5 ms·

I'm so impressed with the LadyBird / SerenityOS browser engine! It took Mozilla more than 25 years to write Firefox's HTML engine and here are a couple of geni

I'm so impressed with the LadyBird / SerenityOS browser engine! It took Mozilla more than 25 years to write Firefox's HTML engine and here are a couple of geniuses who write a web browser from scratch in just a few years!! Including Javascript (however, as of yet lacking video and WebGL). And Google's Chromium is simply a convoluted mess, chockful with vulnerabilities and memory corruption errors.

senko 4y ago
I'm a fan of Andreas and love seeing the progress here, but let's be fair: it didn't take Mozilla 25 years to write a HTML engine. It took Netscape 3 years to build the world's best (at the time) browser from scratch ('94 to '97). Chromium's HTML engine derives from an open source KHTML engine, written for the KDE project.
ossusermivami 4y ago
Not trying to diminish this impressive work from Andrew, but I would believe as the saying says those last (ongoing since a browser is never finished) 20% is what take 80% of the time to make a browser.
londons_explore 4y ago
I'm actually pretty impressed with the Chromium source code. For such a huge, old and complex project, I think it is rather impressive. It's a lot better than the Linux kernel for example, another project of similar size/age/complexity.
- senkora 4y ago
  I think a significant factor in this is that C++ simply has better abstractions for building large codebases than C does. Any big enough C project is gonna turn out a bit funky.
  - mhh__ 4y ago
    For quite a long time now I have said that the future for the Linux kernel could easily be C++ rather than rust. Rust is very cool and have no issue with it in the kernel tree but C++ would prevent so many bugs and eliminate so many lines of code. It's just ego.
    - mdaniel 4y ago
      > C++ would prevent so many bugs https://chromereleases.googleblog.com/search/label/Stable%20updates https://chromereleases.googleblog.com/search/label/Stable%20... and control-f for "High CVE" This from the company with arguably the best security researchers on Earth, and probably unholy amounts of internal fuzzing and static analysis tooling
      - mhh__ 4y ago
        Note that the baseline is C not C++ used badly.
asadotzler 4y ago
Mozilla wrote Gecko, with enough web compat to effectively take on IE6, in about 4 years. We made a couple of significant changes in years 4-6 right before Firefox launched, but Gecko was basically "there" about 4 years after Mozilla transitioned from the old Communicator engine to Gecko/NGLayout/Raptor/Magellen. Having said that, Gecko wasn't a Netscape start from scratch effort. They acquired and built on a very simple and modular cross platform rendering engine that was used for the preview function in an HTML authoring product called WebSuite by Digital Style out of San Diego. (This is where Netscape got engineers Rick Gessner, Peter Linss, and manager Jim Hammerly.) So, maybe if you count the WebSuite and the Netscape efforts both, you get something like 5-6 years of effort to get Gecko up to sufficient capability to compete in the market. That's a far cry from "it took Mozilla 25 years" though. And yes, the Web is much more capable today, which makes building a rendering engine more difficult for sure, but the 25 year comment seemed wrong enough to me that I thought I'd share some of what I know as a Mozilla participant for the last 25 years (and a full-time Netscape/Mozilla employee for the last 22.5 years.) This is not in any way meant to take away from the efforts of any new engine devs or teams. I'm amazed that anyone is even trying given how large the platform has become and have great respect for those trying and succeeding.
- Wowfunhappy 4y ago
  > Mozilla wrote Gecko, with enough web compat to effectively take on IE6, in about 4 years. Yes, but web standards were at least an order of magnitude simpler back then.
  - ec109685 4y ago
    How to build a browser is also a much more solved problem now.
  - asadotzler 4y ago
    I noted that in the later sentences of my comment. Yes, the platform is larger. But in some cases, it's also more sensible now that standardization has had 20 years to work it over. When Gecko was being developed, it was half implementing standards and half reverse engineering Microsoft's undocumented web APIs. Still, I'm sure it's nevertheless harder today and that's why I said so near the end of my comment.
als0 4y ago
> And Google's Chromium is simply a convoluted mess, chockful with vulnerabilities and memory corruption errors. I'm sorry, but Ladybird is written in C++. Therefore, it's inevitable that it will have vulnerabilities and memory corruption errors.
- marginalia_nu 4y ago
  > Therefore, it's inevitable that it will have vulnerabilities and memory corruption errors. Is it though?
  - rvz 4y ago
    Yes it is inevitable, as long as it is using C++ then you will still get memory corruption vulnerabilities. If it was written in Rust on the other hand, it eliminates those specific class of vulnerabilities.
    - UltraViolence 4y ago
      No it isn't. I'm studied the Firefox code and there are lots of raw pointers being used everywhere, instead of them using RAII. Anyway, wxWidgets is an example of a C++ framework which is almost flawless and comparable in complexity to Gecko.
      - rvz 4y ago
        > No it isn't. It is. > I'm studied the Firefox code and there are lots of raw pointers being used everywhere, instead of them using RAII. Firefox is still in C++ and is still subject to memory corruption vulnerabilities, proving my point again. > Anyway, wxWidgets is an example of a C++ framework which is almost flawless and comparable in complexity to Gecko. "almost flawless" is still in the category of 'possible'. Memory corruption is not possible in Rust by default. Surely you understand what 'inevitable' means before giving me an example of a project that has at least one memory corruption vulnerability out of the thousands of other projects that are also in C++, especially browser-based software?
    - 4y ago

senko 4y ago

I'm a fan of Andreas and love seeing the progress here, but let's be fair: it didn't take Mozilla 25 years to write a HTML engine. It took Netscape 3 years to build the world's best (at the time) browser from scratch ('94 to '97). Chromium's HTML engine derives from an open source KHTML engine, written for the KDE project.

ossusermivami 4y ago

Not trying to diminish this impressive work from Andrew, but I would believe as the saying says those last (ongoing since a browser is never finished) 20% is what take 80% of the time to make a browser.

londons_explore 4y ago

I'm actually pretty impressed with the Chromium source code. For such a huge, old and complex project, I think it is rather impressive. It's a lot better than the Linux kernel for example, another project of similar size/age/complexity.

senkora 4y ago
I think a significant factor in this is that C++ simply has better abstractions for building large codebases than C does. Any big enough C project is gonna turn out a bit funky.
- mhh__ 4y ago
  For quite a long time now I have said that the future for the Linux kernel could easily be C++ rather than rust. Rust is very cool and have no issue with it in the kernel tree but C++ would prevent so many bugs and eliminate so many lines of code. It's just ego.
  - mdaniel 4y ago
    > C++ would prevent so many bugs https://chromereleases.googleblog.com/search/label/Stable%20updates https://chromereleases.googleblog.com/search/label/Stable%20... and control-f for "High CVE" This from the company with arguably the best security researchers on Earth, and probably unholy amounts of internal fuzzing and static analysis tooling
    - mhh__ 4y ago
      Note that the baseline is C not C++ used badly.

asadotzler 4y ago

Mozilla wrote Gecko, with enough web compat to effectively take on IE6, in about 4 years. We made a couple of significant changes in years 4-6 right before Firefox launched, but Gecko was basically "there" about 4 years after Mozilla transitioned from the old Communicator engine to Gecko/NGLayout/Raptor/Magellen. Having said that, Gecko wasn't a Netscape start from scratch effort. They acquired and built on a very simple and modular cross platform rendering engine that was used for the preview function in an HTML authoring product called WebSuite by Digital Style out of San Diego. (This is where Netscape got engineers Rick Gessner, Peter Linss, and manager Jim Hammerly.) So, maybe if you count the WebSuite and the Netscape efforts both, you get something like 5-6 years of effort to get Gecko up to sufficient capability to compete in the market. That's a far cry from "it took Mozilla 25 years" though. And yes, the Web is much more capable today, which makes building a rendering engine more difficult for sure, but the 25 year comment seemed wrong enough to me that I thought I'd share some of what I know as a Mozilla participant for the last 25 years (and a full-time Netscape/Mozilla employee for the last 22.5 years.) This is not in any way meant to take away from the efforts of any new engine devs or teams. I'm amazed that anyone is even trying given how large the platform has become and have great respect for those trying and succeeding.

Wowfunhappy 4y ago
> Mozilla wrote Gecko, with enough web compat to effectively take on IE6, in about 4 years. Yes, but web standards were at least an order of magnitude simpler back then.
- ec109685 4y ago
  How to build a browser is also a much more solved problem now.
- asadotzler 4y ago
  I noted that in the later sentences of my comment. Yes, the platform is larger. But in some cases, it's also more sensible now that standardization has had 20 years to work it over. When Gecko was being developed, it was half implementing standards and half reverse engineering Microsoft's undocumented web APIs. Still, I'm sure it's nevertheless harder today and that's why I said so near the end of my comment.

als0 4y ago

> And Google's Chromium is simply a convoluted mess, chockful with vulnerabilities and memory corruption errors. I'm sorry, but Ladybird is written in C++. Therefore, it's inevitable that it will have vulnerabilities and memory corruption errors.

marginalia_nu 4y ago
> Therefore, it's inevitable that it will have vulnerabilities and memory corruption errors. Is it though?
- rvz 4y ago
  Yes it is inevitable, as long as it is using C++ then you will still get memory corruption vulnerabilities. If it was written in Rust on the other hand, it eliminates those specific class of vulnerabilities.
  - UltraViolence 4y ago
    No it isn't. I'm studied the Firefox code and there are lots of raw pointers being used everywhere, instead of them using RAII. Anyway, wxWidgets is an example of a C++ framework which is almost flawless and comparable in complexity to Gecko.
    - rvz 4y ago
      > No it isn't. It is. > I'm studied the Firefox code and there are lots of raw pointers being used everywhere, instead of them using RAII. Firefox is still in C++ and is still subject to memory corruption vulnerabilities, proving my point again. > Anyway, wxWidgets is an example of a C++ framework which is almost flawless and comparable in complexity to Gecko. "almost flawless" is still in the category of 'possible'. Memory corruption is not possible in Rust by default. Surely you understand what 'inevitable' means before giving me an example of a project that has at least one memory corruption vulnerability out of the thousands of other projects that are also in C++, especially browser-based software?
  - 4y ago