozilla.org/en-US/docs/Archive/Add-ons/Dis... 3. https://developer.mozilla.org/en-US/docs/Archive/Add-ons/Interaction_between_privileged_and_non-privileged_pages https://developer.mozilla.org/en-US/docs/Archive/Add-ons/Int...

newsletterguy 7y ago

Simply an excuse for "We can't successfully implement it, our browser is becoming incompatible with a large part of current web, so please do not use it to make us happy"! Result - they are going to die and losing hope and faith, like the link here describes. Read especially the IRC link where they discuss things like that with their "ecmascript guy" Gaming4JC - who has the task... WITHOUT ADDITIONAL HELP" to make Pale Moon "COMPATIBLE WITH TODAYS WEB" - honestly... what a joke.... More here: https://www.reddit.com/r/palemoon/comments/fk4fnl/attention_palemoon_is_going_to_die_most_likely/ https://www.reddit.com/r/palemoon/comments/fk4fnl/attention_... Why is this the truth? They failed in the past with implementing stuff on their own, and they had to use new Firefox variants to re-base their UI towards them. As there is not a way of going forward anymore without losing all their customization abilities, they are screwed as webcomponents is such a breaking point in time again where they can't succeed on their own because of their team missing guys who successfully would be able to implement stuff like this - uses Rust/Stylo/Servo - and that is way too complicated to them and they miss all the necessary knowledge how to convert it to their current codebase of Firefox 52!

Wowfunhappy 7y ago
Even if that reddit post is 100% correct, the author's behavior strikes me as the epitome of trolling. So I'm not inclined to take their words particularly seriously. The author basically walked into a community of Pale Moon enthusiasts and shouted: "Hey Palemoon fans! Y'know that thing you love? It's going to die! Sorry!". The legitimately-concerned version of this post would go something like: "If Palemoon can't implement web components, does the browser have a future?"
- newsletterguy 7y ago
  Well, it COULD mean the end of this browser, which i would not call a big loss, as it was always outdated and the makers ripped out vital security features like sandboxing or they have been unable to implement Mozilla implemented tor based privacy fixes! It is better that the fans are learning WHAT COULD HAPPEN - because if they would not learn the truth, they are suddenly sitting around with a dead and even more outdated browser. This is too important than to ignore it or not to post about it.

rickcrown 7y ago

Like it was said already... a lame excuse for "We can't successfully implement it, our browser is becoming incompatible with a large part of current web, so please do not use it to make us happy" Without doubts - this will be Pale Moons final run - as the makers are fully unable to implement complex features on their own, as they do not have the tiniest bit of knowledge how to implement medium or highly complex Ecmascript features. This link explains everything with all necessary details - also shared before: https://www.reddit.com/r/palemoon/comments/fk4fnl/attention_palemoon_is_going_to_die_most_likely/ https://www.reddit.com/r/palemoon/comments/fk4fnl/attention_...

Ajedi32 7y ago
Nonetheless, its still mildly concerning that smaller players in the browser space are finding it difficult to keep pace with all the new APIs being introduced to the web these days. Even Microsoft sort of gave up and killed their browser engine in favor of a Chromium fork. It's a tricky situation with no obvious solutions. The Pale Moon dev's plea to slow down isn't going to work; devs want these new features and they're not going to stop using them just because a smaller browser developer with no significant market share can't keep up. There is, perhaps, the beginnings of a solution with the Extensible Web Manifesto[1], which aims to shift the focus of browsers from implementation of many high-level features to instead focus on smaller, simpler low-level features which high-level features can then be built on top of. (Though ironically, web components are a part of this movement.) CSS Houdini[2] is one such feature which seems like it might be relevant in this specific situation (though whether it's helpful I have no idea; in the short term I suspect it might just translate to a lot more work). [1]: https://github.com/extensibleweb/manifesto https://github.com/extensibleweb/manifesto [2]: https://developer.mozilla.org/en-US/docs/Web/Houdini https://developer.mozilla.org/en-US/docs/Web/Houdini
- esarbe 7y ago
  All the more reason to cherish Firefox.
  - stjohnswarts 7y ago

monadic2 7y ago

It’s a document api that, when used, can’t be saved as a document. Pretty simple.

deleted 7y ago

[deleted]

AnarchistNode7 7y ago

Even worse.. the Pale Moon guys are unskilled amateurs of the worst classification - the kind of developers which activity should be force-closed to protect others of their unintentionally spread incompetence which put tons of other people at high risks. Not alone that, they are rude and shit into the face of a big part of the Linux community with threatening them in the worst way possible. Then we had a server hack with compromised binary files.... People should be made aware of Pale Moon and their amateurish activity, so they can immediately uninstall this danger-ware from their systems!

zamalek 7y ago
They have blown things out of proportion (see parent comment). Only extremely minor browsers will be affected. Chromium (Chrome, Edge, Opera), Quantum (FF) will be fine. I suspect even the likes of KHTML will add support for it. Pale Moon is a fork of Firefox made before the removal of XUL (as I believe is their selling point). They would have to back-port Web Components (which may be impossible due to Quantum) or write it from scratch. This is all really hard for them because they likely have fewer than 10 active developers.
- Udik 7y ago
  Can't they just ship the browser with js webcomponents polyfills?
kevingadd 7y ago
Back when I still had to support bleeding-edge web apps more than a few of my bug reports were from Pale Moon users because the devs couldn't configure their compiler properly and were always behind on bug fixes. Impossible to act on that stuff, though I tried. Once I realized how bad PM's security story was I gave up on supporting it, not gonna expose my development machines to that.
- smnthermes 7y ago
  > Once I realized how bad PM's security story was I gave up on supporting it, not gonna expose my development machines to that. Fake news. Firefox had sandboxing (that was the excuse for deprecating XUL/XPCOM) before Chrom* and Electrolysis: 1. https://developer.mozilla.org/en-US/docs/Archive/Add-ons/Security_best_practices_in_extensions https://developer.mozilla.org/en-US/docs/Archive/Add-ons/Sec... 2. https://developer.mozilla.org/en-US/docs/Archive/Add-ons/Displaying_web_content_in_an_extension_without_security_issues https://developer.mozilla.org/en-US/docs/Archive/Add-ons/Dis... 3. https://developer.mozilla.org/en-US/docs/Archive/Add-ons/Interaction_between_privileged_and_non-privileged_pages https://developer.mozilla.org/en-US/docs/Archive/Add-ons/Int...

runarberg 7y ago

Thanks for clarifying. While reading this I was under the impression that they were referring to specific web components created and hosted by Google, and I further assumed that Google denied crawlers access to the web component modules (hence closed). Thanks for making it clear that is not the case.

smnthermes 7y ago

> Trying to brand Web Components as Google-only may have worked in the v0 prototype days in like 2014, but it's factually not the case today. Even Mozilla is having problems with Google WebComponents. There are 100 bugs open in Bugzilla about it.

untog 7y ago
Your comment doesn’t seem to be related to the text you’ve quoted. “It’s difficult to implement” is not related to “it is owned by Google”.

smnthermes 7y ago

YouTube uses WebComponents, and its pages are unviewable with Wayback Machine: http://web.archive.org/web/20200317150441/https://www.youtube.com/ http://web.archive.org/web/20200317150441/https://www.youtub...

dathinab 7y ago

Note sure, but doesn't AMP have "custom elements" which are not just CustomElement+Shadow DOM but google pseudo-proprietary "pre-loaded/created" elements? Anyway it's nevertheless troublesome that google has so much influence that they can just push new web features without much discussion of other developers/browser vendors. Due to differences in internal design some features can be simple to implement for google but hard for everyone else (or the other way around, in which case google can just reject them by simply not implementing them). EDIT: Also the non-JS web is basically dead. People should to come and accept that even if it's not perfect.

no_wizard 7y ago
All of that is window dressing over custom elements polyfilled by document-register-element[0] and Preact[1] Its a giant SSR machine, from what I can tell. Also web workers are leveraged to do alot of the heavy lifting when it can't be SSR'd [0]https://github.com/WebReflection/document-register-element https://github.com/WebReflection/document-register-element [1]https://preactjs.com/ https://preactjs.com/
SickOfSlowSites 7y ago
> EDIT: Also the non-JS web is basically dead. People should to come and accept that even if it's not perfect. No. I won't accept it. The JS web sucks. It's slow, bloated, provides nothing of value to me the user, and exists only to feed the maw of advertisers and platform providers who will never be satisfied with the tech we have. HTML pages are still faster to use and 1000x easier to deploy than all this "modern" web crap that delivers less and less for more and more. Look at the site you are on! I've never heard about this Webcomponents thing before today. I hate it already. No I'm not willing to give it a chance. I am certain, certain that it will deliver nothing but pages with 100K of actual content which need 10MB code downloads and 20s rendering times on an i5. Web designers, developers, and especially browser developers are destroying the world wide web and replacing it with a glorified series of custom-flash apps. It's every bit as terrible as when flash was around no matter how much spin is put on these "standards". Google is the new Adobe and your website is awful again.
- 7y ago