Hacker News Reader

Comment by biot | Hacker News Reader

I'm going to have to try this to see if Firefox's privacy is better. I currently use Chrome on iOS and was very disappointed to discover that it remembers Google searches that you do within incognito mode, completely breaking all expectations on what incognito is for.

Apparently this is a two year old bug: http://www.theverge.com/2013/10/3/4797968/chrome-for-ios-inc...

Long story short, Google saves all searches in HTML5 local storage and this is shared between regular and incognito windows. Perhaps DuckDuckGo is a configurable Firefox option. (EDIT: yes, it is. Goodbye, Chrome.)

View on HN

We use a totally separate WKWebView process pool and WKWebViewConfiguration for Private Browsing.

From the perspective of the underlying web engine, we're two separate browsers.

Nice. Does that isolate private browsing sessions from each other?

Yes.

Also there is ZERO data sharing between Firefox and Safari. Both apps run sandboxed and cannot see eachothers data.

Both have their own unique and private bookmark, history, cookie, password management.

But on IOS you're not a real browser, are you?

In my humble understanding Firefox is just a Safari skin, crippled by the lack of JIT.

IIRC, the new (since iOS 8) WKWebView uses the Nitro JIT engine for JS, unlike the UIWebView of old.

A technical centric view of a browser would focus on the rendering engine. But modern browsers, in their being almost small operating systems, go very far beyond the HTML/CSS/JavaScript rendering engine. I will list a few things that vary between browsers irrespective of the rendering engine: tab handling, incognito mode, extension system/ecosystem, privacy handling, search/url bar/completion, security policies, anti malware strategies, download manager, history management, bookmark management, cross platform syncing, password management. And all these things have a higher impact on the user experience than the rendering engine.

All these things might be completely different between Firefox and Safari on iOS. Saying that Firefox on iOS is not "a real browser" is an understatement.

Um… based on your stance, I don’t think you meant to call that “an understatement”. ;)

Don't be ridiculous, the rendering engine is much more complex and many more lines of code than the GUI features. And browsers have had bookmarks, tabs, and password managers for a decade now.

More importantly, the rendering engine is what matters to the "open web", if you care about that. If there's only one rendering engine which "everyone" uses, then websites are designed to the bugs and quirks of that engine, then that engine need not fix any bugs, then those bugs become the de-facto standard. Then users can't use the web from the platform or browser UI of their choice if the only web rendering engine of note doesn't support it.

The engines of a 747 are much more complex and designing them takes many more man-hours of engineering than does designing comfortable and spacious seats.

But assuming the engines don't fail to perform correctly, which one do you think 99.9% of passengers care more about?

Engines aren't just "correct" or "incorrect", they perform differently. Users switched to Chrome from IE because Chrome was well marketed on a website they already used (google) and was way, way faster than IE. Many also switched on OS X because it was a bit faster, more feature-full, and marketed/perceived as way faster. It wasn't because they loved the Chrome UI.

I still regularly have to help "common people" find everything but the new-tab button in Chrome (and every browser).

Finally, it's clear that UI/UX designers always say they're making software "more intuitive" and "a joy to use" but no one (except grumpy engineers like me...) know what to click or where stuff is hidden anyway. It's all just UI churn, around in circles. Show feature prominently because users don't know how to find it, then hide it because the UI is too cluttered. Repeat.

EDIT: and all that's not the main point, sorry ... anyway, the "mass market" or "common" user's ignorance doesn't change the importance of the engine to the "open web". And don't forget how Firefox started, with only particularly savvy users caring to install it.

I agree -- I would totally fly on a plane with uncomfortable seats but an engine that would get me from Tokyo to Seattle 40% faster.

And I am not saying the renderer doesn't matter. My contention is just that the featureset and the UI probably matters more today, for most people. Historically, that wasn't true. (I consider switching from IE "historical". I don't know anybody who uses MSIE today, except for one-off reason like accessing some legacy banking system.)

We are a real and unique browser. Not a Safari skin.

There is no such thing as a Safari skin. Instead we use a low level component called the WKWebView, which is a bare-bones minimal API to 'show web pages'. On top of that we have built a browser.

This is exactly what Apple has done with Safari.

The only common component between Firefox and Safari is the WKWebView. Everything on top of that, like the UI, bookmark management, history, sync is unique and implement in different ways by each browser.

Regarding JIT .. the WKWebView exposes the same fast JIT as Safari uses. Run a benchmark. We are as fast as Safari or any other app that uses the WKWebView underneath.

I think that's what they were getting at though, it's the same engine as Safari with a layer of Firefox on top, not Gecko, etc.

Yes as of a few releases ago (but not originally) iOS allows JIT for WKWebView.

But no, the result of a bit of chrome (historical name for browser controls) around a WKWebView is indeed just a Safari skin. The renderer is not some minor detail like how tcp connections are made, it's practically the whole thing! It handles the http/https/websocket connections, the html, css, js, html5 video and audio, canvas, webgl, webrtc (or lack thereof), pointer events, everything that matters.

- user of firefox on linux and on android, who never "signs in" to his browser chrome, or saves passwords in the browser, or other ill-advised but marketer-loved things

- also developer working on a webrtc application, who has had to explain to users "Chrome on iOS isn't actually Chrome, sorry"

WKWebView != Safari. Safari is built on top of WKWebView. Likewise, Firefox is build on top of WKWebView. Firefox is not built on top of Safari, so your Safari skin statement is incorrect. Its called mobile app development, you work with the APIs provided to you by the OS. Attempting to write your own low level networking and rendering libraries that bypass those provided by OS will simply mean your app is not released on the app store. Should Mozilla not release a browser on mobile cause as its not 'true' to your definition?

Indeed, just own up to the fact that Apple does not allow any other browsers on iOS. (nor f.lux nor game emulators etc. Apple sucks.)

Mozilla Corp. has become increasingly frantic these days, trying to maintain market share by making all the compromises it can on its ideals. Is it working? Doesn't look like it to me. I'm the only one I know personally who still uses Firefox instead of Chrome (on Windows/OSX) or Safari (on iOS). Notably, I know a number of web developers (though I'm a systems software engineer).

There are very good reasons for Apple to sandbox apps in this way. It provides a controlled, consistent experience for users.

A controlled, consistently awful experience IMO.

When hundreds of millions of people keep buying things you believe are awful, perhaps it's time to ask how broadly shared your views are.

For every nerd who complains about not being able to root their iPhone, there are probably a hundred people who think “I/my kids/my parents won't get mal/ransom-ware”. Repeat for almost every other security or reliability issue.

I'm not entirely in love with the effects but I'm not going to say those people are wrong because they value stability and lack the extremely high level of skill needed to operate a general purpose computer safely.

> When hundreds of millions of people keep buying things you believe are awful, perhaps it's time to ask how broadly shared your views are.

It's irrelevant how many people believe in something if they're wrong. A billion people believe the Earth is 60,000 years old and was created in a week by an all-powerful bearded deity. That doesn't make it true and doesn't mean we should throw our hands up and reinforce those beliefs instead of improving education and displacing them.

That's not a fair comparison. I can't believe I'm going to defend Apple here, but Apple's "walled garden" is an environment that they designed, that people can choose to use or not. We can tell people that there's a long-term price associated with this, but people that choose to support Apple's model are not in the same boat with people that choose not to believe in carbon dating.

> It's irrelevant how many people believe in something if they're wrong.

“Wrong” asserts a level of objectivity which has not been established.

My argument is simple: the computer industry has failed to produce general-purpose devices which non-specialists can safely operate. That's security threats like phishing, but also just the ever present fear almost all computer users have of installing something which will break or degrade their computer.

When a high percentage of people choose to buy devices which are more restricted – and thus safer to use – the correct response is not to crank up the smugness and say that they need better education but rather to ask what we should change to make a general purpose computer safer without going all of the way to the app store model. As the most obvious example, strong mandatory sandboxing could be a big improvement while still allowing a knowledgeable user to adjust the sandbox policies or develop their own.

> A billion people believe the Earth is 60,000 years old and was created in a week by an all-powerful bearded deity

I find this comparison apt, but presumably not in the direction which you intended:

We have a preponderance of evidence that people cannot operate computers safely, ranging from the billions of dollars spent on support and data recovery services to e.g. ransomware being an industry with at least 8 figures of annual revenue.

Smugly asserting that people buying safer alternatives is due to poor education seems rather close to the creationists who assert that every hole in their theory is caused by insufficient faith. If that was ever going to work, it would have done so already.

Your providing a service not teaching a religion. No 1 most perversive failure in all tech projects, ignoring your end user.

Apple creates devices that are user friendly, they win. Guy creates software that's pain in the bum to use and requires a manual, they lose.

Now more then ever users expect a stylish non-complicated experience. If you don't provide that then users will just move on to the next alternative.

> The renderer is not some minor detail like how tcp connections are made, it's practically the whole thing!

It's totally not.

All the things you list are just components of "showing a web page in this rectangle". That is akin to "how tcp conections are made". The renderer used to be hugely important because many renderers didn't work at all for some sites and features, or were massively slow. That's still true to an extent and why the renderer is still an important point.

But the browser itself is more about application features (and maybe cloud features).

How do you manage windows? How do you manage 10 tabs, or 250 tabs? How does it store your passwords and how do they sync across devices? Can you pull out your phone and easily jump to a web page open on your desktop back at the office? Does the browser crash a lot? Can the browser remember your font zoom settings for each site you visit? Can you override preferences for certain websites conveniently? How can you visualize the current set of websites you are on, or this history of sites you have visited. Can you easily restore a bookmark set of twenty websites? If so, does it restore your window sizes, positions, and tab order? Can you easily identify which window/tab is making annoying sounds? Does it have a 1Password extension? Does it override standard OS features like Print (to PDF) with its own lame-ass UI for the same thing (lookin' at you Chrome)? When you copy text, is it smart about putting the different representations of the copied data on the clipboard so it works optimally whatever app you are then paste into? Does it let you have different profiles to keep e.g. your work cookies separate from your pr0n cookies? Speaking of cookies, how easy is it to inspect and deal with them? How does its extension mechansim work, and what is its defense story against the installer-malware that comes with e.g. Java? Is it fast to launch? Can you easily re-open closed tabs and windows? If so, do they retain their state and Back/Forward history? Can you easily customize things like font and zoom and override bogus sites? Does it have an ad-stripping "reading" mode or does it need an extension? Etc.

In modern times, those things are a lot more important to me than the renderer (unless the renderer is broken).

I love how you're talking about the process from a user point of view. This is truly a difficult time for Mozilla. The rise of iOS means that independent renderers have not as much of a voice as they could have. It is scary because a user will maybe rely on features that exist on Firefox on another os might not work on Firefox on iOS.

The renderer is still very critical for developers. We don't really have a browser without a renderer after all.

To my understanding, chrome's incognito mode means everything you did within incognito will not be saved and applied to regular mode. But everything you did within regular mode will be applied to incognito. This works for localstorage and passwords. (Not sure about cookies, since my login session doesn't preserve in incognito, I guess cookie is not shared)

Are you sure it keeps localstorage? I was under the impression that passwords from normal mode were shared because that's a "meta" feature of the browser rather than part of the API web pages use, but localstorage and cookies weren't.

Well, I just checked and it looks like localStorage is not shared. But I recall it was shared when I checked sometime last year, maybe a bug back then.

That is amazing.

I was think about the same recently. You put a lot of faith in incognito mode working as you expect it to on the 'edge' cases (e.g. third party plugins, cache, cookies) but this seems like it does not work even for a pretty straightforward case.

[I use edge there pretty liberally, even those cases are pretty far away from the edge]

Isn't that a limitation of the iOS platform, not Chrome?

Perhaps, but Chrome's configurable search engines are all unacceptable. As Firefox has DuckDuckGo as a configurable option and DuckDuckGo doesn't track you (so no HTML5 local storage issues to deal with), it's a great workaround for that limitation.

Aren't you now conflating a browser platform issue with search engines?

Any website using HTML5 local storage could exploit the iOS problem.

Yes, due to convenience (and app limitations). I want to be able to open an incognito window, do a search, and close the tab and have all history wiped. In iOS Chrome, because the least unacceptable search engine option is Google, this means history is actually tracked due to the HTML5 local storage issue. I could work around this by opening an incognito window, typing duckduckgo.com, and then doing a search but that's extra effort. In iOS Firefox, DuckDuckGo is a search engine option, so it avoids the issue without requiring extra effort.

Couldn't you just open incognito window (in Chrome) and go to duckduckgo.com to search?

Regardless of browser or platform that would solve your search engine problem.

Um… he addressed that already:

“I could work around this by opening an incognito window, typing duckduckgo.com, and then doing a search but that's extra effort. In iOS Firefox, DuckDuckGo is a search engine option, so it avoids the issue without requiring extra effort.”

Anything we can improve in Firefox for iOS to make that a better experience? Private Search Shortcuts?

I'm not sure what you mean by private search shortcuts. Would this be a search box that you type something, press ENTER, and it does a search in a normal tab or I could do something else to make it search in a private tab? Or something as easy as Chrome's three dots > "New Incognito Tab" and I could immediately search from the URL bar would be fine.

Having played around with Firefox on my iPad, here are some things which are annoying (I mentioned a few of these elsewhere in this thread). I can see that many of these decisions were likely taking into account the limited real estate on an iPhone where I can understand the limitations, but it makes for a poor iPad experience. Safari and Chrome generally get these correct in a single app by adjusting the functionality based on the screen size.

  - Adding a tab takes two steps: click the number box then
    click "+" to add a tab.
  - Closing a tab takes two steps as well. Why no "x" to close?
    The "star" icon is exactly where I'd expect the close option
    to be. Consider the frequency of someone closing a tab vs.
    marking a URL as a favorite and the resulting UI should be
    obvious.
  - Adding a private tab is three steps: click the number box,
    then click the Private Browsing icon, then click "+".
  - Swapping between regular and private tabs involves three
    steps: click the number box, enable/disable the private
    icon, then click on the tab you want to focus on. In Chrome,
    this is one step: click the Incognito icon which immediately
    swaps between the most recent active tabs in each mode.
  - You can only view one tab at a time. Not only does this make
    switching between tabs tedious but you also lose context;
    not seeing a tab you've opened in the background that you
    mean to read later will generally go unread.
  - "Settings" available via the tab management interface. This is
    a rather unintuitive location to manage application settings.
    Why not have app settings available from within the iOS
    Settings app?
  - Editing the URL of a tab hides the tab's content. Not sure what
    the thinking was here, but if I want to access thumbnails,
    bookmarks, etc. I'll do this from a new tab, not by manually
    editing a URL. Consider the use case of a URL shown in a web page
    but it contains tracking info. I might want to manually type it
    instead of clicking, so when the page contents vanish it's
    difficult to do that.
  - Unable to search for text on the page.

That's what I've run into after five minutes of playing with it. I might keep this on my iPhone, but as it stands it's unusable (compared to alternatives) on an iPad. Safari and Chrome generally get the iPad UX right.

@st3fan, riding off biot's comment because he hit a lot of the right points.

First off, congrats, this is amazing and beautiful. I've been a long time Firefox poweruser, and here are some of the things I noticed myself:

    - Lack of differentiation between bookmarks, history, open pages, tags, etc. in URL bar.

This is vital for a power user feature I use a lot: browser.url.restrict.* (in about:config), allowing me to quickly get to a page from history, an open tab, or a bookmark. You get the idea :)

    - Inability to reorder tabs
    - No context of tabs opened/ to switch to
    - Unable to specify sync categories
    - Unable to disable password saving asks

Overall, biot is right: this is great from a iPhone POV, but from a iPad POV, there are more controls to bring into view to bring it to parity with Safari/ Chrome. As for going beyond what Safari and Chrome offers on iOS, carrying over the spirit of power user features and customization will definitely do it (like the AwesomeBar icon hints, switch to tab, urlbar match, search keywords, and more).

> Private Search Shortcuts?

IMO, private search shortcuts used to be really cool and then I switched to DuckDuckGo. Their !bang feature has all the search shortcuts I need (and then some), preconfigured :)

Since Firefox must use the same WebKit renderer on iOS that Chrome does, then it likely suffers from the same problem.

Of course, there might be a difference between UIWebView and WKWebView, and I don't know which Firefox is using.

Firefox is using the newer WKWebView, unlike Chrome.

Here is the relevant Chromium issue tracking the move to WKWebView: https://code.google.com/p/chromium/issues/detail?id=423444

That link also lists a hand full of Radars filed which are preventing the iOS Chrome team from moving to WKWebView.

Not too long ago I found that you can restore a deleted tab in incognito mode in Firefox. I was pretty shocked at that. Chrome behaves as expected for this particular test.

This is true only until that incognito session is closed. Future sessions will have no knowledge of that tab.

Similarly in Safari on OS X if you force-quit or uncleanly shutdown your Mac it will restore private windows when you restart it...

If you like privacy, why not use Safari ?

Has DuckDuckGo as a configurable search option too.

There were a few annoyances with Safari that I never really liked such as the inability to search for text within the page. In verifying whether this is still an issue, I managed to locate the "Find on Page" option hidden in the "Send to" menu, clearly something I never expected. Safari also used to hide the contents of the page as you edited the URL bar, something which is now fixed and I notice you can use that to find text in the current page as well. And now that I look into Firefox further, I don't see how I can search for text within the page here either and Firefox hides the page contents when you edit the URL.

Looks like I'll be giving Safari another try.

> I never really liked such as the inability to search for text within the page

You can actually find in page by typing a keyword in the address bar. There will be an "On this page" section at the bottom of the suggestion list, which you can tap in and jump through all matches. If I remembered correctly, this feature has been available since iOS 5 or so (which were a little bit clearer back then, since search box was separate from the address box).

Yep. It’s a feature that’s already been around for quite a while. Safari on my iPod touch (3rd generation) running iOS 5.1.1 has it.

Aren't we supposed to avoid stock Apple options due to concerns about privacy? For example, isn't Safari proprietary, suggesting that we should choose an open-source browser? Are Apple apps actually good for privacy?

Why would you trust Apple for iOS but not for Safari?

I wish people would stop thinking DuckDuckGo cares about your privacy. It's all marketing BS. The founder sold his old startup in 2006 to classmates.com, an incredibly scummy company.

Incorrect. He sold his social network "The Names Database", to classmates.com, in 2006. DDG came later.

This is exactly what I said.

Almost everyone assumed you were talking about the object of your objections: DuckDuckGo.

[citation needed]

Yeah, not the intended purpose of that meme.

Like chris_wot below, your comment reads as if you're talking about DDG.

So you downvote me? Nice. #not

"Incognito mode" is meant to stop data from being stored on your computer, not Google's. This is written in plain English every time you start a process in "incognito mode".

Reply on news.ycombinator.com