4 ms·

I think that Ladybird has driven a lot of the effort, otherwise we'd just see browsers continuing to use Chromium with backports to allow v2 being worked on. L

I think that Ladybird has driven a lot of the effort, otherwise we'd just see browsers continuing to use Chromium with backports to allow v2 being worked on. Ladybird was already progressing rapidly within SerenityOS well before it was officially launched, and I think that's given people a new inspiration for how plausible it is to create a browser from scratch. I'm really pleased we're seeing Servo having a resurgence too.

p-e-w 9mo ago
It’s indeed rapidly progressing feature-wise, but I have yet to see an explanation for how they intend to manage security once market adoption happens. Ladybird is written in C++, which is memory-unsafe by default (unlike Rust, which is memory-safe by default). Firefox and Chrome also use C++, and each of them has 3-4 critical vulnerabilities related to memory safety per year, despite the massive resources Mozilla and Google have invested in security. I don’t understand how the Ladybird team could possibly hope to secure a C++ browser engine, given that even engineering giants have consistently failed to do so.
- jsheard 9mo ago
  > Firefox and Chrome also use C++, and each of them has 3-4 critical vulnerabilities related to memory safety per year, despite the massive resources Mozilla and Google have invested in security. And part of Firefox/Chromes security effort has been to use memory safe languages in critical sections like file format decoders. They're far too deeply invested in C++ to move away entirely in our lifetimes, but they are taking advantage of other languages where they feasibly can, so to write a new browser in pure C++ is a regression from what the big players are already doing.
- binary132 9mo ago
  Ladybird is going to use Swift.
  - boxed 9mo ago
    That is very good news! I've used Swift a bunch for hobby projects, and the two things that suck about it are: 1. XCode 2. Compile times I would assume if you're coming from C++ or Rust the compile time issues aren't really something you notice anyway :P
    - quux 9mo ago
      You don't strictly have to use Xcode to use swift, there's a good LSP for use in other editors. That said, if you're using Swift to build an app, you're probably still going to want to use Xcode for building and debugging
      - boxed 9mo ago
        Yea, I'm building iOS apps mostly, and some macOS apps, so definitely need to use XCode :/
        quux 9mo ago
        I have a nice workflow going for the iOS apps I work on where I use neovim for all my editing, and Xcode for building and debugging.
  - p-e-w 9mo ago
    I know that that’s the plan, but I believe it when I see it. Mozilla invented entire language features for Rust based on Servo’s needs. It’s doubtful whether a language like Swift, which is used mostly for high-level UI code, has what it takes to serve as the foundation of a browser engine.
    - binary132 9mo ago
      what technical demerits specifically make Swift a doubtfully viable option for a browser?
    - no_wizard 9mo ago
- torginus 9mo ago
  I just checked out Servo, and like all browsers it has a VERY large footprint of dependencies (notably GStreamer/GOject, libpng/jpeg, PCRE). Considering browsers have quite the decent process isolation (the whole browser process vs heavily sandboxed renderer processes), I wonder how tangible the Rust advantage turns out to be.
  - p-e-w 9mo ago
    Browsers have had sandboxing for well over a decade, and the 3-4 catastrophic vulnerabilities per year happen in spite of that. And most of them are in the browser code itself, not in dependencies. By far the biggest offender tends to be the JavaScript engine.
    - torginus 9mo ago
      Are you sure? I just looked at the top CVEs for chrome in 2025. There are 5 which allow excaping the sandbox, and the top ones seem to be V8 bugs where the JIT is coaxed into generating exploitable code. One seems to be a genuine use-after-free. So I can echo what you wrote about the JS engine being most exploitable, but how is Rust supposed to help with generating memory-safe JITed code?
      - p-e-w 9mo ago
        Like this: https://github.com/nbp/holyjit https://github.com/nbp/holyjit

p-e-w 9mo ago

It’s indeed rapidly progressing feature-wise, but I have yet to see an explanation for how they intend to manage security once market adoption happens. Ladybird is written in C++, which is memory-unsafe by default (unlike Rust, which is memory-safe by default). Firefox and Chrome also use C++, and each of them has 3-4 critical vulnerabilities related to memory safety per year, despite the massive resources Mozilla and Google have invested in security. I don’t understand how the Ladybird team could possibly hope to secure a C++ browser engine, given that even engineering giants have consistently failed to do so.

jsheard 9mo ago
> Firefox and Chrome also use C++, and each of them has 3-4 critical vulnerabilities related to memory safety per year, despite the massive resources Mozilla and Google have invested in security. And part of Firefox/Chromes security effort has been to use memory safe languages in critical sections like file format decoders. They're far too deeply invested in C++ to move away entirely in our lifetimes, but they are taking advantage of other languages where they feasibly can, so to write a new browser in pure C++ is a regression from what the big players are already doing.
binary132 9mo ago
Ladybird is going to use Swift.
- boxed 9mo ago
  That is very good news! I've used Swift a bunch for hobby projects, and the two things that suck about it are: 1. XCode 2. Compile times I would assume if you're coming from C++ or Rust the compile time issues aren't really something you notice anyway :P
  - quux 9mo ago
    You don't strictly have to use Xcode to use swift, there's a good LSP for use in other editors. That said, if you're using Swift to build an app, you're probably still going to want to use Xcode for building and debugging
    - boxed 9mo ago
      Yea, I'm building iOS apps mostly, and some macOS apps, so definitely need to use XCode :/
      - quux 9mo ago
        I have a nice workflow going for the iOS apps I work on where I use neovim for all my editing, and Xcode for building and debugging.
- p-e-w 9mo ago
  I know that that’s the plan, but I believe it when I see it. Mozilla invented entire language features for Rust based on Servo’s needs. It’s doubtful whether a language like Swift, which is used mostly for high-level UI code, has what it takes to serve as the foundation of a browser engine.
  - binary132 9mo ago
    what technical demerits specifically make Swift a doubtfully viable option for a browser?
  - no_wizard 9mo ago
torginus 9mo ago
I just checked out Servo, and like all browsers it has a VERY large footprint of dependencies (notably GStreamer/GOject, libpng/jpeg, PCRE). Considering browsers have quite the decent process isolation (the whole browser process vs heavily sandboxed renderer processes), I wonder how tangible the Rust advantage turns out to be.
- p-e-w 9mo ago
  Browsers have had sandboxing for well over a decade, and the 3-4 catastrophic vulnerabilities per year happen in spite of that. And most of them are in the browser code itself, not in dependencies. By far the biggest offender tends to be the JavaScript engine.
  - torginus 9mo ago
    Are you sure? I just looked at the top CVEs for chrome in 2025. There are 5 which allow excaping the sandbox, and the top ones seem to be V8 bugs where the JIT is coaxed into generating exploitable code. One seems to be a genuine use-after-free. So I can echo what you wrote about the JS engine being most exploitable, but how is Rust supposed to help with generating memory-safe JITed code?
    - p-e-w 9mo ago
      Like this: https://github.com/nbp/holyjit https://github.com/nbp/holyjit