6 ms·

GNUzilla and IceCat

72 points by rouma7 12y ago

rouma7 12y ago
GNUzilla is the GNU version of the Mozilla suite, and GNU IceCat is the GNU version of the Firefox browser. Its main advantage is an ethical one: it is entirely free software. While the Firefox source code from the Mozilla project is free software, they distribute and recommend non-free software as plug-ins and addons. In addition, GNU IceCat includes some privacy protection features, included in a separate addon: 1. Some sites refer to zero-size images on other hosts to keep track of cookies. When IceCat detects this mechanism it blocks cookies from the site hosting the zero-length image file. (It is possible to re-enable such a site by removing it from the blocked hosts list.) 2. Other sites rewrite the host name in links redirecting the user to another site, mainly to "spy" on clicks. When this behavior is detected, IceCat shows a message alerting the user.
- rouma7 12y ago
  GNU Icecat will be available on Fedora updates-testing repositories for some days. That’s right time to test harshly this new web browser (really it’s not so new considering it’s a fork of Firefox) and leave a positive/negative karma or open a bug. http://fedoraos.wordpress.com/2014/09/02/gnu-icecat-browser-is-finally-on-fedora/ http://fedoraos.wordpress.com/2014/09/02/gnu-icecat-browser-...
  - deleted 12y ago
    [deleted]
- asadotzler 12y ago
  "Its main advantage is an ethical one: it is entirely free software. While the Firefox source code from the Mozilla project is free software..." It's entirely free software just like Mozilla's Firefox.
  - joosters 12y ago
    Yes. Some impressive weasel words from GNU to try and make Mozilla sound bad there.
    - admax88q 12y ago
      They're not weasel words. It's the stance that the FSF has always taken in regards to software that makes it easy for people to uninstall non-free software. Say what you want about their stance, at least they're consistent.
    - AndrewOMartin 12y ago
      It's only weasel words if you don't read the second half of the sentence. Taken together it's an explicit description of the subtle but significant difference between Firefox and Icecat. Seriously, the comment I'm responding to and its parent made me so angry.
      - riquito 12y ago
        > they [Mozilla] distribute and recommend non-free software as plug-ins and addons What are the non free plugins distributed? And what are the ones recommended? Afaik you download Firefox without plugins. Is the message "for seeing this video you need Flash player" the recommendation?
        LukeShu 12y ago
        > What are the non free plugins distributed? Mozilla distributes plenty of nonfree plugins at addons.mozilla.org; they aren't authored by Mozilla, but Mozilla distributes them. The "Get Add-ons" section of about:addons potentially recommends nonfree plugins; what is displayed there is based on user ratings, freedom isn't considered (though most of them seem to be free). Saying "you need a Flash Player" isn't necessarily a nonfree recommendation (there are other Flash Players), but the button that says "take care of it for me" and automatically picks Adobe Flash Player is.
- lucb1e 12y ago
  Yeah that's the first text on the page. If people can't be bothered to click the link, why literally copy the page here? Besides, the page requires attribution when copying text, something you didn't do. Not a major issue as it's on the topic of the page, but still you could have mentioned it.
edwintorok 12y ago
what does this mean for Debian's icedove? Could it just be replaced by IceCat?
- aruggirello 12y ago
  icedove is the unbranded version of thunderbird; you probably meant iceweasel :) I think Debian's reasons for forking Firefox & Thunderbird is more related to trademarks and licensing issues, while it seems IceCat is more focused on privacy concerns. All in all I'm sure Debian will consider IceCat though.
  - currysausage 12y ago
    > All in all I'm sure Debian will consider IceCat though. Just to clarify, IceCat is around for almost a decade now. Actually, IceCat was called IceWeasel before the Debian project decided to call their own Firefox fork IceWeasel. [1] So no, I don't believe Debian will consider GNU IceCat. [1] https://en.wikipedia.org/wiki/GNU_IceCat#Origins_of_the_name https://en.wikipedia.org/wiki/GNU_IceCat#Origins_of_the_name
  - edwintorok 12y ago
    Hmm I must've read the announcement too fast because I thought: GNUzilla = web browser = Firefox/Iceweasel Icecat = email client = Thunderbird/Icedove So ... looking forward for thunderbird/icedove's equivalent from GNU :)
    - LukeShu 12y ago
      That was originally the plan, but I don't believe that's been true since Loic Duros replaced Giuseppe Scrivano as the maintainer.
Zikes 12y ago
> Other sites rewrite the host name in links redirecting the user to another site, mainly to "spy" on clicks. When this behavior is detected, IceCat shows a message alerting the user. Easily one of the most annoying "features" I deal with on a daily basis. I almost wish the a.href property were read-only in the DOM.
- glass- 12y ago
  In some cases it's not to spy on clicks but to hide data in the URL by obscuring the HTTP referer header, eg. DuckDuckGo does this so sites can't see your search terms.
  - Zikes 12y ago
    That's a pretty respectable and legitimate use. It's a shame it can't happen on the browser side, though, by tagging the links with something like rel="noreferer".
WoodenChair 12y ago
This has been around for years; the title is misleading, making it sound like something new.
- rouma7 12y ago
  my mistake, the 'news' is that it's being shipped on Fedora updates-testing repos http://fedoraos.wordpress.com/2014/09/02/gnu-icecat-browser-is-finally-on-fedora/ http://fedoraos.wordpress.com/2014/09/02/gnu-icecat-browser-...
  - hsivonen 12y ago
    Will it get security updates in sync with Firefox ESR point releases ? I can't find security updates for IceCat on ftp.gnu.org.
Igglyboo 12y ago
Doesn't IceWeasel already exist? Are there license differences here?
- Malus 12y ago
  IceWeasel was created to work around trademark restrictions; Mozilla Corporation would not allow to Debian to use the trademarked names as long as Debian was distributing the software with unapproved patches. So, Debian created their own branding in order to comply. See http://en.wikipedia.org/wiki/Mozilla_Corporation_software_rebranded_by_the_Debian_project http://en.wikipedia.org/wiki/Mozilla_Corporation_software_re... for more details.
seba_dos1 12y ago
Uhm... > Updated: $Date: 2012/08/22 01:51:19 $
- davexunit 12y ago
  Yeah, this page hasn't been updated in awhile. However, IceCat's maintainer (who is also the Trisquel GNU/Linux maintainer) has builds of IceCat 31 (maybe 32 now, not sure) for Trisquel 7. The source tarball should be officially released sometime soon.
- rouma7 12y ago
  sorry for the confusion, https://news.ycombinator.com/item?id=8284815 https://news.ycombinator.com/item?id=8284815
keithpeter 12y ago
http://gnewsense.org/Documentation/3/MiscellaneousGuides/CompileGnuIcecatSeventeen http://gnewsense.org/Documentation/3/MiscellaneousGuides/Com... I compiled IceCat 17 for 32bit gnewsense some months ago. V24 needs dependencies outside what can be provided on gnewsense 3.1 (based on Debian Squeeze). The maintainer compiles the 64bit binaries against fairly recent libraries. Firefox put out a generic 32bit binary that will work on linuxen of some vintage when unpacked somewhere like ~/home. I did spend some time scratching my head and reading their mozconfig files to see how they manage to produce one binary that will work on Centos 5.10 up to Debian Sid. Didn't get anywhere. Anyone got any ideas? Static build? Anyone got a mozconfig or mozbuild method to share?
ryan-c 12y ago
> GNUzilla runs its own plugin finder service at gnuzilla.gnu.org. To specify this at runtime, visit the url about:config in your browser, find the pfs.datasource.url attribute, and change the host to gnuzilla.gnu.org. Also change the protocol from https to http, if necessary. I hope they sign packages...
- kentonv 12y ago
  > I hope they sign packages... And defend against attacks that trick you into installing a known-vulnerable version of the plugin (which of course has a valid signature, since it was believed to be good at the time of release). And avoid using error-prone package signature algorithms, like the one Android uses that originates from Java and has had several vulnerabilities. And don't send any personally-identifiable or private user information to the server when checking for updates. And... actually, no, just don't distribute software over HTTP, even if signed.
- quidam 12y ago
  In its current implementation the plugin finder just redirects to the gnash source at ftp.gnu.org (which is signed) or the mozplugger website. This will be updated to provide a more useful response to the user, in particular it will try to provide a way to install the appropriate package from the repos of the distro the browser is running on. The note about changing to http comes from the fact that the finder service doesn't work through https://gnuzilla.gnu.org/ https://gnuzilla.gnu.org/ but http://gnuzilla.gnu.org/plugins/PluginFinderService.php http://gnuzilla.gnu.org/plugins/PluginFinderService.php We would work on this too.
monokrome 12y ago
As a bonus, these tools are also consistently outdated. :/
oscargrouch 12y ago
My two cents for mozilla, and im sure they will be sort of offended by this, but the best strategy, one that should be pursuit years ago, is to get the chrome engine, and replace the webkit/blink layer with the mozilla web rendering engine.. That way, they would have the multi-process architecture, they need badly, but with their core, the web layer intact.. The chrome architecture is good enough, that you can replace the webkit layer without mess with other core parts Dont know why they are procrastinating with servo instead, and doing the same mistakes netscape did years ago, to rewrite the whole engine, while IE was capable to take the lead in the browser wars back than.. the same mistake!! Theres a good Joel Spolsky article about this (from 2000): Things You Should Never Do [http://www.joelonsoftware.com/articles/fog0000000069.html http://www.joelonsoftware.com/articles/fog0000000069.html]
- kryptiskt 12y ago
  They have multiprocess in the nightlies (https://wiki.mozilla.org/Electrolysis https://wiki.mozilla.org/Electrolysis), but it is only used in FirefoxOS releases currently.
  - doublec 12y ago
    If you have a nightly desktop build you should see a "New E10s Window" in the menu. This starts up a multiprocess browser window allowing you to test the feature.
- doublec 12y ago
  Servo is a research project exploring the design space of writing a modern browser from the ground up in a language designed for it. It's not being developed as a Gecko (Firefox internal framework) replacement. So I don't think they are making the mistake of restarting from scratch for their core product. The Servo project is done by a different team and Gecko development continues uninterrupted. No procrastination in that area is going on.
quidam 12y ago
Hi, current maintainer here! That documentation is pretty old, I'll be updating it pretty soon. Current .deb development packages can be tested from http://devel.trisquel.info/icecat/ http://devel.trisquel.info/icecat/ The "toutatis" repo should work on Trisquel 6, Debian Stable and Ubuntu Precise, while the "belenos" one should work on Trisquel 7 (beta), Debian Testing and Ubuntu Trusty. Main changes from the previous version focus on providing better privacy, in particular protecting the user against fingerprinting. The settings have been tweaked to prevent the browser from leaking information through referrers, cookies, useragent and other methods. The current version comes with this main extensions enabled: * LibreJS to check for the freedom of the javascript you run * HTTPS-Everywhere redirects you to secure versions of the sites you browse * A customized Adblockplus blocks known privacy trackers, and when in private browsing mode it blocks all third party content. * A custom homepage lists this and other features with links to documentation and the possibility to disable them quickly if needed. I'll be publishing a more complete list of features through the bug-gnuzilla mailing list soon, along with a beta release. Stay tuned!

72 points by rouma7 12y ago

GNUzilla is the GNU version of the Mozilla suite, and GNU IceCat is the GNU version of the Firefox browser. Its main advantage is an ethical one: it is entirely free software. While the Firefox source code from the Mozilla project is free software, they distribute and recommend non-free software as plug-ins and addons. In addition, GNU IceCat includes some privacy protection features, included in a separate addon: 1. Some sites refer to zero-size images on other hosts to keep track of cookies. When IceCat detects this mechanism it blocks cookies from the site hosting the zero-length image file. (It is possible to re-enable such a site by removing it from the blocked hosts list.) 2. Other sites rewrite the host name in links redirecting the user to another site, mainly to "spy" on clicks. When this behavior is detected, IceCat shows a message alerting the user.

rouma7 12y ago
GNU Icecat will be available on Fedora updates-testing repositories for some days. That’s right time to test harshly this new web browser (really it’s not so new considering it’s a fork of Firefox) and leave a positive/negative karma or open a bug. http://fedoraos.wordpress.com/2014/09/02/gnu-icecat-browser-is-finally-on-fedora/ http://fedoraos.wordpress.com/2014/09/02/gnu-icecat-browser-...
- deleted 12y ago
  [deleted]
asadotzler 12y ago
"Its main advantage is an ethical one: it is entirely free software. While the Firefox source code from the Mozilla project is free software..." It's entirely free software just like Mozilla's Firefox.
- joosters 12y ago
  Yes. Some impressive weasel words from GNU to try and make Mozilla sound bad there.
  - admax88q 12y ago
    They're not weasel words. It's the stance that the FSF has always taken in regards to software that makes it easy for people to uninstall non-free software. Say what you want about their stance, at least they're consistent.
  - AndrewOMartin 12y ago
    It's only weasel words if you don't read the second half of the sentence. Taken together it's an explicit description of the subtle but significant difference between Firefox and Icecat. Seriously, the comment I'm responding to and its parent made me so angry.
    - riquito 12y ago
      > they [Mozilla] distribute and recommend non-free software as plug-ins and addons What are the non free plugins distributed? And what are the ones recommended? Afaik you download Firefox without plugins. Is the message "for seeing this video you need Flash player" the recommendation?
      - LukeShu 12y ago
        > What are the non free plugins distributed? Mozilla distributes plenty of nonfree plugins at addons.mozilla.org; they aren't authored by Mozilla, but Mozilla distributes them. The "Get Add-ons" section of about:addons potentially recommends nonfree plugins; what is displayed there is based on user ratings, freedom isn't considered (though most of them seem to be free). Saying "you need a Flash Player" isn't necessarily a nonfree recommendation (there are other Flash Players), but the button that says "take care of it for me" and automatically picks Adobe Flash Player is.
lucb1e 12y ago
Yeah that's the first text on the page. If people can't be bothered to click the link, why literally copy the page here? Besides, the page requires attribution when copying text, something you didn't do. Not a major issue as it's on the topic of the page, but still you could have mentioned it.

edwintorok 12y ago

what does this mean for Debian's icedove? Could it just be replaced by IceCat?

aruggirello 12y ago
icedove is the unbranded version of thunderbird; you probably meant iceweasel :) I think Debian's reasons for forking Firefox & Thunderbird is more related to trademarks and licensing issues, while it seems IceCat is more focused on privacy concerns. All in all I'm sure Debian will consider IceCat though.
- currysausage 12y ago
  > All in all I'm sure Debian will consider IceCat though. Just to clarify, IceCat is around for almost a decade now. Actually, IceCat was called IceWeasel before the Debian project decided to call their own Firefox fork IceWeasel. [1] So no, I don't believe Debian will consider GNU IceCat. [1] https://en.wikipedia.org/wiki/GNU_IceCat#Origins_of_the_name https://en.wikipedia.org/wiki/GNU_IceCat#Origins_of_the_name
- edwintorok 12y ago
  Hmm I must've read the announcement too fast because I thought: GNUzilla = web browser = Firefox/Iceweasel Icecat = email client = Thunderbird/Icedove So ... looking forward for thunderbird/icedove's equivalent from GNU :)
  - LukeShu 12y ago
    That was originally the plan, but I don't believe that's been true since Loic Duros replaced Giuseppe Scrivano as the maintainer.

Zikes 12y ago

> Other sites rewrite the host name in links redirecting the user to another site, mainly to "spy" on clicks. When this behavior is detected, IceCat shows a message alerting the user. Easily one of the most annoying "features" I deal with on a daily basis. I almost wish the a.href property were read-only in the DOM.

glass- 12y ago
In some cases it's not to spy on clicks but to hide data in the URL by obscuring the HTTP referer header, eg. DuckDuckGo does this so sites can't see your search terms.
- Zikes 12y ago
  That's a pretty respectable and legitimate use. It's a shame it can't happen on the browser side, though, by tagging the links with something like rel="noreferer".

WoodenChair 12y ago

This has been around for years; the title is misleading, making it sound like something new.

rouma7 12y ago
my mistake, the 'news' is that it's being shipped on Fedora updates-testing repos http://fedoraos.wordpress.com/2014/09/02/gnu-icecat-browser-is-finally-on-fedora/ http://fedoraos.wordpress.com/2014/09/02/gnu-icecat-browser-...
- hsivonen 12y ago
  Will it get security updates in sync with Firefox ESR point releases ? I can't find security updates for IceCat on ftp.gnu.org.

Igglyboo 12y ago

Doesn't IceWeasel already exist? Are there license differences here?

Malus 12y ago
IceWeasel was created to work around trademark restrictions; Mozilla Corporation would not allow to Debian to use the trademarked names as long as Debian was distributing the software with unapproved patches. So, Debian created their own branding in order to comply. See http://en.wikipedia.org/wiki/Mozilla_Corporation_software_rebranded_by_the_Debian_project http://en.wikipedia.org/wiki/Mozilla_Corporation_software_re... for more details.

seba_dos1 12y ago

Uhm... > Updated: $Date: 2012/08/22 01:51:19 $

davexunit 12y ago
Yeah, this page hasn't been updated in awhile. However, IceCat's maintainer (who is also the Trisquel GNU/Linux maintainer) has builds of IceCat 31 (maybe 32 now, not sure) for Trisquel 7. The source tarball should be officially released sometime soon.
rouma7 12y ago
sorry for the confusion, https://news.ycombinator.com/item?id=8284815 https://news.ycombinator.com/item?id=8284815

keithpeter 12y ago

http://gnewsense.org/Documentation/3/MiscellaneousGuides/CompileGnuIcecatSeventeen http://gnewsense.org/Documentation/3/MiscellaneousGuides/Com... I compiled IceCat 17 for 32bit gnewsense some months ago. V24 needs dependencies outside what can be provided on gnewsense 3.1 (based on Debian Squeeze). The maintainer compiles the 64bit binaries against fairly recent libraries. Firefox put out a generic 32bit binary that will work on linuxen of some vintage when unpacked somewhere like ~/home. I did spend some time scratching my head and reading their mozconfig files to see how they manage to produce one binary that will work on Centos 5.10 up to Debian Sid. Didn't get anywhere. Anyone got any ideas? Static build? Anyone got a mozconfig or mozbuild method to share?

ryan-c 12y ago

> GNUzilla runs its own plugin finder service at gnuzilla.gnu.org. To specify this at runtime, visit the url about:config in your browser, find the pfs.datasource.url attribute, and change the host to gnuzilla.gnu.org. Also change the protocol from https to http, if necessary. I hope they sign packages...

kentonv 12y ago
> I hope they sign packages... And defend against attacks that trick you into installing a known-vulnerable version of the plugin (which of course has a valid signature, since it was believed to be good at the time of release). And avoid using error-prone package signature algorithms, like the one Android uses that originates from Java and has had several vulnerabilities. And don't send any personally-identifiable or private user information to the server when checking for updates. And... actually, no, just don't distribute software over HTTP, even if signed.
quidam 12y ago
In its current implementation the plugin finder just redirects to the gnash source at ftp.gnu.org (which is signed) or the mozplugger website. This will be updated to provide a more useful response to the user, in particular it will try to provide a way to install the appropriate package from the repos of the distro the browser is running on. The note about changing to http comes from the fact that the finder service doesn't work through https://gnuzilla.gnu.org/ https://gnuzilla.gnu.org/ but http://gnuzilla.gnu.org/plugins/PluginFinderService.php http://gnuzilla.gnu.org/plugins/PluginFinderService.php We would work on this too.

monokrome 12y ago

As a bonus, these tools are also consistently outdated. :/

oscargrouch 12y ago

My two cents for mozilla, and im sure they will be sort of offended by this, but the best strategy, one that should be pursuit years ago, is to get the chrome engine, and replace the webkit/blink layer with the mozilla web rendering engine.. That way, they would have the multi-process architecture, they need badly, but with their core, the web layer intact.. The chrome architecture is good enough, that you can replace the webkit layer without mess with other core parts Dont know why they are procrastinating with servo instead, and doing the same mistakes netscape did years ago, to rewrite the whole engine, while IE was capable to take the lead in the browser wars back than.. the same mistake!! Theres a good Joel Spolsky article about this (from 2000): Things You Should Never Do [http://www.joelonsoftware.com/articles/fog0000000069.html http://www.joelonsoftware.com/articles/fog0000000069.html]

kryptiskt 12y ago
They have multiprocess in the nightlies (https://wiki.mozilla.org/Electrolysis https://wiki.mozilla.org/Electrolysis), but it is only used in FirefoxOS releases currently.
- doublec 12y ago
  If you have a nightly desktop build you should see a "New E10s Window" in the menu. This starts up a multiprocess browser window allowing you to test the feature.
doublec 12y ago
Servo is a research project exploring the design space of writing a modern browser from the ground up in a language designed for it. It's not being developed as a Gecko (Firefox internal framework) replacement. So I don't think they are making the mistake of restarting from scratch for their core product. The Servo project is done by a different team and Gecko development continues uninterrupted. No procrastination in that area is going on.

quidam 12y ago

Hi, current maintainer here! That documentation is pretty old, I'll be updating it pretty soon. Current .deb development packages can be tested from http://devel.trisquel.info/icecat/ http://devel.trisquel.info/icecat/ The "toutatis" repo should work on Trisquel 6, Debian Stable and Ubuntu Precise, while the "belenos" one should work on Trisquel 7 (beta), Debian Testing and Ubuntu Trusty. Main changes from the previous version focus on providing better privacy, in particular protecting the user against fingerprinting. The settings have been tweaked to prevent the browser from leaking information through referrers, cookies, useragent and other methods. The current version comes with this main extensions enabled: * LibreJS to check for the freedom of the javascript you run * HTTPS-Everywhere redirects you to secure versions of the sites you browse * A customized Adblockplus blocks known privacy trackers, and when in private browsing mode it blocks all third party content. * A custom homepage lists this and other features with links to documentation and the possibility to disable them quickly if needed. I'll be publishing a more complete list of features through the bug-gnuzilla mailing list soon, along with a beta release. Stay tuned!