6 ms·

Some context that could possibly make the reasoning behind this more clear. Pale Moon is a fork of Firefox. The purpose of the fork was to retain support for v

Some context that could possibly make the reasoning behind this more clear. Pale Moon is a fork of Firefox. The purpose of the fork was to retain support for various legacy technologies that mainline Firefox was abandoning, such as NPAPI plugins, XUL/XPCOM, and old-style themes. If keeping up support for those old technologies and keeping up with the latest improvements in Firefox sounds like a lot of work for a small team to tackle, that's because it is. As a result, Pale Moon doesn't include all the performance improvements that shipped with Firefox Quantum, along with various other "modern Firefox" improvements like not running all tabs in a single process. (Pale Moon last rebased itself on mainline Firefox circa Firefox 52, which shipped three years ago.) My suspicion is that, when Pale Moon asks you not to use Web Components, they're doing so because their engine is old, it doesn't have the necessary muscle to deal with things like shadow DOM in a performant fashion, and they don't have the resources necessary to give it that muscle. They could rebase onto a newer version of Firefox that did have that muscle, but they'd lose support for all the legacy technologies they forked away to keep in the first place; and re-implementing all those APIs on their own would be just as prohibitively large a project as tuning up their engine on their own would be. So, in the absence of some huge population of skilled developers volunteering to pitch in for free, their project is kind of stuck between a rock and a hard place.

Hokusai 7y ago
Other way of looking at it is that google is the new Microsoft and play the Embrace, extend, and extinguish game. You are attacking the post ad hominem. But, your comment does not change the validity original argument. I’m interested in knowing your opinion about the arguments, thou.
AnarchistNode7 7y ago
Well, if I as developer would realize that i pose my users under certain risk and i am unable to do anything about it, then the only logical and morally correct option would be, to tell that my users and cease operation. Everything else is selfish and delusional!
- smacktoward 7y ago
  I tend to agree, but if the Pale Moon developers agreed they would have shut the project down long ago. The legacy APIs they're clinging to are loaded with security risks -- that's part of why Mozilla ditched them in the first place. And there's not much evidence that Pale Moon et al. are doing anything substantial to remove or mitigate them.
- laurent123456 7y ago
  Yes sounds like they should just cut their losses. They gave it a try and discovered you can't maintain a fork of a browser that easily.
- LordLestat 7y ago
  It is up to the user to decide WHAT they want to use. If they want to use something with features, then YES THEY CAN! Demanding that a product you do NOT like or HATE should cease their activity.. this is dictatorship! Leftist fanaticism of the worst kind - especially if it is against features. The worst kind of community which is contra-features and contra-choice is Mozilla these days without their origin power-user target-group. Most remaining Mozilla users today are radical left, so is Mozillas management these days.And both have a serious intense hate against features and functions... hate against everything which is against conformity.
  - tensor 7y ago
    The political propaganda in your post, e.g. "radical left", "leftist fanaticism," makes it lose all meaning. Sadly I didn't see a flag button. I would hope that posts like yours are not welcome in a technical discussion.
    - duckMuppet 7y ago
      Resistance is futile. You will be assimilated.
    - rickcrown 7y ago
      There is a difference between discussing something and the fascist haters of customization these days. It is a fact that most people are either using Firefox OR Chrome and sharing such a toxic opinion. And that is not what the right-wing side is spreading, this opinion you can find majority-wise at the left-winger audience. Therefor Lestat is right and this has to be mentioned, as there is zero reason that such disgusting fascism just should not be ignored.
basch 7y ago
They also maintain an in between version. https://www.basilisk-browser.org/ https://www.basilisk-browser.org/
- smacktoward 7y ago
  If the core problem is that you don't have enough resources to do everything you set out to do, splitting those resources between two separate products doesn't help matters.
  - smnthermes 7y ago
    Both browsers use the same platform/rendering engine. Stop spreading misinformation and FUD.
  - dirtnugget 7y ago
    Exactly my thought... How is fragmentation exactly gonna help this?
lonelappde 7y ago
How does Pale Moon maintain security for these legacy technologies?
- ailideex 7y ago
  How do pigs fly?
- smacktoward 7y ago
  I'm not sure they could, even if they wanted to. The security problems with those technologies aren't due to implementation goofs. They're fundamental issues with the design of those platforms, all of which were designed back in the '90s, when we didn't appreciate just how dangerous an environment the Internet could become. There's no way to fix issues that run that deep without breaking backwards compatibility with all the existing code written for those platforms, which would negate the entire point of the exercise.
  - smnthermes 7y ago
    > all of which were designed back in the '90s, when we didn't appreciate just how dangerous an environment the Internet could become. No, it was in the 2000's and 2010's. And even more than 10 years ago, people were aware of how Internet can be dangerous, as shown by Internet Explorer. Moreover, Firefox had sandboxing before Chrom* and Electrolysis: 1. https://developer.mozilla.org/en-US/docs/Archive/Add-ons/Security_best_practices_in_extensions https://developer.mozilla.org/en-US/docs/Archive/Add-ons/Sec... 2. https://developer.mozilla.org/en-US/docs/Archive/Add-ons/Displaying_web_content_in_an_extension_without_security_issues https://developer.mozilla.org/en-US/docs/Archive/Add-ons/Dis... 3. https://developer.mozilla.org/en-US/docs/Archive/Add-ons/Interaction_between_privileged_and_non-privileged_pages https://developer.mozilla.org/en-US/docs/Archive/Add-ons/Int...
    - duskwuff 7y ago
      The "sandboxing" you're referring to was very limited in scope. It essentially amounted to not giving content scripts any references to non-content objects like the browser chrome; poorly written extensions often broke this "sandbox", and it provided no protection whatsoever against browser exploits -- any arbitrary code execution exploit would allow an attacker to run unrestricted code on the user's system.
theNewMicrosoft 7y ago
> My suspicion is that, when Pale Moon asks you not to use Web Components, they're doing so because their engine is old Your suspicion is entirely wrong. 1: https://forum.palemoon.org/viewtopic.php?t=22270 https://forum.palemoon.org/viewtopic.php?t=22270 2: https://forum.palemoon.org/viewtopic.php?t=22399 https://forum.palemoon.org/viewtopic.php?t=22399
- thih9 7y ago
  > Your suspicion is entirely wrong. In what way? Could someone summarize these sources?
- tialaramex 7y ago
  These are both basically MoonChild saying "it's not true" which doesn't change whether it's true. MoonChild also told everybody that Let's Encrypt is a terrible idea, untrustworthy and nobody should use it. How did that end up? I will give them props for actually doing it (plenty of people went "I'll just fork it" when Mozilla decided to change things but very few of them actually did all the resulting heavy lifting) not just talking about it. That's not nothing, but it doesn't make them right.
- chc 7y ago
  Neither of those really even contradict what smacktoward said, much less disprove it. In those posts, Moonchild disagrees with the idea that Pale Moon is "a rebranded rebuild of an old Firefox version" and more broadly that it corresponds to any particular Firefox version since there has been years of parallel development. He also affirms that Pale Moon has kept up with other browsers in security. It is entirely possible for all of that to be true and for smacktoward's suspicion — that Moonchild's primary problem with Web Components is that they work poorly in Pale Moon and it would be a lot of trouble to fix that — to be true.
  - theNewMicrosoft 7y ago
    > It is entirely possible for all of that to be true and for smacktoward's suspicion — that Moonchild's primary problem with Web Components is that they work poorly in Pale Moon and it would be a lot of trouble to fix that — to be true. It is not true for the simple fact that the next milestone release (v29) of pale moon will support WebComponents > Neither of those really even contradict what smacktoward said, much less disprove it. smacktoward repeats the same tired oversimplifications that PM is just "rebased itself on mainline Firefox circa Firefox 52" both my links prove that the above statement is fundamentally wrong.
dessant 7y ago
Some of my browser extensions depend on querying the DOM, and I'm also worried about not being able to fully inspect web pages that use closed shadow root elements.
- evilpie 7y ago
  WebExtension in Firefox get access to open and closed shadow roots: https://developer.mozilla.org/en-US/docs/Web/API/Element/openOrClosedShadowRoot https://developer.mozilla.org/en-US/docs/Web/API/Element/ope.... I think there are open bugs for some further improvements.
cameronfraser 7y ago
It doesn't make sense to me to ask developers to not use a newer technology that can make their lives easier and affect bottom lines for business just so we can accommodate a single project with likely a very small set of users. I'm surprised they would even think that is an OK thing to ask.
- gerikson 7y ago
  Anyone can write an open letter. Whether somone acts on that is another matter.
- lukifer 7y ago
  Reminds me of the invocations of old to ensure that websites support disabling Javascript, and/or text-only browsers like Lynx. While there are those who still (understandably) want these things, I think we all realize it's largely a lost cause at this point.
  - bronipstid 7y ago
    Google, Microsoft, Apple and even Firefox have an incentive to reduce competition by making the web as complex as possible. If the web is to be free, it must be radically simplified. To call that a lost cause is just a self-fulfilling prophesy.
    - lukifer 7y ago
      I don't disagree (although I'd be curious to hear your rationale on Mozilla; their incentives are... curious). I suppose what's hard to not view as a lost cause is the idea that accessibility to non-JS/Lynx/etc is best-practice or the default. But there are counter-examples of less-is-more good citizens (Craigslist and HN itself come to mind). As flawed as browsers (and their vendors) may be, I come at it from the other direction: from the perspective of end-user adoption, the open web and federated email are our last two bastions of open computing ecosystems of any kind, holding back the tide of walled-garden apps and clouds and such from taking over completely. While radically-simple "good citizens" of the open web may not be the norm, at least they're possible, which can't exactly be said for the computer-as-appliance model.
jolmg 7y ago
> My suspicion is that, when Pale Moon asks you not to use Web Components, they're doing so because their engine is old They address this: > Full disclosure: While it is absolutely true that it is in our direct interest that web developers don't use something we are still working on implementing ourselves (considering our limited capacity as a smaller non-profit community, which is likely the same for any other true Open Source/Libre projects out there), the impact of what is outlined above is much more far-reaching than just our own projects; not only is it pushing for a proprietary web that is vendor-locked, it also, as stated, becomes something that will be impossible to archive, save or process. So, yeah, they have special interest, but that doesn't take away from their point.
- eropple 7y ago
  It takes away from the point when it's untrue. Web Components is a standard. Multiple implementations exist. They don't have one and are sore.
  - jolmg 7y ago
    This isn't the first time the topic of browser monoculture has been brought up. Why does it matter that it was Pale Moon that brought it up this time? If I or anyone else would have written the post instead of them, would then people focus on the issue instead of on who brought it up? > It takes away from the point when it's untrue What exactly are you saying is untrue? Can you quote the part? There are comments[1] right in this same thread that confirm Pale Moon's statements about the inability to save or archive pages. > Web Components is a standard. Multiple implementations exist. Are you sure it's not Google that's controlling what's to become "standard" and Firefox that chases after them? And I say Firefox specifically, because, besides Safari, they seem to be the only other implementation on the market. Edge uses Chrome's engine. Indeed, with Chrome's 64% in market share[2], anything they do becomes "standard" automatically. With Firefox's 4.5%, I don't think they can do anything but chase after the Chrome guys to wherever they decide to take the web. Isn't the point of a standard to help foster a rich ecosystem of diverse, interoperable implementations? I feel that a standard that evolves too fast (as made possible by an implementation monoculture) fails at fostering one. This is what I believe Pale Moon is getting at when they say: > The more additional "features" are tacked on to these components, the less likely it is for non-Google clients to be able to display sites in full or properly. It gets harder and harder to make a new web engine from scratch. It's a step backwards from gaining a more diverse browser ecosystem. The fact that Web Components specifically makes it harder to parse content (for archival or indexing purposes, etc.) is a separate issue, and for it, it doesn't matter if it's standard. In fact, it makes it worse. [1] https://news.ycombinator.com/item?id=22605069 https://news.ycombinator.com/item?id=22605069 [2] https://gs.statcounter.com/browser-market-share https://gs.statcounter.com/browser-market-share

Hokusai 7y ago

Other way of looking at it is that google is the new Microsoft and play the Embrace, extend, and extinguish game. You are attacking the post ad hominem. But, your comment does not change the validity original argument. I’m interested in knowing your opinion about the arguments, thou.

AnarchistNode7 7y ago

Well, if I as developer would realize that i pose my users under certain risk and i am unable to do anything about it, then the only logical and morally correct option would be, to tell that my users and cease operation. Everything else is selfish and delusional!

smacktoward 7y ago
I tend to agree, but if the Pale Moon developers agreed they would have shut the project down long ago. The legacy APIs they're clinging to are loaded with security risks -- that's part of why Mozilla ditched them in the first place. And there's not much evidence that Pale Moon et al. are doing anything substantial to remove or mitigate them.
laurent123456 7y ago
Yes sounds like they should just cut their losses. They gave it a try and discovered you can't maintain a fork of a browser that easily.
LordLestat 7y ago
It is up to the user to decide WHAT they want to use. If they want to use something with features, then YES THEY CAN! Demanding that a product you do NOT like or HATE should cease their activity.. this is dictatorship! Leftist fanaticism of the worst kind - especially if it is against features. The worst kind of community which is contra-features and contra-choice is Mozilla these days without their origin power-user target-group. Most remaining Mozilla users today are radical left, so is Mozillas management these days.And both have a serious intense hate against features and functions... hate against everything which is against conformity.
- tensor 7y ago
  The political propaganda in your post, e.g. "radical left", "leftist fanaticism," makes it lose all meaning. Sadly I didn't see a flag button. I would hope that posts like yours are not welcome in a technical discussion.
  - duckMuppet 7y ago
    Resistance is futile. You will be assimilated.
  - rickcrown 7y ago
    There is a difference between discussing something and the fascist haters of customization these days. It is a fact that most people are either using Firefox OR Chrome and sharing such a toxic opinion. And that is not what the right-wing side is spreading, this opinion you can find majority-wise at the left-winger audience. Therefor Lestat is right and this has to be mentioned, as there is zero reason that such disgusting fascism just should not be ignored.

basch 7y ago

They also maintain an in between version. https://www.basilisk-browser.org/ https://www.basilisk-browser.org/

smacktoward 7y ago
If the core problem is that you don't have enough resources to do everything you set out to do, splitting those resources between two separate products doesn't help matters.
- smnthermes 7y ago
  Both browsers use the same platform/rendering engine. Stop spreading misinformation and FUD.
- dirtnugget 7y ago
  Exactly my thought... How is fragmentation exactly gonna help this?

lonelappde 7y ago

How does Pale Moon maintain security for these legacy technologies?

ailideex 7y ago
How do pigs fly?
smacktoward 7y ago
I'm not sure they could, even if they wanted to. The security problems with those technologies aren't due to implementation goofs. They're fundamental issues with the design of those platforms, all of which were designed back in the '90s, when we didn't appreciate just how dangerous an environment the Internet could become. There's no way to fix issues that run that deep without breaking backwards compatibility with all the existing code written for those platforms, which would negate the entire point of the exercise.
- smnthermes 7y ago
  > all of which were designed back in the '90s, when we didn't appreciate just how dangerous an environment the Internet could become. No, it was in the 2000's and 2010's. And even more than 10 years ago, people were aware of how Internet can be dangerous, as shown by Internet Explorer. Moreover, Firefox had sandboxing before Chrom* and Electrolysis: 1. https://developer.mozilla.org/en-US/docs/Archive/Add-ons/Security_best_practices_in_extensions https://developer.mozilla.org/en-US/docs/Archive/Add-ons/Sec... 2. https://developer.mozilla.org/en-US/docs/Archive/Add-ons/Displaying_web_content_in_an_extension_without_security_issues https://developer.mozilla.org/en-US/docs/Archive/Add-ons/Dis... 3. https://developer.mozilla.org/en-US/docs/Archive/Add-ons/Interaction_between_privileged_and_non-privileged_pages https://developer.mozilla.org/en-US/docs/Archive/Add-ons/Int...
  - duskwuff 7y ago
    The "sandboxing" you're referring to was very limited in scope. It essentially amounted to not giving content scripts any references to non-content objects like the browser chrome; poorly written extensions often broke this "sandbox", and it provided no protection whatsoever against browser exploits -- any arbitrary code execution exploit would allow an attacker to run unrestricted code on the user's system.

theNewMicrosoft 7y ago

> My suspicion is that, when Pale Moon asks you not to use Web Components, they're doing so because their engine is old Your suspicion is entirely wrong. 1: https://forum.palemoon.org/viewtopic.php?t=22270 https://forum.palemoon.org/viewtopic.php?t=22270 2: https://forum.palemoon.org/viewtopic.php?t=22399 https://forum.palemoon.org/viewtopic.php?t=22399

thih9 7y ago
> Your suspicion is entirely wrong. In what way? Could someone summarize these sources?
tialaramex 7y ago
These are both basically MoonChild saying "it's not true" which doesn't change whether it's true. MoonChild also told everybody that Let's Encrypt is a terrible idea, untrustworthy and nobody should use it. How did that end up? I will give them props for actually doing it (plenty of people went "I'll just fork it" when Mozilla decided to change things but very few of them actually did all the resulting heavy lifting) not just talking about it. That's not nothing, but it doesn't make them right.
chc 7y ago
Neither of those really even contradict what smacktoward said, much less disprove it. In those posts, Moonchild disagrees with the idea that Pale Moon is "a rebranded rebuild of an old Firefox version" and more broadly that it corresponds to any particular Firefox version since there has been years of parallel development. He also affirms that Pale Moon has kept up with other browsers in security. It is entirely possible for all of that to be true and for smacktoward's suspicion — that Moonchild's primary problem with Web Components is that they work poorly in Pale Moon and it would be a lot of trouble to fix that — to be true.
- theNewMicrosoft 7y ago
  > It is entirely possible for all of that to be true and for smacktoward's suspicion — that Moonchild's primary problem with Web Components is that they work poorly in Pale Moon and it would be a lot of trouble to fix that — to be true. It is not true for the simple fact that the next milestone release (v29) of pale moon will support WebComponents > Neither of those really even contradict what smacktoward said, much less disprove it. smacktoward repeats the same tired oversimplifications that PM is just "rebased itself on mainline Firefox circa Firefox 52" both my links prove that the above statement is fundamentally wrong.

dessant 7y ago

Some of my browser extensions depend on querying the DOM, and I'm also worried about not being able to fully inspect web pages that use closed shadow root elements.

evilpie 7y ago
WebExtension in Firefox get access to open and closed shadow roots: https://developer.mozilla.org/en-US/docs/Web/API/Element/openOrClosedShadowRoot https://developer.mozilla.org/en-US/docs/Web/API/Element/ope.... I think there are open bugs for some further improvements.

cameronfraser 7y ago

It doesn't make sense to me to ask developers to not use a newer technology that can make their lives easier and affect bottom lines for business just so we can accommodate a single project with likely a very small set of users. I'm surprised they would even think that is an OK thing to ask.

gerikson 7y ago
Anyone can write an open letter. Whether somone acts on that is another matter.
lukifer 7y ago
Reminds me of the invocations of old to ensure that websites support disabling Javascript, and/or text-only browsers like Lynx. While there are those who still (understandably) want these things, I think we all realize it's largely a lost cause at this point.
- bronipstid 7y ago
  Google, Microsoft, Apple and even Firefox have an incentive to reduce competition by making the web as complex as possible. If the web is to be free, it must be radically simplified. To call that a lost cause is just a self-fulfilling prophesy.
  - lukifer 7y ago
    I don't disagree (although I'd be curious to hear your rationale on Mozilla; their incentives are... curious). I suppose what's hard to not view as a lost cause is the idea that accessibility to non-JS/Lynx/etc is best-practice or the default. But there are counter-examples of less-is-more good citizens (Craigslist and HN itself come to mind). As flawed as browsers (and their vendors) may be, I come at it from the other direction: from the perspective of end-user adoption, the open web and federated email are our last two bastions of open computing ecosystems of any kind, holding back the tide of walled-garden apps and clouds and such from taking over completely. While radically-simple "good citizens" of the open web may not be the norm, at least they're possible, which can't exactly be said for the computer-as-appliance model.

jolmg 7y ago

> My suspicion is that, when Pale Moon asks you not to use Web Components, they're doing so because their engine is old They address this: > Full disclosure: While it is absolutely true that it is in our direct interest that web developers don't use something we are still working on implementing ourselves (considering our limited capacity as a smaller non-profit community, which is likely the same for any other true Open Source/Libre projects out there), the impact of what is outlined above is much more far-reaching than just our own projects; not only is it pushing for a proprietary web that is vendor-locked, it also, as stated, becomes something that will be impossible to archive, save or process. So, yeah, they have special interest, but that doesn't take away from their point.

eropple 7y ago
It takes away from the point when it's untrue. Web Components is a standard. Multiple implementations exist. They don't have one and are sore.
- jolmg 7y ago
  This isn't the first time the topic of browser monoculture has been brought up. Why does it matter that it was Pale Moon that brought it up this time? If I or anyone else would have written the post instead of them, would then people focus on the issue instead of on who brought it up? > It takes away from the point when it's untrue What exactly are you saying is untrue? Can you quote the part? There are comments[1] right in this same thread that confirm Pale Moon's statements about the inability to save or archive pages. > Web Components is a standard. Multiple implementations exist. Are you sure it's not Google that's controlling what's to become "standard" and Firefox that chases after them? And I say Firefox specifically, because, besides Safari, they seem to be the only other implementation on the market. Edge uses Chrome's engine. Indeed, with Chrome's 64% in market share[2], anything they do becomes "standard" automatically. With Firefox's 4.5%, I don't think they can do anything but chase after the Chrome guys to wherever they decide to take the web. Isn't the point of a standard to help foster a rich ecosystem of diverse, interoperable implementations? I feel that a standard that evolves too fast (as made possible by an implementation monoculture) fails at fostering one. This is what I believe Pale Moon is getting at when they say: > The more additional "features" are tacked on to these components, the less likely it is for non-Google clients to be able to display sites in full or properly. It gets harder and harder to make a new web engine from scratch. It's a step backwards from gaining a more diverse browser ecosystem. The fact that Web Components specifically makes it harder to parse content (for archival or indexing purposes, etc.) is a separate issue, and for it, it doesn't matter if it's standard. In fact, it makes it worse. [1] https://news.ycombinator.com/item?id=22605069 https://news.ycombinator.com/item?id=22605069 [2] https://gs.statcounter.com/browser-market-share https://gs.statcounter.com/browser-market-share