Waterfox – Firefox fork retaining XUL support | Hacker News Reader

Waterfox – Firefox fork retaining XUL support

waterfoxproject.org

146 pointstwobyfour115 comments

Huh, didn't expect to see this on here again!

Just before I continue I'd like everyone to know I have complete respect for Mozilla and everything they have achieved with Firefox in v57! It really is awesome and a testament to their engineering talent. I used to submit patches to them to get the code base compiled with Intel's C++ compiler and they really are great in communicating with you and even going out of their way to fix obscure issues. I hope to return to submitting more helpful patches and I'm excited to see where Firefox goes from here on out!

Now on to some other points:

* v56 with security patches from v57 is available to test here if anyone is interested: https://www.reddit.com/r/waterfox/comments/7ed9sf/waterfox_5...

* v56 will stay here with security patches remaining until the end of v59 ESR (I'll be using it to track security issues and patch them).

* In the spirit of YCombinator and HN, my next step after the release of v56 is to go to VCs (or other funding sources) and show that open source projects can be successful business ventures without having to sell out the user. Then hopefully set up a team and create a power-user focused browser based on all the exciting technology out there - (servo would definitely be a fun base).

Of course I'm young and Waterfox was a side-project that I thought made me a real programmer at 16 because I managed to set the 64-bit flags on MSVC (oh dear). I never thought it'd basically become a full time job, get me into prestigious universities and even land me job contracts because of all the years I spent working on it!

If anyone has advice I certainly wouldn't knock it and it would be much appreciated. If you think I'm crazy go ahead and let me know as well haha!

I have a lot of respect for open-source contributors and for OSS project maintainers.

However in order for a fork to be sustainable it means that it needs to be more than a rebranding, otherwise it cannot survive. In particular, if Waterfox is retaining the XUL support, then it's going to get harder and harder to merge upstream Firefox into it, which means a bigger and bigger burden on you.

> my next step after the release of v56 is to go to VCs (or other funding sources) and show that open source projects can be successful business ventures without having to sell out the user

If you succeed, that's going to be great, since it means more funding for open-source.

However the elephant in the room is that you're dependent on Mozilla's developers for continued development. That's much like greenwashing, you know, how some companies claim to be "green" by outsourcing pollution to other countries.

And implicit in this claim is that Mozilla is selling the user out and I don't see how. I understand the reticence for Google being the default search engine, but as a DuckDuckGo user and as an European I can tell you that the difference can be night and day. And it's easy to change the search engine, there's no other browser that makes it easier, desktop or mobile.

Speaking of which, Ecosia might be cool for having trees planted from its revenue, but it kind of has the same problem — being dependent on Bing and thus Microsoft. And I'm going to guess that the results are at least as poor as DDG and the problem for users is that most users will apply the "three strikes you're out" rule, because you don't want to second-guess your search engine on every search, unless you really, really care so much about privacy that you can take that pain and most people don't.

Sorry for the delayed response!

> However in order for a fork to be sustainable it means that it needs to be more than a rebranding, otherwise it cannot survive. In particular, if Waterfox is retaining the XUL support, then it's going to get harder and harder to merge upstream Firefox into it, which means a bigger and bigger burden on you.

I am aware, but the plan is to keep XUL support going for now until the end of ESR 59 (Q1 2019) and by then having an appropriate replacement.

One path was the idea to keep following Firefox except to extend the APIs available (and submit them to Mozilla as well in-case they get would like to merge).

> And implicit in this claim is that Mozilla is selling the user out and I don't see how.

Sorry I didn't mean it to be interpreted that way! Just meant that the general stigma about OSS + business not working together (although the last few years that has been changing).

> Speaking of which, Ecosia might be cool for having trees planted from its revenue, but it kind of has the same problem — being dependent on Bing and thus Microsoft. And I'm going to guess that the results are at least as poor as DDG and the problem for users is that most users will apply the "three strikes you're out" rule, because you don't want to second-guess your search engine on every search, unless you really, really care so much about privacy that you can take that pain and most people don't.

I see. Well I believe it's still worth it and from feedback I've heard, many people don't mind the results as they find Bing results fairly decent and are more than happy to support the project. I don't think it's too unreasonable to not want to have to rely on Google for everything? People are free to use it if they want to though.

It's not unreasonable to want to be free of Google. I went through this process already, which is why I'm a Firefox and DuckDuckGo user and a FastMail customer, having used Google Apps before.

I'm glad to see your attitude, I guess I've read too much between the lines — personally I'm a little annoyed by a double standard I've seen here regarding Firefox, which is somehow held to a much higher standard.

So good luck to you and your project.

On a separate note (Since title says XUL support), how do you plan for Waterfox to keep getting extension updates as, developers will slowly move away from XUL? Would Waterfox support both? If yes what's the point of spending energy on XUL?

I'd like to see it more as a stepping stone for when Mozilla extend their API/we implement similar ones that keep a lot of the old functionality found in the low-level APIs. I've mentioned to the users already it would be unfeasible to do it by myself and this would be a good stepping stone. Hopefully more competition is seen as healthy that everyone can benefit from.

Thanks for all the work you do, Alex!

Will we also ever see quantum-based waterfox?

With him wanting to keep compatibility with XUL, that's basically impossible. Mozilla didn't just deprecate XUL for fun, compatibility with most XUL extensions is now already broken, just because they moved around so much stuff in the browser to achieve Quantum.

If you’re thinking abount funding, you must have a vision of profitability, mass adoption, controlling a platform, or amazing innovation or technology.

What’s your business model?

Currently: - The browser is generates revenue with next to no cost (although employees etc. and that changes, but hopefully a better product means more users) from search engine revenue. They pay quite a bit as well, depend on the search engine some reach between $70-90 CPM. - Although there's no direct way to measure, assuming we can woo the current user base, there's around 50K active a day using the default search engine from what I'm told - Brave, Vivaldi etc manage to keep a decent user-base being based on Blink and a basic feature set.

I speak with the users almost every day, am always transparent with them and some users have been using the browser for years. There always seems to be people looking for 'something else'.

More importantly, I have a voice that gets heard by the users as they're very involved with everything - loyalty which I think is something money can't buy. I have received funding before for a spin-off, so I don't think it's an impossible situation.

Alex, with your confidence some past successes you're already checking the right boxes. I sincerely hope this ends up being a win for you, good luck.

Apart from retaining XUL support, it also:

  * Disabled Encrypted Media Extensions (EME)
  * Disabled Web Runtime (deprecated as of 2015)
  * Removed Pocket
  * Removed Telemetry
  * Removed data collection
  * Removed startup profiling
  * Allow running of all 64-Bit NPAPI plugins
  * Allow running of unsigned extensions
  * Removal of Sponsored Tiles on New Tab Page
  * Addition of Duplicate Tab option
  * Locale selector in about:preferences > General

Judging by that feature list alone, this seems like a browser that respects user privacy, is against DRM and advertising to its users, and gives the user the power to run any extension they want instead of limiting them to running only signed extensions.

> limiting them to running only signed extensions.

Surely you recognize that we are part of an extreme minority of users. For everyone else this change is extremely positive. Gone are the days of malwares installing themselves as browser extensions. Requiring power users to switch to Dev/Nightly to run unsigned extensions is a pretty small ask for a change that will stop friends and family from having horribly infected browsers.

isn't there also an unbranded version that's the exact same as the release, but does support unsigned extensions?

Yes, it was announced in https://blog.mozilla.org/addons/2016/07/29/extension-signing...

Maybe GNU IceCat?

Are there any forks of Firefox that do all/most of the above but keep the new Firefox UI?

Or alternatively is there a one-click way of doing all/most of the above to regular Firefox?

Can I also add DuckDuckGo as a search engine without it adding &t=ffab to query urls?

Presumably it's to track "firefox address bar" as the query source, but I don't see why it needs to be there, and why I can't remove it as easily as I can in Chromium.

You don't see why it needs to be there? So they can know how the search function is accessed by users to improve UI, or to know that people are using Firefox specifically to access their site. It's called telemetry, and it's not always evil, not always a violation of privacy.

I know individual bits can add up, so I only think it's a /little/ bit silly to worry about. Honestly: Of all things privacy related regarding web browsers and the web in general, is one of the best browsers letting one of the most respectful search engines know a UI hint really that bad?

I think that's very reasonable, thanks for the insight :)

  * addition of duplicate tab option

Why can't Firefox and Chrome add this functionality?

How it should work: In IE11 it's Ctrl+K and it opens a new tab (a deep-copy of the current one, incl history so one click on the back button in the new cloned tab.

Duplicate tab option is present here in Firefox 57. It's in the right click context menu on any tab.

Is it too much to ask for a simple shortcut, like Ctrl+K

Ctrl+T ... new Tab

Ctrl+K ... dublicate Tab

Ctrl+W ... close Tab

I won't start clicking around on the tabs. Please add the missing shortcut (Ctrl+K)

can you file a bug in bugzilla.mozilla.org? It should be easy to do!

source: I added the duplicate tab context menu option in Fx57

Ctrl+K is already search in both Firefox and Chrome.

Chrome has had this functionality for a very long time. Right click on a tab => duplicate.

Clicking in the URL bar (or Ctrl-L) then pressing Ctrl+Enter also works. Ctrl-Clicking the back and forward buttons also opens items in new tabs. s/Ctrl/Command/g for macOS.

A lot of Developers are great at applying modifier key behaviours consistently with the button and key combinations you can think of, especially with Shift and Ctrl/Command :)

As others already mentioned, Firefox has this exact functionality available in the context menu (4th from the top) but also when you middle-click on the reload button.

In addition to the middle-click refresh and context menu entry that others have mentioned: you can hold down Ctrl and drag the new duplicate tab anywhere.

Browsing this on FF58, and at least here I do have a duplicate tab option.

It even duplicated my "add comment" tab with the text in the textbox retained.

On another note, XULRunner was a JS runtime with XUL for UI markup, like an early Electron. It's a shame the project was scrapped, I really enjoyed writing XUL+ES5 and seeing XML become native widgetry. (It's the platform that Firefox was initially built on, I don't know how much of it is still there now)

Bring back XULRunner :'( That project was way ahead of its time

XULRunner was a great piece of tech!

> (It's the platform that Firefox was initially built on, I don't know how much of it is still there now)

Looks like it was completely removed in this bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1221724

Although I suppose some form of it is used in Firefox now (although I imagine XUL will get removed some time after XBL has been replaced with WebComponents).

I wonder what kind of effort would be required to port it to node/V8? IIRC XULRunner's main handicap was relying on Moz's older-gen JS engine

I would personally be interested in using XULRunner's innards to create a dependency-less cross-platform GUI framework (as a C library ala libui). Does anyone know how easy that would be and where I should start looking?

I don't have any answers for you, but it's worth noting that Moz worked around the JS speed limitations with bespoke C++ via XPCOM.

why XULRunner instead of Graphene (i think it's called that)?

I wonder if someone actually just made a Electron equivalent from the XUL + ES6 combination.

Developers are free to spend their time on whatever projects they wish, but I suspect that Waterfox users will quickly run into the tradeoffs between customizability and performance that the Firefox team made.

It's a noble effort but I suspect there just isn't a big enough community to keep a XUL-based browser (plus the extensions themselves) moving forward while being as secure, web-standard-current and fast as Firefox proper.

I'm not sure that there will be many XUL extensions left maintained after a while -- since no major browser supports them and the fact that WebExtensions is a much easier framework for development. As a result, I don't see much of a future in Firefox pre-Quantum forks.

Yes, in time there won't be any XUL extenions. But what do they say we are all supposed do with that tiny nagging:'it worked yesterday, but not today' problem?

Firefox's Extended Support Release, which will keep getting updates for almost a year, certainly helps.

I've been on ESR because of vimperator/pentadactyl not being portable, plus some other extensions like FoxyProxy, Tree Style Tabs etc.

But today I discovered tridactyl works well enough on latest FF to suit my vim-ish needs, while the other two have been fairly completely ported.

Thanks for the tip about tridactyl, I've only seen Saka Key so far in this space.

Neat saka tridactyl and vim vixen several interesting choices

I did not like Saka Key (some weird behavior sometimes), but Vim Vixen comes close to VimFx.

Plus, there's already Pale Moon, which shares a lot of the same goals that this one seems to.

Using forks of unsupported Firefox versions/features (this, Pale Moon, etc.) is a good way to introduce vulnerabilities into your daily browsing.

Firefox ESR should be the addons stopgap of choice while they’re ported.

We'll see if 52 ESR reaches end-of-life before webextensions acquire the needed functionality to do the ports.

Pale Moon reportedly backports security patches.

Sure – not trying would be obscenely irresponsible. But:

1. I don’t trust them to do that right

2. You’re later to get the same patches

3. You can’t backport patches for removed features

It's funny that you say these things with such confidence when you're demonstrably wrong (ie, 3) by simply looking at the Pale Moon update logs and the 'Defense in Depth' "fixes" for vulnerabilities that don't exist in PM but do in FF which are changed anyway just to be sure. http://www.palemoon.org/releasenotes.shtml

#3 is a weird one to take issue with. Unless by “demonstrably wrong” you mean “objectively right”? You can’t backport a patch from a fork for a feature that doesn’t exist in that fork. You can make your own patch. XUL ones can come from ESR… except when you don’t fork ESR. Oops! A fork has to be able to maintain the browser as well or better than the Firefox community does right now, and again, I don’t trust any of the fork teams to do that.

You’re also misrepresenting what “Defense in Depth” changelog entries in Pale Moon mean. For two of the five on the current page: CVE-2017-7809 was fixed by Firefox; NPAPI plugins aren’t supported anymore. The other three aren’t specific and don’t link to an issue tracker or patch, so it’s hard to say.

Well, 1 is your opinion so it's hard to change that. 2 is obvious and not really a problem. So the only thing you had was 3.

And no, I mean demonstrably wrong. But you are right that all the useless attack surfaces that Firefox has (ie, WebGl, Websockets, Pocket, etc) aren't in Pale Moon. Luckily for PM it doesn't need to do as well or better than Firefox because it simply doesn't have all the excess "features".

Maybe an example will make it clearer to you what #3 means. Firefox stops supporting certain types of extensions. Firefox stops making security patches to this (eventually) removed feature. Because there are no patches, you can’t backport them to your fork. From this, we have the objectively correct

> 3. You can’t backport patches for removed features

which is just as obvious as 2 – and they are important.

Ah, I finally get what you're saying. You're complaining that forks will have to support code that Mozilla no longer does.

Yeah. That's the point of forks.

They're not complaining, they are pointing out that this is a bunch of work that Palemoon's authors need to do, just to be no worse than Firefox. Work there isn't much evidence of them doing.

WebSocket is useless? WebGL is useless?

I mean, you're entitled to your opinions, but these are pushing the envelope of silly.

> Pocket

That's just a plain extension they bundled...

This reminds me of: https://news.slashdot.org/comments.pl?sid=8898847&cid=517351...

Practicality aside, benefit #4 of open source is just this. That you can fork and with some dexterity include things that fit your purpose like Security fixes, while leaving out those you don't

Practicality aside, you could install a Developer Edition of Firefox, set extensions.legacy.enabled to true, and keep using your extensions until the underlying XUL APIs get removed.

Have you tried this and it worked well for you?

Mozilla has shifted around and swapped out tons of code in Firefox since the official deprecation of XUL extensions. So, I imagine most XUL extensions will be broken by now just on that account.

Maybe I want to use my extensions until the WebExtensions API is up to the task?

Yeah, ideally. They're still adding on features pretty quickly.

I used Waterfox long time ago, as a fast 64bit alternative to Firefox (although never noticed a significant speed difference). Now I think the only reason I'd still use it is because add-ons such as Vimperator, but I already switched to the less powerful Vim-fx.

I love the idea that projects such as this one or Pale Moon exist, but I find it hard for me to use them as a regular user, apart from sentimental reasons.

FWIW, I've had much better luck with vim-vixen than I did with vim-fx. Obviously ymmv

Have you tried tridactyl?

I don't believe I have, I'll give it a shot sometime

I'm going to give it a shot now, thanks for the suggestion

You are right, and in fact is vim-vixen what I'm using right now, I guess after trying so many alternatives after updating to FF57 I just got confused about what I finally had installed.

I've been trying a few of them out. I had to look at which one I had installed. Unfortunately, there doesn't seem to be any plans to put in the proper APIs to make anything nearly as useful as vimperator.

I just completed my first Firefox for Android build and I have to say that Mozilla makes it really easy to get started [1] - I plan to run a personal fork/modified Android version from now on if this works this smooth.

Ignoring the huge download, this has been one of the easiest open source projects to build so far. I'm impressed.

1: https://developer.mozilla.org/en-US/docs/Mozilla/Developer_g...

What's your reason for building your own FF for Android may I ask? Just curious...

Firefox improves greatly in speed and features - I like that and don't want a long term release thing or a radical fork like the one discussed here. I can live with some plugin issues on the desktop (web extensions being less powerful). But I refuse to use Firefox on Android without 'Share To Bottom' [1]. Feel free to link to xkcd's "you broke my workflow", but without this feature my blood pressure is constantly too high.

Whenever I long-press on a link I want either (80% of the time) 'Open in new tab' or (the rest of the time. No exception. Never anything but these two things) 'Copy link'. I never ever want 'Share', but some time in the past Fennec/Firefox for Android moved that option to the top of the menu. I filed bugs for that, got shot down rather quickly and stumbled upon the addon [1] as a workaround. The workaround is now broken and so is literally nearly every single (I rarely just click links, always long-press them. I have sometimes more than 90 tabs open on my Android phone) interaction with a link on the internet. The menu is annoying me with a prominent button that I never want, but press in error again and again (probably adding to Mozilla's heatmap, so that they'll conclude in the future that this was a very good change indeed! Lots of people click "Share"!).

So right now I created my own Firefox build and I'm trying to do this the nasty way (still searching my way around in this codebase, but I plan to completely remove the 'Share' menu item. A hardcoded 'Share To Trash' modification, if you will). I'll happily rebuild the browser for this change, for all eternity.

(Note that I never understood the 'Share' option in that menu in the first place. Everyone I see around me uses 'Share' from the page menu, i.e. the top-right … thing. To share the page you're _actually_ looking at. Instead of sharing a link to a page (via a popup menu) that you cannot see right now. So the version I envision still allows you to share stuff, just not from the context menu of a link)

1: https://github.com/miraks/ShareToBottom/

I've used the "share" option on that long-press menu recently, to share a link through zxing's Barcode Scanner to another person's phone. Unfortunately, doing that seems to somehow have moved that rarely-used option to the top of the menu, above even the frequently used "open in new tab" option.

Hmm. If that happened only because you clicked it once, then it should be reversible to "never wanted it in the first place" somehow, I hope..

Might be worth investigating..

Thanks! It's also disappointing that something as simple (functionally) as this cannot yet be implemented through WebExtensions. I really hope they beef up the API soon...

from time to time i lose firefox extensions because they are not updated anymore; with firefox 57 i am losing my beloved fireftp, which is still available on waterfox... but there's no way i would get rid of firefox, even for fireftp

I don’t know exactly what your situation is, but I had hundreds of sites saved in FireFTP. It won’t get you FireFTP in Firefox 57 but I wrote a utility to help move them over to FileZilla. Maybe it can help you too.

https://github.com/myspoonistoobig/AtomicFire

Oh thank you, that's great! No, I used to use at most 2 or 3 different logins, mainly one. And I indeed switched to FileZilla

Well, if this allows people to bridge the gap until the WebExtensions API in Firefox is comprehensive enough for their needs, then I'm all for it.

Firefox 52 ESR would probably be the safer alternative. It will receive security updates until June 26, 2018. And I honestly just can't imagine Waterfox or other forks trying to keep XUL compatibility to stay secure long after that, as XUL extensions used to be a major maintenance burden for Mozilla and these forks have only a fraction of the size of Mozilla.

Or for those of us who find the new UI problematic.

There is also SeaMonkey, how do waterfox and seamonkey compare?

SeaMonkey is a different code base in the sense that the point of divergence was long, long ago. Waterfox on the other hand is very close of recent Firefox versions. SeaMonkey is descended from the Mozilla Suite, from which also Firefox descends, but SeaMonkey retains components that Firefox didn't like email, Composer, IRC chat etc.

BTW, I hope SeaMonkey gets a few more devs and love... from what I can see it's struggling badly. I hope to be wrong on this...

When the decision was made to make a browser-only version of the Mozilla suite, a separate front-end was built on Gecko eventually called Firefox. The legacy suite was renamed SeaMonkey, and it still uses the same repository. The trunk version of SeaMonkey uses the trunk version of Gecko, and it doesn't fork or modify the stock Gecko in anyway.

Seamonkey is much older, and not really a fork as it follows current day Firefox development quite closely.

Hell, one may well call Firefox a fork of the browser part of Seamonkey.

A more interesting comparison to Waterfox would be Pale Moon. And there is also Basilisk, a more recent project by the Pale Moon people.

Sadly, Pale Moon is still not available on Mac. I wasn't aware of Basilisk, though! It appears that that one too is Windows/Linux only.

I thought SeaMonkey was still the entire suite (email client, HTML editor, etc). It seems to be further behind in keeping up with Firefox.

Has anyone here done any line of business/crud type of app with XUL that they feel has been successful? I'd be interested in hearing any short description of the ups/downs of your efforts.

About 15 years ago German car rental company Sixt migrated some mainframe based console UIs to XUL, while keeping the backend in COBOL. They focused a lot on reaction time and keyboard shortcuts as the tool was used in the call center to capture damage reports. I have no idea how much of this is still used. Slides from an old talk about this: https://blog.mayflower.de/uploads/XUL_xtech2.pdf

Thanks for this. I played around with XUL in 2004 for the first time - and last time. Being totally blown away by its native controls then, I suggested it for an in-house insurance app my client was developing. My recommendation did not receive much respect! They ended up developing an ASP app.

If only people would put their efforts toward making WebExtensions support better, with features they liked from XUL, like they do with their XUL forks...

That's kind of hard when this requires changing the WebExtension API, which Mozilla seems to be very hesitant in doing.

Only to be denied by Mozilla over "security"?

> "Addition of Duplicate Tab option"

As a user of both Chromium and Firefox browser, I miss this option in tab's context menu in "stock" Firefox browser.

When did you last test? For me, using Firefox 59, there's a "Duplicate Tab" entry when I right-click on a tab.

Also, I know for a fact that you've been able to Ctrl+drag to duplicate a tab in Firefox for years and years now, because I do it every week. :)

It's in 57 for me.

If you have a mouse with a middle button (or just one with a left button and a keyboard with a CTRL key) you've been able to do this since probably Firefox 1.0 by clicking thusly on the refresh button in the target tab.

I believe Mozilla added it back in with the Photon work.

Yeah, they implemented it in Firefox 57.

or middle-click the reload button?

Why not Pale Moon?

Pale Moon is a 3.5 fork, it's ancient, although it's gotten a lot of independent development.

AFAIK it's rebased onto Firefox 38 and there will be another rebase in the future based on Basilisk release (should be similar to Firefox 53-54)

Do you not wonder that this fork will suffer the same fate?

Waterfox has been around for a while. What fate are you talking about? Pale Moon is still in active development and use as well. I use it on some older machines for performance reasons.

Because Mac?

Also, Pale Moon forked much longer ago and has diverged more significantly from Firefox, AFAICT.

when the first firefox 57 beta came out I tried pale moon and too many of the extensions I used wouldn't work on it. They worked with Waterfox. I use firefox as my main browser but there are a couple extensions that won't be ported over that I keep waterfox installed to use.

For a while I was thinking of the idea of Gecko for legacy XUL support and Servo being WebExtensions only.

I become more and more convinced that Mozilla could have saved themselves a lot of pain by giving FF57 a completely new name and version number, rather than suggest it is a continuation of the venerable Firefox lineage.

Idunno, that'd be an uphill battle in terms of branding, and you'd split the userbase even more than with a simple update

I use Waterfox every day. Mozilla may want Firefox to be a Chrome clone, but I still use my 'old fashioned' extensions and don't need new (pardon the pun) chrome all over the place.

I've been using it too, especially since FF 57 for some reason breaks images on some websites. I've also been using Qutebrowser some, which I love for the keybindings.

I find it hilarious that while they took the time to give FF57 a new "touch" UI, the zoom gesture is still only enlarge the font size.

go to about:config and set browser.zoom.full to true this will cause the whole page to get zoomed.

Reply on news.ycombinator.com