9 ms·

We need a browser written in managed lang Even if it means some perf drop, modern hardware will get it back in X years, but safety will be significantly improv

We need a browser written in managed lang Even if it means some perf drop, modern hardware will get it back in X years, but safety will be significantly improved

SoothingSorbet 2y ago
Why managed when it could be in Rust and have both performance and safety? The Servo shouldn't have ever been laid off. Yes, I'm aware a team is working on it now, but it isn't up to the same speed and enthusiasm as it was when funded by Mozilla, is it?
- high_na_euv 2y ago
  Im aware of Rust, but there is C#/Java too, with way bigger ecosystem, community and lower entry level. At the end of the day web browser is just bunch of parsers and compilers working together, and some video/audio
  - eqvinox 2y ago
    Servo exists, in Rust. I don't know of any browser engine in C#/Java? Also, modern browsers as a whole outsize entire OSes (sans browser)...
    - cesarb 2y ago
      > I don't know of any browser engine in C#/Java? A famous one is HotJava. According to Wikipedia, it was also the first web browser to support Java applets.
      - Yoric 2y ago
        It was also a mess :)
      - eqvinox 2y ago
        > A famous one is HotJava. "Final release: Late 2004; 20 years ago" I guess I should've specified "not completely and utterly dead"? ;D (Also, the size and complexity of a browser at that point in time was arguably still a whole lot less than a modern one)
  - Ygg2 2y ago
    > At the end of the day web browser is just bunch of parsers and compilers working together At the end of the day, OS is just a bunch of command lines being piped together. /sarcasm Sure, you are just missing: rendering, layout, security, network traffic for sockets, low-level control over hardware, writing a decent enough VM, image processing, video playback, music playback, compression, decompression, self-update, decryption, don't forget add-ons people love add-ons, also add-on security and isolation, web edit and debug tools, network analysis tools, etc. You know, little things.
    - high_na_euv 2y ago
      Why would you need to reinvent networking layer instead of just sending http requests via matrue, battle tested lib available in your programming ecosystem e.g from MSFT? Same with crypto, sockets, compression, etc? Video and audio I mentioned. Extensions are tricky, right, but more from privacy standpoint cuz after all you can just expose too much
      - Ygg2 2y ago
        > Why would you need to reinvent networking layer instead of just sending http requests via matrue, battle tested lib available in your programming ecosystem e.g from MSFT? Because modern browsers are essentially cross-compatible OSes.
        high_na_euv 2y ago
        So is .net
        eqvinox 2y ago
        You've clearly never tried to use .net on a non-MS OS. Sure, it's possible. But it's also a royal pain, at least last time I checked.
        high_na_euv 2y ago
  - sunshowers 2y ago
    The problem with writing a browser in C# or Java is that neither of them can provide anywhere close to the level of thread safety that Rust does.
    - chii 2y ago
      both java and c# has thread safety primitives that are also pretty easy to use. E.g., the java concurrency package.
      - om8 2y ago
        The cool thing about rust is that it forces you to use thread safety primitives. It's called fearless concurrency
      - Yoric 2y ago
        Having done concurrency in Java and Rust, my experience is that Rust's concurrency primitives are an order of magnitude better than Java's. I haven't tested C#'s.
      - sunshowers 2y ago
        No, that's not what I'm talking about. C# and Java have nothing like the Send and Sync traits, and they don't have & and &mut.
        neonsunset 2y ago
        C# doesn't have Send and Sync that is true. It frequently does not need either because it uses GC instead of affine types for automatic memory management. Synchronization is indeed "just don't write bugs", where Rust offers a massive upgrade, but .NET CoreCLR's memory model is more strict than C one, like object reference assignment having release semantics, so quite a few footguns are luckily avoided: https://github.com/dotnet/runtime/blob/main/docs/design/specs/Memory-model.md https://github.com/dotnet/runtime/blob/main/docs/design/spec... '&' and '&mut', however, are your 'ref readonly' and 'ref' respectively.
  - Malidir 2y ago
    Microsoft are re-writing c# stuff in Rust! https://news.ycombinator.com/item?id=39240205 https://news.ycombinator.com/item?id=39240205
  - Yoric 2y ago
    > At the end of the day web browser is just bunch of parsers and compilers working together, and some video/audio That's... an interesting reduction :) I guess it's about as true as saying that the Linux Kernel is a bunch of I/O and a scheduler?
fulafel 2y ago
They already are partly in JS so there's a smooth path. (Wasm isn't safe but could be a building block too)
- flohofwoe 2y ago
  I can't find the link right now but I seem to remember that Firefox already replaced some internal native subsystems with the same code compiled to WASM - or maybe even compiled to WASM and then translated back to C, which basically adds a runtime memory safety layer to unsafe C code at the cost of some performance (I think it was a couple of media codecs, but not sure). Not sure why you think that WASM is less secure than JS though. Even if the WASM heap has internal corruption there's no way for this to do damage outside the WASM sandbox that wouldn't be possible in JS.
  - fulafel 2y ago
    If your browser is running in a wasm sandbox, it's a minor comfort that only your browser gets compromised which contains all your creds, etc.
    - flohofwoe 2y ago
      Only parts of the browser are running in multiple small isolated WASM sandboxes, those WASM sandboxes are isolated from outside world about as well as if they would run in their own process.
      - fulafel 2y ago
        Compartments of internally unsafe sandboxes are what we have now, with browsers employing native-code sandboxes and isolated renderer processes etc. It gets leaky.
  - cesarb 2y ago
    > I can't find the link right now but I seem to remember that Firefox already replaced some internal native subsystems with the same code compiled to WASM - or maybe even compiled to WASM and then translated back to C Was it this one? https://hacks.mozilla.org/2021/12/webassembly-and-back-again-fine-grained-sandboxing-in-firefox-95/ https://hacks.mozilla.org/2021/12/webassembly-and-back-again... Or perhaps this one? https://hacks.mozilla.org/2020/02/securing-firefox-with-webassembly/ https://hacks.mozilla.org/2020/02/securing-firefox-with-weba...
mikae1 2y ago
Ladybird[1] is switching to Swift[2]. [1] https://ladybird.org https://ladybird.org [2] https://news.ycombinator.com/item?id=41208836 https://news.ycombinator.com/item?id=41208836
- actualwitch 2y ago
  Swift didn't save apple from rce's in blastdoor.
- hypeatei 2y ago
  That's not completely accurate. The plan is to use Swift for "security critical" areas like decoding data. It's unlikely core components like the layout/CSS engine will be converted to Swift.
ftrobro 2y ago
Rust was created at Mozilla and currently 11.7% of the Firefox source code is in Rust: https://4e6.github.io/firefox-lang-stats/ https://4e6.github.io/firefox-lang-stats/ That's down from 12.49% at the peak in July 2020 so I assume the conversion work was halted after the layoffs in 2020: https://docs.google.com/spreadsheets/d/1flUGg6Ut4bjtyWdyH_9emD9EAN01ljTAVft2S4Dq620/edit?gid=885787479#gid=885787479 https://docs.google.com/spreadsheets/d/1flUGg6Ut4bjtyWdyH_9e...
- psychoslave 2y ago
  But the CEO got it’s pay raise, so we are safe. https://techrights.org/o/2022/02/17/mozilla-salaries/ https://techrights.org/o/2022/02/17/mozilla-salaries/ https://www.reddit.com/r/browsers/comments/yy986k/can_someone_explain_why_mozillas_ceo_salary/ https://www.reddit.com/r/browsers/comments/yy986k/can_someon... https://news.ycombinator.com/item?id=38849580 https://news.ycombinator.com/item?id=38849580
  - sph 2y ago
    What's that got to do with anything? The CEO situation is awful, but this is just flame bait on your part.
    - redserk 2y ago
      It’s pretty relevant considering the continued mismanagement of Mozilla. Nobody would care about Mozilla in 2024 without Firefox, but Firefox development seemingly takes a back seat to a variety of other pet projects that Mozilla’s management tries (and keeps failing, over and over) to chase. For example, they’ve been trying a pivot to become a community-focused privacy company the last couple of years, yet are fine with implementing ad topics. AFAIK didn’t Safari advocate against it over privacy concerns? If so, what is Mozilla doing? Or their partnering with a shady company for removing data from data brokers. Before the privacy pivot, there was the “we want to make browsing better” pivot with their acquisition of Pocket that went nowhere. From the outside Mozilla looks like a low-scoring charity grift you’d find on CharityNavigator with how far they deviate from the missions they claim to support.
Ygg2 2y ago
Sounds like Mozilla should invent a low level language with great safety guarantees, maybe even call it after some form of oxidation process[1]. Then make a browser engine called after a motor[2], and then NOT axe the team responsible for it[3]. I think the last part might be crucial. [1] https://www.rust-lang.org/ https://www.rust-lang.org/ [2] https://servo.org/ https://servo.org/ [3] https://paulrouget.com/bye_mozilla.html https://paulrouget.com/bye_mozilla.html
- high_na_euv 2y ago
  Im aware of Rust, but there is C#/Java too, with way bigger ecosystem, community and lower entry level
  - aryonoco 2y ago
    I think of browsers these days on par with OSes. I mean, they provide a runtime to execute binary code (wasm). They do process management and scheduling. They do a lot of things which up until 15 years ago, we thought bongs to the realm of Operating Systems. And history has shown that when you need to do that kind of low level code, it's nigh on impossible to achieve acceptable results with a garbage collected language. Many people tried, none really succeeded. Hence why Rust was made
  - m4rtink 2y ago
    It seems to me that both C#/Java have build their own niches and are hard to impossible to realistically use outside of them, such as to write a web browser.
  - Yoric 2y ago
    A long time ago, the possibility of using Java or C# in Gecko (the core of Firefox) was pondered. Java was rejected because of the huge memory requirements and the unpredictable (and sometimes lengthy) garbage-collection pauses. C# was rejected because (at the time) it was too tied to the Microsoft ecosystem and there was no way to get it to build on all the platforms for which Firefox is available. I don't remember garbage-collection pauses being discussed, but they would also be an issue.
moffkalast 2y ago
> if it means some perf drop, modern hardware will get it back in X years I think the unfortunate reality is that other browsers will also take advantage of that speed boost, sites will get even more bloated because they can and it will stay unusable for a long long time.
heresie-dabord 2y ago
From the fine article: > Throughout 2024, so far, Mozilla had to fix zero-day vulnerabilities on Firefox only once. > On March 22, the internet company released security updates to address CVE-2024-29943 and CVE-2024-29944, both critical-severity issues Vulnerabilities will be found in everything. Firefox is a fully internationalised application and it is FOSS. The team responsible for Firefox is doing a good job.
- high_na_euv 2y ago
  >Vulnerabilities will be found in everything. Different ratios, different consequences, etc.
guappa 2y ago
Run your browser in a namespace. You can get firejail.

We need a browser written in managed lang Even if it means some perf drop, modern hardware will get it back in X years, but safety will be significantly improved

SoothingSorbet 2y ago

Why managed when it could be in Rust and have both performance and safety? The Servo shouldn't have ever been laid off. Yes, I'm aware a team is working on it now, but it isn't up to the same speed and enthusiasm as it was when funded by Mozilla, is it?

high_na_euv 2y ago
Im aware of Rust, but there is C#/Java too, with way bigger ecosystem, community and lower entry level. At the end of the day web browser is just bunch of parsers and compilers working together, and some video/audio
- eqvinox 2y ago
  Servo exists, in Rust. I don't know of any browser engine in C#/Java? Also, modern browsers as a whole outsize entire OSes (sans browser)...
  - cesarb 2y ago
    > I don't know of any browser engine in C#/Java? A famous one is HotJava. According to Wikipedia, it was also the first web browser to support Java applets.
    - Yoric 2y ago
      It was also a mess :)
    - eqvinox 2y ago
      > A famous one is HotJava. "Final release: Late 2004; 20 years ago" I guess I should've specified "not completely and utterly dead"? ;D (Also, the size and complexity of a browser at that point in time was arguably still a whole lot less than a modern one)
- Ygg2 2y ago
  > At the end of the day web browser is just bunch of parsers and compilers working together At the end of the day, OS is just a bunch of command lines being piped together. /sarcasm Sure, you are just missing: rendering, layout, security, network traffic for sockets, low-level control over hardware, writing a decent enough VM, image processing, video playback, music playback, compression, decompression, self-update, decryption, don't forget add-ons people love add-ons, also add-on security and isolation, web edit and debug tools, network analysis tools, etc. You know, little things.
  - high_na_euv 2y ago
    Why would you need to reinvent networking layer instead of just sending http requests via matrue, battle tested lib available in your programming ecosystem e.g from MSFT? Same with crypto, sockets, compression, etc? Video and audio I mentioned. Extensions are tricky, right, but more from privacy standpoint cuz after all you can just expose too much
    - Ygg2 2y ago
      > Why would you need to reinvent networking layer instead of just sending http requests via matrue, battle tested lib available in your programming ecosystem e.g from MSFT? Because modern browsers are essentially cross-compatible OSes.
      - high_na_euv 2y ago
        So is .net
        eqvinox 2y ago
        You've clearly never tried to use .net on a non-MS OS. Sure, it's possible. But it's also a royal pain, at least last time I checked.
        high_na_euv 2y ago
- sunshowers 2y ago
  The problem with writing a browser in C# or Java is that neither of them can provide anywhere close to the level of thread safety that Rust does.
  - chii 2y ago
    both java and c# has thread safety primitives that are also pretty easy to use. E.g., the java concurrency package.
    - om8 2y ago
      The cool thing about rust is that it forces you to use thread safety primitives. It's called fearless concurrency
    - Yoric 2y ago
      Having done concurrency in Java and Rust, my experience is that Rust's concurrency primitives are an order of magnitude better than Java's. I haven't tested C#'s.
    - sunshowers 2y ago
      No, that's not what I'm talking about. C# and Java have nothing like the Send and Sync traits, and they don't have & and &mut.
      - neonsunset 2y ago
        C# doesn't have Send and Sync that is true. It frequently does not need either because it uses GC instead of affine types for automatic memory management. Synchronization is indeed "just don't write bugs", where Rust offers a massive upgrade, but .NET CoreCLR's memory model is more strict than C one, like object reference assignment having release semantics, so quite a few footguns are luckily avoided: https://github.com/dotnet/runtime/blob/main/docs/design/specs/Memory-model.md https://github.com/dotnet/runtime/blob/main/docs/design/spec... '&' and '&mut', however, are your 'ref readonly' and 'ref' respectively.
- Malidir 2y ago
  Microsoft are re-writing c# stuff in Rust! https://news.ycombinator.com/item?id=39240205 https://news.ycombinator.com/item?id=39240205
- Yoric 2y ago
  > At the end of the day web browser is just bunch of parsers and compilers working together, and some video/audio That's... an interesting reduction :) I guess it's about as true as saying that the Linux Kernel is a bunch of I/O and a scheduler?

fulafel 2y ago

They already are partly in JS so there's a smooth path. (Wasm isn't safe but could be a building block too)

flohofwoe 2y ago
I can't find the link right now but I seem to remember that Firefox already replaced some internal native subsystems with the same code compiled to WASM - or maybe even compiled to WASM and then translated back to C, which basically adds a runtime memory safety layer to unsafe C code at the cost of some performance (I think it was a couple of media codecs, but not sure). Not sure why you think that WASM is less secure than JS though. Even if the WASM heap has internal corruption there's no way for this to do damage outside the WASM sandbox that wouldn't be possible in JS.
- fulafel 2y ago
  If your browser is running in a wasm sandbox, it's a minor comfort that only your browser gets compromised which contains all your creds, etc.
  - flohofwoe 2y ago
    Only parts of the browser are running in multiple small isolated WASM sandboxes, those WASM sandboxes are isolated from outside world about as well as if they would run in their own process.
    - fulafel 2y ago
      Compartments of internally unsafe sandboxes are what we have now, with browsers employing native-code sandboxes and isolated renderer processes etc. It gets leaky.
- cesarb 2y ago
  > I can't find the link right now but I seem to remember that Firefox already replaced some internal native subsystems with the same code compiled to WASM - or maybe even compiled to WASM and then translated back to C Was it this one? https://hacks.mozilla.org/2021/12/webassembly-and-back-again-fine-grained-sandboxing-in-firefox-95/ https://hacks.mozilla.org/2021/12/webassembly-and-back-again... Or perhaps this one? https://hacks.mozilla.org/2020/02/securing-firefox-with-webassembly/ https://hacks.mozilla.org/2020/02/securing-firefox-with-weba...

mikae1 2y ago

Ladybird[1] is switching to Swift[2]. [1] https://ladybird.org https://ladybird.org [2] https://news.ycombinator.com/item?id=41208836 https://news.ycombinator.com/item?id=41208836

actualwitch 2y ago
Swift didn't save apple from rce's in blastdoor.
hypeatei 2y ago
That's not completely accurate. The plan is to use Swift for "security critical" areas like decoding data. It's unlikely core components like the layout/CSS engine will be converted to Swift.

ftrobro 2y ago

Rust was created at Mozilla and currently 11.7% of the Firefox source code is in Rust: https://4e6.github.io/firefox-lang-stats/ https://4e6.github.io/firefox-lang-stats/ That's down from 12.49% at the peak in July 2020 so I assume the conversion work was halted after the layoffs in 2020: https://docs.google.com/spreadsheets/d/1flUGg6Ut4bjtyWdyH_9emD9EAN01ljTAVft2S4Dq620/edit?gid=885787479#gid=885787479 https://docs.google.com/spreadsheets/d/1flUGg6Ut4bjtyWdyH_9e...

psychoslave 2y ago
But the CEO got it’s pay raise, so we are safe. https://techrights.org/o/2022/02/17/mozilla-salaries/ https://techrights.org/o/2022/02/17/mozilla-salaries/ https://www.reddit.com/r/browsers/comments/yy986k/can_someone_explain_why_mozillas_ceo_salary/ https://www.reddit.com/r/browsers/comments/yy986k/can_someon... https://news.ycombinator.com/item?id=38849580 https://news.ycombinator.com/item?id=38849580
- sph 2y ago
  What's that got to do with anything? The CEO situation is awful, but this is just flame bait on your part.
  - redserk 2y ago
    It’s pretty relevant considering the continued mismanagement of Mozilla. Nobody would care about Mozilla in 2024 without Firefox, but Firefox development seemingly takes a back seat to a variety of other pet projects that Mozilla’s management tries (and keeps failing, over and over) to chase. For example, they’ve been trying a pivot to become a community-focused privacy company the last couple of years, yet are fine with implementing ad topics. AFAIK didn’t Safari advocate against it over privacy concerns? If so, what is Mozilla doing? Or their partnering with a shady company for removing data from data brokers. Before the privacy pivot, there was the “we want to make browsing better” pivot with their acquisition of Pocket that went nowhere. From the outside Mozilla looks like a low-scoring charity grift you’d find on CharityNavigator with how far they deviate from the missions they claim to support.

Ygg2 2y ago

Sounds like Mozilla should invent a low level language with great safety guarantees, maybe even call it after some form of oxidation process[1]. Then make a browser engine called after a motor[2], and then NOT axe the team responsible for it[3]. I think the last part might be crucial. [1] https://www.rust-lang.org/ https://www.rust-lang.org/ [2] https://servo.org/ https://servo.org/ [3] https://paulrouget.com/bye_mozilla.html https://paulrouget.com/bye_mozilla.html

high_na_euv 2y ago
Im aware of Rust, but there is C#/Java too, with way bigger ecosystem, community and lower entry level
- aryonoco 2y ago
  I think of browsers these days on par with OSes. I mean, they provide a runtime to execute binary code (wasm). They do process management and scheduling. They do a lot of things which up until 15 years ago, we thought bongs to the realm of Operating Systems. And history has shown that when you need to do that kind of low level code, it's nigh on impossible to achieve acceptable results with a garbage collected language. Many people tried, none really succeeded. Hence why Rust was made
- m4rtink 2y ago
  It seems to me that both C#/Java have build their own niches and are hard to impossible to realistically use outside of them, such as to write a web browser.
- Yoric 2y ago
  A long time ago, the possibility of using Java or C# in Gecko (the core of Firefox) was pondered. Java was rejected because of the huge memory requirements and the unpredictable (and sometimes lengthy) garbage-collection pauses. C# was rejected because (at the time) it was too tied to the Microsoft ecosystem and there was no way to get it to build on all the platforms for which Firefox is available. I don't remember garbage-collection pauses being discussed, but they would also be an issue.

moffkalast 2y ago

> if it means some perf drop, modern hardware will get it back in X years I think the unfortunate reality is that other browsers will also take advantage of that speed boost, sites will get even more bloated because they can and it will stay unusable for a long long time.

heresie-dabord 2y ago

From the fine article: > Throughout 2024, so far, Mozilla had to fix zero-day vulnerabilities on Firefox only once. > On March 22, the internet company released security updates to address CVE-2024-29943 and CVE-2024-29944, both critical-severity issues Vulnerabilities will be found in everything. Firefox is a fully internationalised application and it is FOSS. The team responsible for Firefox is doing a good job.

high_na_euv 2y ago
>Vulnerabilities will be found in everything. Different ratios, different consequences, etc.

guappa 2y ago

Run your browser in a namespace. You can get firejail.