23 ms·

Porting Firefox to Apple Silicon

644 points by sylvestre 6y ago

loufe 6y ago
We talk often on this forum of how innaccessible giants like Google and Amazon are for the little guy. I thus found this point particularly interesting: >"Attempts to contact the vendor through regular support channels were unsuccessful so we ended up searching LinkedIn and managed to find an engineer working on the core antivirus detection. They immediately understood the seriousness of the problem and took prompt action to get a fix shipped, thus preventing quite the disaster for the users of this product. It’s notable that without this last-ditch effort we would have been effectively blocked from releasing a native Apple Silicon version for an indefinite period."
- bluedino 6y ago
  If Mozilla can’t get a hold of anyone... 20 years ago Google would have sent someone to Mozilla HQ for a week to work on stuff
  - OnlyMortal 6y ago
    Apple did this when transitioning from CodeWarrior to the GNU chain. Apple had to apply patches to the C++ compiler for the company I was at.
    - zerkten 6y ago
      This is surprisingly common for large companies. It often isn't formalized because no one wants to dedicate engineers to going onsite with customers. Often the expert is too valuable to give up, or is a poor choice for customer engagement. If you have a consulting team, they may lack the experience needed, or reputation, that the customer wants. As soon as you send the expert onsite, you will have a challenge not sending them at a later time. This scares off engineering managers from lending their engineers because inevitably they have to fight off the requests. The better workflow is one where you can send a less expensive resource (however you measure it) onsite and have them work remotely with the expert. If you can stick with that you often end up with the onsite person leveling up their skills and the ability to re-engage in a scalable manner. Any engagement needs prep before the onsite, a plan for escalation when onsite, and a disengagement plan.
      - OnlyMortal 6y ago
        It was Agfa in Antwerp. Their guy was very polite but I had to explain to him what was going wrong. I think he was more tech support than anything else. Edit: Apple also had to change the linker for the sake of Macromedia’s monolithic applications. Another story though.
  - vlovich123 6y ago
    This is the problem with jumping to conclusions from a vague excerpt. The vendor is some random anti-virus vendor and if you know what trying to get a handle there means.... > More of a concern was user reports that some antivirus software was flagging all our Universal Binaries as malware, and corrupting the Firefox installation the moment the update arrived. > The software was using machine learning techniques and presumably observed that our combined Universal Binaries didn’t quite look like any other legitimate software it had ever seen before. > Attempts to contact the vendor through regular support channels were unsuccessful so we ended up searching LinkedIn and managed to find an engineer working on the core antivirus detection.
    - rebelwebmaster 6y ago
      It was Cylance made by Blackberry.
      - mlyle 6y ago
        I had an awful experience with Cylance and some open source software I maintained, too-- false positive detections, and they wouldn't fix it.
      - cozzyd 6y ago
        Their website is... blech.
- deleted 6y ago
  [deleted]
- dubcanada 6y ago
  Obviously there is more to it then what I am going to say, and who knows with remote workers where people are. But Apple and Mozilla headquarters are 5 miles apart (roughly). Couldn't you just walk/drive/scoot/fly/what ever over and talk to someone?
  - dak1 6y ago
    It sounds like this was an issue with an independent antivirus vendor, not Apple.
  - milkytron 6y ago
    I'd imagine that security and the front desk are going to prevent anyone from entering to meet with specific teams or individuals without an appointment. If you knew someone and had scheduled time with them, then yeah I'm sure you could hoverboard your way over.
  - djrogers 6y ago
    Setting aside that the problem with AV had nothing to do with Apple, for the most part nobody was working at either of those offices over the summer (2020, remember?). Also, which of Apple's 130+ Silicon Valley offices are you going to go to, and who do you ask for when you get there?
  - dblohm7 6y ago
    Also, pandemic, remote workers, etc. gcp and the engineers who worked on this do not live in SV.
- jmull 6y ago
  They are being very careful not to identify the anti-virus vendor. So it's hard to tell if the size of the vendor is the issue here.
- selykg 6y ago
  My experience working with antivirus vendors is... not good. Product I used to work on had frequent false positives from antivirus software marking certain files as having some malware or whatever in it. It's super unpleasant trying to get those changes pushed out. Glad that they were able to get some resolution quickly, usually that isn't the case, at least in my experience.
- duxup 6y ago
  I was a back channel route to engineering at a company I worked for a while. A few of the engineers trusted me and a couple select customers / sales guys knew they could come to me to run a bug by me 'in theory' and if we had enough information I could unofficially run it by engineering without going through the song and dance of the typical support channels. I could get a quick ya or nay form them on some things and it was so much faster for everyone involved. If it was a ya, I knew we had something, still more work to do but the case would skyrocket through the usual channels and engineering was engaged and ready. If it was a nay, the usual channels it went and everyone was ok with that. The engineers would give me a few minutes knowing I wasn't going to bring them poorly thought out garbage, I would limit the rate of these special situations, and special customers / sales guys could get the job done way faster. It was a well known process by those who knew about it... but not everyone knew.
  - anonymouse008 6y ago
    That sounds like a dream career -- any advice getting there when you've hacked on graveyard startups most your life?
    - duxup 6y ago
      It wasn't an official job. I was a regular support drone as far as anyone knew. I just had some connections that came about because I could be discrete and the engineers understood that I didn't bring them garbage too early (without enough information) or without good reason.
      - macksd 6y ago
        And this is why it's important to recognize and retain people who get the right things done. One does not simply backfill a support position and replace someone who has built up the internal AND external reputation and relationships required for issues like this to get fast-tracked and fixed in a way that makes everyone happy.
    - dingaling 6y ago
- meibo 6y ago
  The antivirus industry is the biggest player of the modern adware/malware crisis. The dark patterns used in software like AVG and avast, both making every system I see them on so slow that they might as well be unusable, are all focused on getting more installs, be it to force people into getting whatever "premium" subscription or harvesting data(e.g. attaching themselves to every sent email like a virus). There are very few that I could actually recommend, like Malwarebytes - for most users, Windows Defender will be more than enough nowadays. I haven't used a mac in a while, do you actually need AV on them today?
  - sjg007 6y ago
    I mean there is mac malware and some of it is quite sophisticated. The compiled apple script bitcoin miner being one of the more ingenious ones. But those were distributed through pirated applications. There are probably a few zero days as well that maybe an AVE package could help stop if a signature is rapidly distributed. Ignoring the fact that the AV engine itself is a target too. Most people using only the app store helps cut that down.
    - wlesieutre 6y ago
      The one in recent memory for me is the KeRanger ransomware that was distributed in the official Transmission installer. https://unit42.paloaltonetworks.com/new-os-x-ransomware-keranger-infected-transmission-bittorrent-client-installer/ https://unit42.paloaltonetworks.com/new-os-x-ransomware-kera... >Transmission representative John Clay told Reuters via email that the ransomware was added to disk-image of its software after the project's server was compromised in a cyber attack. >"We're not commenting on the avenue of attack, other than to say that it was our main server that was compromised," he said. "The normal disk image (was) replaced by the compromised one."
      - setpatchaddress 6y ago
        Just to answer the original question: that's an example of something Apple handled -- no external AV required.
- robin_reala 6y ago
  I guess this was Cylance: I ran into this one on my work laptop with Firefox Nightly and managed to get it escalated internally from us too.
- ksec 6y ago
  >It’s notable that without this last-ditch effort we would have been effectively blocked from releasing a native Apple Silicon version for an indefinite period." And they are Mozilla. Imagine Indies. The Modern Day Apple requires you to get some Mainstream Media publish about How Apple block Open Sources Software to be running on M1 before Apple saw the PR damage and start acting on it.
  - mlyle 6y ago
    This was about Cylance being jerks, not Apple. I've fought Cylance quite a bit on Windows for flagging open source software as malware, too (and they fail to respond / fix).
    - account42 6y ago
      So what do you do if an antivirus vendor is uncooperative? Can you sue them for defamation?
      - mlyle 6y ago
        Give up on your open source project, in my case.
- e40 6y ago
  This really bugs me about Apple. We had the DTK (pre-release hardware for the M1). We got into trouble with an upgrade from beta2 to beta10 and the machine was bricked. Everywhere we turned, we were told to use the developer forums. We did. There were no responses there and I didn't see anyone but customer helping customers. So, since we're an Apple developer, we decided we would use one of our DTS (developer technical support) tickets. Nope. Pre-release anything is not supported. So, we ended up waiting for release, bought a new M1 mini and then started our porting effort. Then, we ran into problems and used one of our DTS incidents and we got some help. However, we lost months.
  - deleted 6y ago
    [deleted]
  - jarjoura 6y ago
    beta 10 also bricked my DTK unit as well. Total paper weight
  - saagarjha 6y ago
    I don't have a bricked DTK, but the last seven builds or so kernel panic every few hours of use. It's kind of sad to see where the program is now…
- gigatexal 6y ago
  It's not like Mozilla is a nobody software outfit. For this to be what they had to do go get someone's attention at Apple is terrible.
  - lambada 6y ago
    It wasn't Apple they were trying to contact, it was a random anti-virus vendor who were flagging all new Universal Binaries as malware.
    - gigatexal 6y ago
      Doh! My bad
- tyingq 6y ago
  Oh wow. So in this case, a foundation with roughly half a billion in revenue per year is still somewhat of a little guy, at least for the standard process. I'm curious which antivirus vendor it was. Mozilla did eject a few extensions written by antivirus vendors in 2019, probably for good reasons.
- TwoBit 6y ago
  AV vendors and software are cancer.
- dpkonofa 6y ago
  I'm not sure I follow. Why would an anti-virus product accidentally flagging their Universal Binary block them from releasing a native Apple Silicon version? Of all the Macs in use, I'd have to imagine that only a small percentage are using that specific anti-virus software much less any anti-virus software at all. It might cause them some headaches with specific people who are using that software but why extend that all the way to blocking the release indefinitely?
- drewg123 6y ago
  I was doing Mac drivers about a decade ago, and some of the dumbest and most ignorant questions on the kernel and drivers mailing lists came from A/V folks. Things like "my machine locks up when our software does X", where it was clear that X was blocking the entire kernel waiting for a userpace thread. Ugh. I've resolved to never, ever run A/V software on any machine I control based on the quality of those devs.
  - slim 6y ago
    because A/V folks are hackers, not engineers. hackers do impressive things without reading the fucking manual. that's why they can break seemingly unbreakable things. but on the surface, to the engineer, they seem uncompetent.
  - 2Gkashmiri 6y ago
    how do you "secure" machines if they are windows ones and dumb people plugin flash drives and click on big shiny download ram buttons. genuinely curious.
    - icebraining 6y ago
      One way to do it is to whitelist all binaries in the system, and sandbox all applications (to prevent chances of a malicious PDF/image/etc abusing a buggy application).
      - 2Gkashmiri 6y ago
        can you do that on windows? every single exe, every process?
        icebraining 6y ago
        Yeah, the security policies let you do that. I think the current mechanism is called AppLocker. Note that there may be still ways to bypass it if you're an attacker sitting at the computer, rather than a hapless user.
- GekkePrutser 6y ago
  Even working for a big multinational with a big tailored support contact, support from our major IT services vendor is abysmal. It's not just the little guys that have trouble.
- ttflee 6y ago
  The issue itself sounds like a prologue for an A.I. dystopian story.
- oauea 6y ago
  Surprising they even went through with that. Personally I'd have said fuck it, blamed Apple and moved on with my life. If Apple wants to create incompatible hardware, let them put the effort & money into fixing the software, if they want the software on their platform.
  - m_st 6y ago
    Though I get your point, in this particular case it was the antivirus company that was the problem. Not Apple.
- m_st 6y ago
  I once did the same with Microsoft Windows 8 (or 8.1) keyboard layout changes breaking old software. You'd think they don't suddenly change from '.' to ',' as decimal separator. But that's what they did. And so did Apple more years ago by the way, even resulting in a calculator that couldn't be used anymore with the numeric keypad. Anyway, found a guy working on keyboard layout stuff at Microsoft through LinkedIn as the other support channels were non-responsive. Unfortunately he just confirmed the change if I remember correctly. But at least we knew what was coming.
CyberRabbi 6y ago
Is “apple silicon” the port job here? Isn’t this more correctly described as a port of their existing ARM64 target to macOS?
- jfk13 6y ago
  Firefox on iOS is based on the system's Webkit engine; Firefox elsewhere is built on Gecko, so there's a vast difference in the codebase involved.
- nguyenkien 6y ago
  iOS browser is just Safari reskin (with different sync)
- skrowl 6y ago
  On iOS there are no web browsers other than Safari, per the app store rules. "Chrome" / "Firefox" / etc on iOS are just basically skins on top of Webkit. See 2.5.6 here - https://developer.apple.com/app-store/review/guidelines/ https://developer.apple.com/app-store/review/guidelines/ This is why you don't get any of the features / extensions / etc of Chrome or Firefox on iOS. Apple does this so that the mobile web can never replace apps that they have a monopoly on and get a % from. If you could just visit netflix.com and have it install a Netflix SPA that worked as well as the native app, why would you ever install the native app? Edit after reading replies - lol, that programming of Apple users to believe "we need an app for every possible site".
  - coldtea 6y ago
    >Apple does this so that the mobile web can never replace apps that they have a monopoly on and get a % from Or you know, because they disallow dynamic code execution of arbitrary downloaded code in apps, and JIT JS compilers do just that. >If you could just visit netflix.com and have it install a Netflix SPA that worked as well as the native app, why would you ever install the native app? It's like asking "why would you ever use a native app". Because it's faster, native, and much more convenient? Take the best desktop browser engine, e.g. Chrome, and put it inside a mobile browser app. Still, I (and most I guess) wouldn't use it to watch Netflix over individual apps.
mugivarra69 6y ago
does firefox use llvm to compile ?
- sylvestre 6y ago
  Yeah, clang for all platforms for a couple years now
  - vetinari 6y ago
    Some Linux distributions, like Fedora, build their Firefox binary with gcc.
    - sylvestre 6y ago
      Yeah but this will probably change too.
      - Vogtinator 6y ago
        I hope not, we need diversity. (Yes, also more rust compilers)
        sylvestre 6y ago
        We will still have jobs to build Firefox with gcc and gcc is not going anywhere in general: the % of package built with clang in Debian/Ubuntu is a fraction compared to gcc. Nathan Froyd wrote this great blog post about compiler usage: https://blog.mozilla.org/nfroyd/2018/05/29/when-implementation-monoculture-right-thing/ https://blog.mozilla.org/nfroyd/2018/05/29/when-implementati...
- gspr 6y ago
  Yes. There are essential Rust components in Firefox, and the only serious Rust compiler uses LLVM. (This has nothing to do with clang as someone else suggests)
  - 6y ago
r00fus 6y ago
> The Apple Silicon chips are one of the first desktop chips that are a heterogeneous design with distinct performance and efficiency cores. We’re revising much of our core threading and thread pooling architecture to handle the distinction better, improve efficiency, and eventually be able to schedule less performance-critical tasks on the efficiency cores. I found this bit interesting. Likely more prevalent in mobile apps, but perhaps shifting desktop code to Big.Little approach and using core affinity will result in a lot less wasted energy.
brundolf 6y ago
> If the user visits such a site, Firefox will automatically download and install such a proprietary EME/CDM module. This presented a problem to us as we would be dependent on those third-party vendors to publish ARM64 versions of those decoders. Wait, modern browsers still download and run native binaries at the request of certain sites? How is this different from the days when native plugins like Flash were massive security liabilities? I thought we didn't do that anymore?
- Gaelan 6y ago
  As I understand it, it's a single trusted binary (Google's Widevine), not arbitrary binaries from sites, so I doubt it's a huge security liability. Not to discount all the other problems with DRM on the web, of course.
  - dblohm7 6y ago
    This is correct. These binaries are downloaded from specific update servers. EDIT: I stand corrected thanks to a colleague on the media team: the EME CDM update servers are known Google servers.
  - padenot 6y ago
    The above is correct. The CDM is very heavily sandboxed, a signature is used, and therefore it can't really do anything apart from what it's supposed to do (which is very little, taking encoded data, a key, decode media). Source: I'm on that team, but I don't work directly on this.
  - mortenjorck 6y ago
    Worth mentioning is that this is also solving a different problem from the old browser plugin ecosystem. Rather than enabling third parties to extend browser functionality, this exists exclusively to partition the open-source Firefox codebase from closed-source DRM code, a workaround to enable DRM playback in an open-source browser.
  - azalemeth 6y ago
    This is correct. I still think the "best" answer is to untick the box that says "Play DRM Content" in the Firefox preference panes, and refuse to support corporations that would otherwise use it. I haven't bought DRM media for over fifteen years.
green-bottle 6y ago
A bit tangential to the main topic of the post. They mention that they are working on another optimizing compiler Ion which will replace the cranelift compiler (which is still in nightly) as the new compiler for WebAssembly. They link the issue [1] tracking the change which also speaks about disabling cranelift. To my knowledge cranelift was made for the purpose of compiling WebAssembly in Firefox, so I am not sure if I am missing something here (it's not yet production ready maybe). The Cranelift README[2] mentions that it will be a backend for IonMonkey. I am a complete layman here so I am curious if someone here has a better understanding. [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1687626 https://bugzilla.mozilla.org/show_bug.cgi?id=1687626 [2] https://github.com/bytecodealliance/wasmtime/tree/main/cranelift https://github.com/bytecodealliance/wasmtime/tree/main/crane...
- kibwen 6y ago
  > They mention that they are working on another optimizing compiler Ion which will replace the cranelift compiler (which is still in nightly) as the new compiler for WebAssembly. Ion (nee IonMonkey) predates Cranelift, being the natural evolution of Mozilla's previous SpiderMonkey JITs. From your link: "Prototyping work (bug 1678097) has demonstrated that Ion can generate good code quickly for wasm on ARM64, and given that Ion has good stability and we know it well, we will ship it as the initial optimizing compiler for wasm on that platform." The keyword being "initial"; it appears to just be saying that Ion is good enough to enable, with support for Cranelift being retained in the event that it ever surpasses IonMonkey in capability.
- twic 6y ago
  I think the situation is: Cranelift - experimental, quick to port Ion - production, slow to port So Firefox on Apple Silicon got Cranelift first, but only in nightlies, and will soon get Ion in release builds - "become the new default" means it will replace the baseline compiler.
- IainIreland 6y ago
  (I work on SpiderMonkey.) Cranelift was originally started as a project to make a new backend for wasm in SpiderMonkey. It took on a life of its own, and has been transferred by the Bytecode Alliance (which Mozilla is a part of). At the moment it's not mature enough for us to use in production (both in terms of performance and in terms of code churn). We're hopeful that will change over the next few years, but we need to ship wasm support now, so we're sticking with our existing backend. (We intend to keep Cranelift working behind a compile-time flag.)
kevincox 6y ago
I'm surprised that Rosetta 2 isn't installed by default. It seems that for the next couple of years the vast majority of people will need at least one x86 app. I guess split-architecture applications were also not foreseen as it is clear that the auto-install prompt doesn't work very well in that case.
- cududa 6y ago
  I wonder if it has anything to do with licensing costs of everything that went into Rosetta? I imagine they owe someone royalties and licensing costs on some components in it, saves some pennies to dollars to only install it as needed
  - SloopJon 6y ago
    Could be. I suspect that's a factor in the fonts available for download or document support in Catalina and Big Sur: https://support.apple.com/en-us/HT210192 https://support.apple.com/en-us/HT210192 https://support.apple.com/en-us/HT211240 https://support.apple.com/en-us/HT211240
- kitsunesoba 6y ago
  Feels like a bit of a nudge to developers to not take x86 compatibility for a given… kind of, "it's there if it's truly necessary, but you really should port that plugin/daemon/etc".
  - kevincox 6y ago
    I suspect this as well. But it seems so obvious that it is necessary for a while that I doubt that anyone takes it seriously.
    - geerlingguy 6y ago
      I believe the Mac OS Classic environment wasn't installed by default in the early OS X days.
masklinn 6y ago
> Apple introduced a translation cache that likely removes this overhead completely for most applications but it does not work for code that is output by a JIT. With the native build, this second translation is avoided completely and we’re back to having a snappy browser. Indeed while Rosetta does have support for JITs (which is really impressive in and of itself), every piece of machine code generated by the JIT has to be translated on the fly. While the hiccup at the initial run is not too costly / annoying for a regular application being AOT-compiled in its entirety and Apple can then shove the result somewhere nearby, for a JIT it's basically constant, continuous overhead which can't be cached because it won't be around next run. I'm not surprised that the gains are significant there.
deleted 6y ago
[deleted]
shrimpx 6y ago
FYI you still cannot get a full native experience with Chrome and Firefox, due to plugins that have not been ported. For example Chrome ships with an x64 version of Widevine, a plugin that is required to watch live streams on YouTube TV (and perhaps other services with live TV). Currently, YouTube TV does not work natively in Chrome or Firefox. All that said, it will work fine if you run Rosetta -- the x64 decoder will run in Rosetta.
- bla3 6y ago
  The post talks about this in some length.
markdog12 6y ago
Got a kick out of one of the bugzilla links: https://bugzilla.mozilla.org/show_bug.cgi?id=34572 https://bugzilla.mozilla.org/show_bug.cgi?id=34572 "Use native context menus on Mac OS" "Opened 21 years ago"
- bombcar 6y ago
  Wow - that bug can now legally drink in all 50 states!
  - saagarjha 6y ago
    Not until April 5th.
  - nichos 6y ago
    But it can go to war and get married the past 3 years!
- partlysean 6y ago
  It’s little things like this that keep me from using Firefox. Context menus, various micro-interactions, visual design decisions—they all feel so non-native.
  - cle 6y ago
    I don't really care much about the native menus, but the non-native scrolling in Firefox drives me nuts. Granted neither of these are deal breakers for me. I don't use Firefox b/c of pretty context menus.
  - SulfurHexaFluri 6y ago
    I'm using firefox on macos right now and I can't see what the issue is. The the menus show up in the main top bar like every other app. Am I missing something?
    - ianlevesque 6y ago
Toutouxc 6y ago
> It’s notable that without this last-ditch effort we would have been effectively blocked from releasing a native Apple Silicon version for an indefinite period. Effectively blocked from releasing it for the single-digit-percentage of people who run an antivirus on a Mac. Does anyone have credible numbers on this?
- dilly_li 6y ago
  i.e. all the folks who are using a macbook from work -- I don't think that's a small fraction.
- terhechte 6y ago
  The IT department at the place where I work installs antivirus on all Macs. I’d guess it is the same at most bigger corporations
  - dpkonofa 6y ago
    Doesn't that assume that all these IT departments and corporations are using the anti-virus software in question? I feel like most AV software vendors were aware of the ARM transition and would know to look for the new Universal Binaries...
  - msh 6y ago
    But was it not just a specific product?
    - rockdoe 6y ago
      How many anti-viruses for macOS are there exactly? If it's the most popular one (whatever that is), it probably doesn't change much about the problem.
- rkangel 6y ago
  They can't selectively release Firefox. If 5% of machines have AV, then the new version of Firefox wouldn't have worked for 5% of machines. That's far too high a failure rate to release.
ed25519FUUU 6y ago
> Rust in particular was a concern. Firefox depends on Rust code, and we require a working Rust compiler to build the browser. Although Apple Silicon support for Rust was underway, it took until mid-August for there to be functional compiler builds, which limited the amount of progress possible for Firefox. Lack of rust support for 64-bit ARM was a bit surprising to me, especially given the velocity in which people have been rewriting certain components in Rust. Take for example ffmpeg failing to compile because librsvg was rewritten in rust: https://trac.macports.org/ticket/61668 https://trac.macports.org/ticket/61668
- steveklabnik 6y ago
  It has gotten significantly better recently, with Arm themselves pitching in.
- CameronNemo 6y ago
  Pretty sure Rust has supported aarch64 Linux targets for ages. It is just aarch64 Darwin/macOS target support which needed to be added.
- saagarjha 6y ago
  And in turn this blocks a large Swift app I work on from shipping Apple silicon support…software dependency chains can be brutal.
liquidify 6y ago
Love you firefox. Keep fighting the good fight. Keep that budget figured out.
fernly 6y ago
What an interesting and informative article! Nicely done!
pixelpoet 6y ago
Oh hey, the author is also the guy who developed the amazing open source AlphaGo reimplementation Leela Zero: https://en.wikipedia.org/wiki/Leela_Zero https://en.wikipedia.org/wiki/Leela_Zero
jonny383 6y ago
I wonder if Mozilla regrets laying off 25% of their engineering team [0] given their rapidly declining browser market share [1], and their rapidly declining performance. Not to mention their forced adoption of the new Firefox on Android which disables all add-ons except Mozilla approved ones, despite their promises to correct this [2]. Mozilla _used_ to be about open internet and security, but that's just a false pretense at this point [3][4]. I believe it's time to embrace Chromium / Blink, throw away the idea of internet freedom and just use the best performing browser of the week. [0] https://thenextweb.com/insights/2020/08/11/mozilla-firefox-layoffs-250-employees/ https://thenextweb.com/insights/2020/08/11/mozilla-firefox-l... [1] https://en.wikipedia.org/wiki/Usage_share_of_web_browsers https://en.wikipedia.org/wiki/Usage_share_of_web_browsers [2] https://www.androidpolice.com/2020/09/03/firefox-update-faces-backlash-due-to-missing-features-and-few-supported-extensions/ https://www.androidpolice.com/2020/09/03/firefox-update-face... [3] https://blog.mozilla.org/blog/2021/01/08/we-need-more-than-deplatforming/ https://blog.mozilla.org/blog/2021/01/08/we-need-more-than-d... [4] https://www.theverge.com/2017/12/16/16784628/mozilla-mr-robot-arg-plugin-firefox-looking-glass https://www.theverge.com/2017/12/16/16784628/mozilla-mr-robo...
- roca 6y ago
  Nice trolling. You can use general extensions on Android in Nightly, so this is in progress: https://blog.mozilla.org/addons/2020/09/29/expanded-extension-support-in-firefox-for-android-nightly/ https://blog.mozilla.org/addons/2020/09/29/expanded-extensio... But sure, if you want to "throw away the idea of internet freedom" then that's your choice.
  - fwn 6y ago
    Not the parent but just to clarify: The ability to install non-store extensions got completely removed on Firefox for Android and there is (AFAIK) no hint at whether it will ever reappear. That's pretty frustrating and clearly not a win in internet freedom. Store extensions can be used if you create a Firefox account and use their Nightly, which is really hard to justify, IMO. To me it looks like they wanted to push their account numbers and I have great difficulties to find any potential hidden greatness in this policy.
fomine3 6y ago
For who curious, the antivirus that caused problem looks like Norton 360. https://bugzilla.mozilla.org/show_bug.cgi?id=1682834#c39 https://bugzilla.mozilla.org/show_bug.cgi?id=1682834#c39
johndoe42377 6y ago
What porting? Isn't C++ the most portable language in existence? Oh, there is also Rust. But isn't it just uses an LLVM codegen, same as Swift or clang? So, there is Rust's stdlib. Seems like these abstractions are not exactly zero-cost?
- spijdar 6y ago
  > But isn't it just uses an LLVM codegen, same as Swift or clang? It's more complicated than that. I've been involved in a project (bootstrapping little-endian 32 bit PowerPC on linux) which needed a rust port. I didn't work on that, but from what I saw, it's at best a major nuisance, possibly a nightmare when something breaks. This may be a bad example since darwin/aarch64 is a more sane target, but still. ;-) More importantly I guess, Firefox has some reeeeaally old platform specific cruft and some really rusty (hah!) ABI-glue stuff lying around. Stuff like the Netscape Portable Runtime. There's still code in Firefox from back when it ran on HP PA-RISC. There's even code for IBM Z mainframes in there. Really glossing over details, but there are some inner mechanisms that are very platform specific and need at least some custom code for each OS + CPU combo.
MrBuddyCasino 6y ago
> The Apple Silicon chips are one of the first desktop chips that are a heterogeneous design with distinct performance and efficiency cores. We’re revising much of our core threading and thread pooling architecture to handle the distinction better, improve efficiency, and eventually be able to schedule less performance-critical tasks on the efficiency cores. Isn't this at the wrong abstraction level? I would expect this to be a job for the OS scheduler.
- kzrdude 6y ago
  the application knows the tasks better than the OS?
  - MrBuddyCasino 6y ago
    The OS already needs to properly schedule tasks of different load intensities and match them to the available cores, which might already be running different processes. An application has strictly less visibility into whats going on overall in the system, what else is using resources etc., so I don't see how it can decide any better? All it needs to do is set the proper priorities, so the OS scheduler knows whats more important.
    - rockdoe 6y ago
      If you read the linked bug, isn't that exactly what's being proposed: https://bugzilla.mozilla.org/show_bug.cgi?id=1678083#c3 https://bugzilla.mozilla.org/show_bug.cgi?id=1678083#c3
wooger 6y ago
Wait, what? People run anti-virus on Macs? What proportion of the userbase is this? It's good to hear from Mozilla doing some browser developmenmt, and not making bizarre political announcements that an authoritarian shutdown of a social network by a cartel of tech giants is "not enough".
- EE84M3i 6y ago
  Many enterprises require some form of anti-virus on all endpoints, including macs.
chris_wot 6y ago
As they linked to the LibreOffice bug that we hit,[1] it might be worthwhile explaining how the cross platform architecture works in LibreOffice. The widgeting/graphics library is actually run by something called VCL (the Visual Component Library). It's a bit of a mess to be honest, but the simplified version is that there is a class called OutputDevice that the rest of the app uses, which basically acts as a fascade over a platform specific class called SalGraphics (there are a number of other platform specific classes, SalGraphics is what I focus on here). Basically it is a class that implements a bunch of primitive drawing functions which call on abstract functions. We then implement these functions in a platform specific class. To see the guts of the Mac class, see AquaSalGraphics [2] - and no, none of know why it was named "Aqua"... our codebase is old. FWIW, OutputDevice has serious issues. I have detailed them in a mailing list post. [3] 1. https://bugs.documentfoundation.org/show_bug.cgi?id=138122 https://bugs.documentfoundation.org/show_bug.cgi?id=138122 2. https://opengrok.libreoffice.org/xref/core/vcl/inc/quartz/salgdi.h?r=e7ace1d0#133 https://opengrok.libreoffice.org/xref/core/vcl/inc/quartz/sa... 3. https://lists.freedesktop.org/archives/libreoffice/2020-December/086546.html https://lists.freedesktop.org/archives/libreoffice/2020-Dece...
- hutattedonmyarm 6y ago
  > and no, none of know why it was named "Aqua"... our codebase is old. The macOS UI is called Aqua, and has been for quite a while! https://en.wikipedia.org/wiki/Aqua_(user_interface) https://en.wikipedia.org/wiki/Aqua_(user_interface)
- deleted 6y ago
  [deleted]

644 points by sylvestre 6y ago

We talk often on this forum of how innaccessible giants like Google and Amazon are for the little guy. I thus found this point particularly interesting: >"Attempts to contact the vendor through regular support channels were unsuccessful so we ended up searching LinkedIn and managed to find an engineer working on the core antivirus detection. They immediately understood the seriousness of the problem and took prompt action to get a fix shipped, thus preventing quite the disaster for the users of this product. It’s notable that without this last-ditch effort we would have been effectively blocked from releasing a native Apple Silicon version for an indefinite period."

bluedino 6y ago
If Mozilla can’t get a hold of anyone... 20 years ago Google would have sent someone to Mozilla HQ for a week to work on stuff
- OnlyMortal 6y ago
  Apple did this when transitioning from CodeWarrior to the GNU chain. Apple had to apply patches to the C++ compiler for the company I was at.
  - zerkten 6y ago
    This is surprisingly common for large companies. It often isn't formalized because no one wants to dedicate engineers to going onsite with customers. Often the expert is too valuable to give up, or is a poor choice for customer engagement. If you have a consulting team, they may lack the experience needed, or reputation, that the customer wants. As soon as you send the expert onsite, you will have a challenge not sending them at a later time. This scares off engineering managers from lending their engineers because inevitably they have to fight off the requests. The better workflow is one where you can send a less expensive resource (however you measure it) onsite and have them work remotely with the expert. If you can stick with that you often end up with the onsite person leveling up their skills and the ability to re-engage in a scalable manner. Any engagement needs prep before the onsite, a plan for escalation when onsite, and a disengagement plan.
    - OnlyMortal 6y ago
      It was Agfa in Antwerp. Their guy was very polite but I had to explain to him what was going wrong. I think he was more tech support than anything else. Edit: Apple also had to change the linker for the sake of Macromedia’s monolithic applications. Another story though.
- vlovich123 6y ago
  This is the problem with jumping to conclusions from a vague excerpt. The vendor is some random anti-virus vendor and if you know what trying to get a handle there means.... > More of a concern was user reports that some antivirus software was flagging all our Universal Binaries as malware, and corrupting the Firefox installation the moment the update arrived. > The software was using machine learning techniques and presumably observed that our combined Universal Binaries didn’t quite look like any other legitimate software it had ever seen before. > Attempts to contact the vendor through regular support channels were unsuccessful so we ended up searching LinkedIn and managed to find an engineer working on the core antivirus detection.
  - rebelwebmaster 6y ago
    It was Cylance made by Blackberry.
    - mlyle 6y ago
      I had an awful experience with Cylance and some open source software I maintained, too-- false positive detections, and they wouldn't fix it.
    - cozzyd 6y ago
      Their website is... blech.
deleted 6y ago
[deleted]
dubcanada 6y ago
Obviously there is more to it then what I am going to say, and who knows with remote workers where people are. But Apple and Mozilla headquarters are 5 miles apart (roughly). Couldn't you just walk/drive/scoot/fly/what ever over and talk to someone?
- dak1 6y ago
  It sounds like this was an issue with an independent antivirus vendor, not Apple.
- milkytron 6y ago
  I'd imagine that security and the front desk are going to prevent anyone from entering to meet with specific teams or individuals without an appointment. If you knew someone and had scheduled time with them, then yeah I'm sure you could hoverboard your way over.
- djrogers 6y ago
  Setting aside that the problem with AV had nothing to do with Apple, for the most part nobody was working at either of those offices over the summer (2020, remember?). Also, which of Apple's 130+ Silicon Valley offices are you going to go to, and who do you ask for when you get there?
- dblohm7 6y ago
  Also, pandemic, remote workers, etc. gcp and the engineers who worked on this do not live in SV.
jmull 6y ago
They are being very careful not to identify the anti-virus vendor. So it's hard to tell if the size of the vendor is the issue here.
selykg 6y ago
My experience working with antivirus vendors is... not good. Product I used to work on had frequent false positives from antivirus software marking certain files as having some malware or whatever in it. It's super unpleasant trying to get those changes pushed out. Glad that they were able to get some resolution quickly, usually that isn't the case, at least in my experience.
duxup 6y ago
I was a back channel route to engineering at a company I worked for a while. A few of the engineers trusted me and a couple select customers / sales guys knew they could come to me to run a bug by me 'in theory' and if we had enough information I could unofficially run it by engineering without going through the song and dance of the typical support channels. I could get a quick ya or nay form them on some things and it was so much faster for everyone involved. If it was a ya, I knew we had something, still more work to do but the case would skyrocket through the usual channels and engineering was engaged and ready. If it was a nay, the usual channels it went and everyone was ok with that. The engineers would give me a few minutes knowing I wasn't going to bring them poorly thought out garbage, I would limit the rate of these special situations, and special customers / sales guys could get the job done way faster. It was a well known process by those who knew about it... but not everyone knew.
- anonymouse008 6y ago
  That sounds like a dream career -- any advice getting there when you've hacked on graveyard startups most your life?
  - duxup 6y ago
    It wasn't an official job. I was a regular support drone as far as anyone knew. I just had some connections that came about because I could be discrete and the engineers understood that I didn't bring them garbage too early (without enough information) or without good reason.
    - macksd 6y ago
      And this is why it's important to recognize and retain people who get the right things done. One does not simply backfill a support position and replace someone who has built up the internal AND external reputation and relationships required for issues like this to get fast-tracked and fixed in a way that makes everyone happy.
  - dingaling 6y ago
meibo 6y ago
The antivirus industry is the biggest player of the modern adware/malware crisis. The dark patterns used in software like AVG and avast, both making every system I see them on so slow that they might as well be unusable, are all focused on getting more installs, be it to force people into getting whatever "premium" subscription or harvesting data(e.g. attaching themselves to every sent email like a virus). There are very few that I could actually recommend, like Malwarebytes - for most users, Windows Defender will be more than enough nowadays. I haven't used a mac in a while, do you actually need AV on them today?
- sjg007 6y ago
  I mean there is mac malware and some of it is quite sophisticated. The compiled apple script bitcoin miner being one of the more ingenious ones. But those were distributed through pirated applications. There are probably a few zero days as well that maybe an AVE package could help stop if a signature is rapidly distributed. Ignoring the fact that the AV engine itself is a target too. Most people using only the app store helps cut that down.
  - wlesieutre 6y ago
    The one in recent memory for me is the KeRanger ransomware that was distributed in the official Transmission installer. https://unit42.paloaltonetworks.com/new-os-x-ransomware-keranger-infected-transmission-bittorrent-client-installer/ https://unit42.paloaltonetworks.com/new-os-x-ransomware-kera... >Transmission representative John Clay told Reuters via email that the ransomware was added to disk-image of its software after the project's server was compromised in a cyber attack. >"We're not commenting on the avenue of attack, other than to say that it was our main server that was compromised," he said. "The normal disk image (was) replaced by the compromised one."
    - setpatchaddress 6y ago
      Just to answer the original question: that's an example of something Apple handled -- no external AV required.
robin_reala 6y ago
I guess this was Cylance: I ran into this one on my work laptop with Firefox Nightly and managed to get it escalated internally from us too.
ksec 6y ago
>It’s notable that without this last-ditch effort we would have been effectively blocked from releasing a native Apple Silicon version for an indefinite period." And they are Mozilla. Imagine Indies. The Modern Day Apple requires you to get some Mainstream Media publish about How Apple block Open Sources Software to be running on M1 before Apple saw the PR damage and start acting on it.
- mlyle 6y ago
  This was about Cylance being jerks, not Apple. I've fought Cylance quite a bit on Windows for flagging open source software as malware, too (and they fail to respond / fix).
  - account42 6y ago
    So what do you do if an antivirus vendor is uncooperative? Can you sue them for defamation?
    - mlyle 6y ago
      Give up on your open source project, in my case.
e40 6y ago
This really bugs me about Apple. We had the DTK (pre-release hardware for the M1). We got into trouble with an upgrade from beta2 to beta10 and the machine was bricked. Everywhere we turned, we were told to use the developer forums. We did. There were no responses there and I didn't see anyone but customer helping customers. So, since we're an Apple developer, we decided we would use one of our DTS (developer technical support) tickets. Nope. Pre-release anything is not supported. So, we ended up waiting for release, bought a new M1 mini and then started our porting effort. Then, we ran into problems and used one of our DTS incidents and we got some help. However, we lost months.
- deleted 6y ago
  [deleted]
- jarjoura 6y ago
  beta 10 also bricked my DTK unit as well. Total paper weight
- saagarjha 6y ago
  I don't have a bricked DTK, but the last seven builds or so kernel panic every few hours of use. It's kind of sad to see where the program is now…
gigatexal 6y ago
It's not like Mozilla is a nobody software outfit. For this to be what they had to do go get someone's attention at Apple is terrible.
- lambada 6y ago
  It wasn't Apple they were trying to contact, it was a random anti-virus vendor who were flagging all new Universal Binaries as malware.
  - gigatexal 6y ago
    Doh! My bad
tyingq 6y ago
Oh wow. So in this case, a foundation with roughly half a billion in revenue per year is still somewhat of a little guy, at least for the standard process. I'm curious which antivirus vendor it was. Mozilla did eject a few extensions written by antivirus vendors in 2019, probably for good reasons.
TwoBit 6y ago
AV vendors and software are cancer.
dpkonofa 6y ago
I'm not sure I follow. Why would an anti-virus product accidentally flagging their Universal Binary block them from releasing a native Apple Silicon version? Of all the Macs in use, I'd have to imagine that only a small percentage are using that specific anti-virus software much less any anti-virus software at all. It might cause them some headaches with specific people who are using that software but why extend that all the way to blocking the release indefinitely?
drewg123 6y ago
I was doing Mac drivers about a decade ago, and some of the dumbest and most ignorant questions on the kernel and drivers mailing lists came from A/V folks. Things like "my machine locks up when our software does X", where it was clear that X was blocking the entire kernel waiting for a userpace thread. Ugh. I've resolved to never, ever run A/V software on any machine I control based on the quality of those devs.
- slim 6y ago
  because A/V folks are hackers, not engineers. hackers do impressive things without reading the fucking manual. that's why they can break seemingly unbreakable things. but on the surface, to the engineer, they seem uncompetent.
- 2Gkashmiri 6y ago
  how do you "secure" machines if they are windows ones and dumb people plugin flash drives and click on big shiny download ram buttons. genuinely curious.
  - icebraining 6y ago
    One way to do it is to whitelist all binaries in the system, and sandbox all applications (to prevent chances of a malicious PDF/image/etc abusing a buggy application).
    - 2Gkashmiri 6y ago
      can you do that on windows? every single exe, every process?
      - icebraining 6y ago
        Yeah, the security policies let you do that. I think the current mechanism is called AppLocker. Note that there may be still ways to bypass it if you're an attacker sitting at the computer, rather than a hapless user.
GekkePrutser 6y ago
Even working for a big multinational with a big tailored support contact, support from our major IT services vendor is abysmal. It's not just the little guys that have trouble.
ttflee 6y ago
The issue itself sounds like a prologue for an A.I. dystopian story.
oauea 6y ago
Surprising they even went through with that. Personally I'd have said fuck it, blamed Apple and moved on with my life. If Apple wants to create incompatible hardware, let them put the effort & money into fixing the software, if they want the software on their platform.
- m_st 6y ago
  Though I get your point, in this particular case it was the antivirus company that was the problem. Not Apple.
m_st 6y ago
I once did the same with Microsoft Windows 8 (or 8.1) keyboard layout changes breaking old software. You'd think they don't suddenly change from '.' to ',' as decimal separator. But that's what they did. And so did Apple more years ago by the way, even resulting in a calculator that couldn't be used anymore with the numeric keypad. Anyway, found a guy working on keyboard layout stuff at Microsoft through LinkedIn as the other support channels were non-responsive. Unfortunately he just confirmed the change if I remember correctly. But at least we knew what was coming.

CyberRabbi 6y ago

Is “apple silicon” the port job here? Isn’t this more correctly described as a port of their existing ARM64 target to macOS?

jfk13 6y ago
Firefox on iOS is based on the system's Webkit engine; Firefox elsewhere is built on Gecko, so there's a vast difference in the codebase involved.
nguyenkien 6y ago
iOS browser is just Safari reskin (with different sync)
skrowl 6y ago
On iOS there are no web browsers other than Safari, per the app store rules. "Chrome" / "Firefox" / etc on iOS are just basically skins on top of Webkit. See 2.5.6 here - https://developer.apple.com/app-store/review/guidelines/ https://developer.apple.com/app-store/review/guidelines/ This is why you don't get any of the features / extensions / etc of Chrome or Firefox on iOS. Apple does this so that the mobile web can never replace apps that they have a monopoly on and get a % from. If you could just visit netflix.com and have it install a Netflix SPA that worked as well as the native app, why would you ever install the native app? Edit after reading replies - lol, that programming of Apple users to believe "we need an app for every possible site".
- coldtea 6y ago
  >Apple does this so that the mobile web can never replace apps that they have a monopoly on and get a % from Or you know, because they disallow dynamic code execution of arbitrary downloaded code in apps, and JIT JS compilers do just that. >If you could just visit netflix.com and have it install a Netflix SPA that worked as well as the native app, why would you ever install the native app? It's like asking "why would you ever use a native app". Because it's faster, native, and much more convenient? Take the best desktop browser engine, e.g. Chrome, and put it inside a mobile browser app. Still, I (and most I guess) wouldn't use it to watch Netflix over individual apps.

mugivarra69 6y ago

does firefox use llvm to compile ?

sylvestre 6y ago
Yeah, clang for all platforms for a couple years now
- vetinari 6y ago
  Some Linux distributions, like Fedora, build their Firefox binary with gcc.
  - sylvestre 6y ago
    Yeah but this will probably change too.
    - Vogtinator 6y ago
      I hope not, we need diversity. (Yes, also more rust compilers)
      - sylvestre 6y ago
        We will still have jobs to build Firefox with gcc and gcc is not going anywhere in general: the % of package built with clang in Debian/Ubuntu is a fraction compared to gcc. Nathan Froyd wrote this great blog post about compiler usage: https://blog.mozilla.org/nfroyd/2018/05/29/when-implementation-monoculture-right-thing/ https://blog.mozilla.org/nfroyd/2018/05/29/when-implementati...
gspr 6y ago
Yes. There are essential Rust components in Firefox, and the only serious Rust compiler uses LLVM. (This has nothing to do with clang as someone else suggests)
- 6y ago

r00fus 6y ago

> The Apple Silicon chips are one of the first desktop chips that are a heterogeneous design with distinct performance and efficiency cores. We’re revising much of our core threading and thread pooling architecture to handle the distinction better, improve efficiency, and eventually be able to schedule less performance-critical tasks on the efficiency cores. I found this bit interesting. Likely more prevalent in mobile apps, but perhaps shifting desktop code to Big.Little approach and using core affinity will result in a lot less wasted energy.

brundolf 6y ago

> If the user visits such a site, Firefox will automatically download and install such a proprietary EME/CDM module. This presented a problem to us as we would be dependent on those third-party vendors to publish ARM64 versions of those decoders. Wait, modern browsers still download and run native binaries at the request of certain sites? How is this different from the days when native plugins like Flash were massive security liabilities? I thought we didn't do that anymore?

Gaelan 6y ago
As I understand it, it's a single trusted binary (Google's Widevine), not arbitrary binaries from sites, so I doubt it's a huge security liability. Not to discount all the other problems with DRM on the web, of course.
- dblohm7 6y ago
  This is correct. These binaries are downloaded from specific update servers. EDIT: I stand corrected thanks to a colleague on the media team: the EME CDM update servers are known Google servers.
- padenot 6y ago
  The above is correct. The CDM is very heavily sandboxed, a signature is used, and therefore it can't really do anything apart from what it's supposed to do (which is very little, taking encoded data, a key, decode media). Source: I'm on that team, but I don't work directly on this.
- mortenjorck 6y ago
  Worth mentioning is that this is also solving a different problem from the old browser plugin ecosystem. Rather than enabling third parties to extend browser functionality, this exists exclusively to partition the open-source Firefox codebase from closed-source DRM code, a workaround to enable DRM playback in an open-source browser.
- azalemeth 6y ago
  This is correct. I still think the "best" answer is to untick the box that says "Play DRM Content" in the Firefox preference panes, and refuse to support corporations that would otherwise use it. I haven't bought DRM media for over fifteen years.

green-bottle 6y ago

A bit tangential to the main topic of the post. They mention that they are working on another optimizing compiler Ion which will replace the cranelift compiler (which is still in nightly) as the new compiler for WebAssembly. They link the issue [1] tracking the change which also speaks about disabling cranelift. To my knowledge cranelift was made for the purpose of compiling WebAssembly in Firefox, so I am not sure if I am missing something here (it's not yet production ready maybe). The Cranelift README[2] mentions that it will be a backend for IonMonkey. I am a complete layman here so I am curious if someone here has a better understanding. [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1687626 https://bugzilla.mozilla.org/show_bug.cgi?id=1687626 [2] https://github.com/bytecodealliance/wasmtime/tree/main/cranelift https://github.com/bytecodealliance/wasmtime/tree/main/crane...

kibwen 6y ago
> They mention that they are working on another optimizing compiler Ion which will replace the cranelift compiler (which is still in nightly) as the new compiler for WebAssembly. Ion (nee IonMonkey) predates Cranelift, being the natural evolution of Mozilla's previous SpiderMonkey JITs. From your link: "Prototyping work (bug 1678097) has demonstrated that Ion can generate good code quickly for wasm on ARM64, and given that Ion has good stability and we know it well, we will ship it as the initial optimizing compiler for wasm on that platform." The keyword being "initial"; it appears to just be saying that Ion is good enough to enable, with support for Cranelift being retained in the event that it ever surpasses IonMonkey in capability.
twic 6y ago
I think the situation is: Cranelift - experimental, quick to port Ion - production, slow to port So Firefox on Apple Silicon got Cranelift first, but only in nightlies, and will soon get Ion in release builds - "become the new default" means it will replace the baseline compiler.
IainIreland 6y ago
(I work on SpiderMonkey.) Cranelift was originally started as a project to make a new backend for wasm in SpiderMonkey. It took on a life of its own, and has been transferred by the Bytecode Alliance (which Mozilla is a part of). At the moment it's not mature enough for us to use in production (both in terms of performance and in terms of code churn). We're hopeful that will change over the next few years, but we need to ship wasm support now, so we're sticking with our existing backend. (We intend to keep Cranelift working behind a compile-time flag.)

kevincox 6y ago

I'm surprised that Rosetta 2 isn't installed by default. It seems that for the next couple of years the vast majority of people will need at least one x86 app. I guess split-architecture applications were also not foreseen as it is clear that the auto-install prompt doesn't work very well in that case.

cududa 6y ago
I wonder if it has anything to do with licensing costs of everything that went into Rosetta? I imagine they owe someone royalties and licensing costs on some components in it, saves some pennies to dollars to only install it as needed
- SloopJon 6y ago
  Could be. I suspect that's a factor in the fonts available for download or document support in Catalina and Big Sur: https://support.apple.com/en-us/HT210192 https://support.apple.com/en-us/HT210192 https://support.apple.com/en-us/HT211240 https://support.apple.com/en-us/HT211240
kitsunesoba 6y ago
Feels like a bit of a nudge to developers to not take x86 compatibility for a given… kind of, "it's there if it's truly necessary, but you really should port that plugin/daemon/etc".
- kevincox 6y ago
  I suspect this as well. But it seems so obvious that it is necessary for a while that I doubt that anyone takes it seriously.
  - geerlingguy 6y ago
    I believe the Mac OS Classic environment wasn't installed by default in the early OS X days.

masklinn 6y ago

> Apple introduced a translation cache that likely removes this overhead completely for most applications but it does not work for code that is output by a JIT. With the native build, this second translation is avoided completely and we’re back to having a snappy browser. Indeed while Rosetta does have support for JITs (which is really impressive in and of itself), every piece of machine code generated by the JIT has to be translated on the fly. While the hiccup at the initial run is not too costly / annoying for a regular application being AOT-compiled in its entirety and Apple can then shove the result somewhere nearby, for a JIT it's basically constant, continuous overhead which can't be cached because it won't be around next run. I'm not surprised that the gains are significant there.

deleted 6y ago

[deleted]

shrimpx 6y ago

FYI you still cannot get a full native experience with Chrome and Firefox, due to plugins that have not been ported. For example Chrome ships with an x64 version of Widevine, a plugin that is required to watch live streams on YouTube TV (and perhaps other services with live TV). Currently, YouTube TV does not work natively in Chrome or Firefox. All that said, it will work fine if you run Rosetta -- the x64 decoder will run in Rosetta.

bla3 6y ago
The post talks about this in some length.

markdog12 6y ago

Got a kick out of one of the bugzilla links: https://bugzilla.mozilla.org/show_bug.cgi?id=34572 https://bugzilla.mozilla.org/show_bug.cgi?id=34572 "Use native context menus on Mac OS" "Opened 21 years ago"

bombcar 6y ago
Wow - that bug can now legally drink in all 50 states!
- saagarjha 6y ago
  Not until April 5th.
- nichos 6y ago
  But it can go to war and get married the past 3 years!
partlysean 6y ago
It’s little things like this that keep me from using Firefox. Context menus, various micro-interactions, visual design decisions—they all feel so non-native.
- cle 6y ago
  I don't really care much about the native menus, but the non-native scrolling in Firefox drives me nuts. Granted neither of these are deal breakers for me. I don't use Firefox b/c of pretty context menus.
- SulfurHexaFluri 6y ago
  I'm using firefox on macos right now and I can't see what the issue is. The the menus show up in the main top bar like every other app. Am I missing something?
  - ianlevesque 6y ago

Toutouxc 6y ago

> It’s notable that without this last-ditch effort we would have been effectively blocked from releasing a native Apple Silicon version for an indefinite period. Effectively blocked from releasing it for the single-digit-percentage of people who run an antivirus on a Mac. Does anyone have credible numbers on this?

dilly_li 6y ago
i.e. all the folks who are using a macbook from work -- I don't think that's a small fraction.
terhechte 6y ago
The IT department at the place where I work installs antivirus on all Macs. I’d guess it is the same at most bigger corporations
- dpkonofa 6y ago
  Doesn't that assume that all these IT departments and corporations are using the anti-virus software in question? I feel like most AV software vendors were aware of the ARM transition and would know to look for the new Universal Binaries...
- msh 6y ago
  But was it not just a specific product?
  - rockdoe 6y ago
    How many anti-viruses for macOS are there exactly? If it's the most popular one (whatever that is), it probably doesn't change much about the problem.
rkangel 6y ago
They can't selectively release Firefox. If 5% of machines have AV, then the new version of Firefox wouldn't have worked for 5% of machines. That's far too high a failure rate to release.

ed25519FUUU 6y ago

> Rust in particular was a concern. Firefox depends on Rust code, and we require a working Rust compiler to build the browser. Although Apple Silicon support for Rust was underway, it took until mid-August for there to be functional compiler builds, which limited the amount of progress possible for Firefox. Lack of rust support for 64-bit ARM was a bit surprising to me, especially given the velocity in which people have been rewriting certain components in Rust. Take for example ffmpeg failing to compile because librsvg was rewritten in rust: https://trac.macports.org/ticket/61668 https://trac.macports.org/ticket/61668

steveklabnik 6y ago
It has gotten significantly better recently, with Arm themselves pitching in.
CameronNemo 6y ago
Pretty sure Rust has supported aarch64 Linux targets for ages. It is just aarch64 Darwin/macOS target support which needed to be added.
saagarjha 6y ago
And in turn this blocks a large Swift app I work on from shipping Apple silicon support…software dependency chains can be brutal.

liquidify 6y ago

Love you firefox. Keep fighting the good fight. Keep that budget figured out.

fernly 6y ago

What an interesting and informative article! Nicely done!

pixelpoet 6y ago

Oh hey, the author is also the guy who developed the amazing open source AlphaGo reimplementation Leela Zero: https://en.wikipedia.org/wiki/Leela_Zero https://en.wikipedia.org/wiki/Leela_Zero

jonny383 6y ago

I wonder if Mozilla regrets laying off 25% of their engineering team [0] given their rapidly declining browser market share [1], and their rapidly declining performance. Not to mention their forced adoption of the new Firefox on Android which disables all add-ons except Mozilla approved ones, despite their promises to correct this [2]. Mozilla _used_ to be about open internet and security, but that's just a false pretense at this point [3][4]. I believe it's time to embrace Chromium / Blink, throw away the idea of internet freedom and just use the best performing browser of the week. [0] https://thenextweb.com/insights/2020/08/11/mozilla-firefox-layoffs-250-employees/ https://thenextweb.com/insights/2020/08/11/mozilla-firefox-l... [1] https://en.wikipedia.org/wiki/Usage_share_of_web_browsers https://en.wikipedia.org/wiki/Usage_share_of_web_browsers [2] https://www.androidpolice.com/2020/09/03/firefox-update-faces-backlash-due-to-missing-features-and-few-supported-extensions/ https://www.androidpolice.com/2020/09/03/firefox-update-face... [3] https://blog.mozilla.org/blog/2021/01/08/we-need-more-than-deplatforming/ https://blog.mozilla.org/blog/2021/01/08/we-need-more-than-d... [4] https://www.theverge.com/2017/12/16/16784628/mozilla-mr-robot-arg-plugin-firefox-looking-glass https://www.theverge.com/2017/12/16/16784628/mozilla-mr-robo...

roca 6y ago
Nice trolling. You can use general extensions on Android in Nightly, so this is in progress: https://blog.mozilla.org/addons/2020/09/29/expanded-extension-support-in-firefox-for-android-nightly/ https://blog.mozilla.org/addons/2020/09/29/expanded-extensio... But sure, if you want to "throw away the idea of internet freedom" then that's your choice.
- fwn 6y ago
  Not the parent but just to clarify: The ability to install non-store extensions got completely removed on Firefox for Android and there is (AFAIK) no hint at whether it will ever reappear. That's pretty frustrating and clearly not a win in internet freedom. Store extensions can be used if you create a Firefox account and use their Nightly, which is really hard to justify, IMO. To me it looks like they wanted to push their account numbers and I have great difficulties to find any potential hidden greatness in this policy.

fomine3 6y ago

For who curious, the antivirus that caused problem looks like Norton 360. https://bugzilla.mozilla.org/show_bug.cgi?id=1682834#c39 https://bugzilla.mozilla.org/show_bug.cgi?id=1682834#c39

johndoe42377 6y ago

What porting? Isn't C++ the most portable language in existence? Oh, there is also Rust. But isn't it just uses an LLVM codegen, same as Swift or clang? So, there is Rust's stdlib. Seems like these abstractions are not exactly zero-cost?

spijdar 6y ago
> But isn't it just uses an LLVM codegen, same as Swift or clang? It's more complicated than that. I've been involved in a project (bootstrapping little-endian 32 bit PowerPC on linux) which needed a rust port. I didn't work on that, but from what I saw, it's at best a major nuisance, possibly a nightmare when something breaks. This may be a bad example since darwin/aarch64 is a more sane target, but still. ;-) More importantly I guess, Firefox has some reeeeaally old platform specific cruft and some really rusty (hah!) ABI-glue stuff lying around. Stuff like the Netscape Portable Runtime. There's still code in Firefox from back when it ran on HP PA-RISC. There's even code for IBM Z mainframes in there. Really glossing over details, but there are some inner mechanisms that are very platform specific and need at least some custom code for each OS + CPU combo.

MrBuddyCasino 6y ago

> The Apple Silicon chips are one of the first desktop chips that are a heterogeneous design with distinct performance and efficiency cores. We’re revising much of our core threading and thread pooling architecture to handle the distinction better, improve efficiency, and eventually be able to schedule less performance-critical tasks on the efficiency cores. Isn't this at the wrong abstraction level? I would expect this to be a job for the OS scheduler.

kzrdude 6y ago
the application knows the tasks better than the OS?
- MrBuddyCasino 6y ago
  The OS already needs to properly schedule tasks of different load intensities and match them to the available cores, which might already be running different processes. An application has strictly less visibility into whats going on overall in the system, what else is using resources etc., so I don't see how it can decide any better? All it needs to do is set the proper priorities, so the OS scheduler knows whats more important.
  - rockdoe 6y ago
    If you read the linked bug, isn't that exactly what's being proposed: https://bugzilla.mozilla.org/show_bug.cgi?id=1678083#c3 https://bugzilla.mozilla.org/show_bug.cgi?id=1678083#c3

wooger 6y ago

Wait, what? People run anti-virus on Macs? What proportion of the userbase is this? It's good to hear from Mozilla doing some browser developmenmt, and not making bizarre political announcements that an authoritarian shutdown of a social network by a cartel of tech giants is "not enough".

EE84M3i 6y ago
Many enterprises require some form of anti-virus on all endpoints, including macs.

chris_wot 6y ago

As they linked to the LibreOffice bug that we hit,[1] it might be worthwhile explaining how the cross platform architecture works in LibreOffice. The widgeting/graphics library is actually run by something called VCL (the Visual Component Library). It's a bit of a mess to be honest, but the simplified version is that there is a class called OutputDevice that the rest of the app uses, which basically acts as a fascade over a platform specific class called SalGraphics (there are a number of other platform specific classes, SalGraphics is what I focus on here). Basically it is a class that implements a bunch of primitive drawing functions which call on abstract functions. We then implement these functions in a platform specific class. To see the guts of the Mac class, see AquaSalGraphics [2] - and no, none of know why it was named "Aqua"... our codebase is old. FWIW, OutputDevice has serious issues. I have detailed them in a mailing list post. [3] 1. https://bugs.documentfoundation.org/show_bug.cgi?id=138122 https://bugs.documentfoundation.org/show_bug.cgi?id=138122 2. https://opengrok.libreoffice.org/xref/core/vcl/inc/quartz/salgdi.h?r=e7ace1d0#133 https://opengrok.libreoffice.org/xref/core/vcl/inc/quartz/sa... 3. https://lists.freedesktop.org/archives/libreoffice/2020-December/086546.html https://lists.freedesktop.org/archives/libreoffice/2020-Dece...

hutattedonmyarm 6y ago
> and no, none of know why it was named "Aqua"... our codebase is old. The macOS UI is called Aqua, and has been for quite a while! https://en.wikipedia.org/wiki/Aqua_(user_interface) https://en.wikipedia.org/wiki/Aqua_(user_interface)
deleted 6y ago
[deleted]