Why we Forked Firefox and Not Chromium
0x65.dev
0x65.dev
In the context of a browser fork, these statements make no sense: "Firefox has open APIs for everything the browser does [...] Chromium on the other hand does not expose certain areas that are sensitive to Google’s business." In the context of changing the source code, how are some APIs "open" and others not? How can the Chrome code possibly "protect" (their words) the address bar from modification relative to any other code?
I think what they're instead talking about is the available extension APIs from JavaScript maybe? But in that case, why call the project a fork, instead of a browser extension or something?
"Firefox has open APIs for everything the browser does—a majority of Firefox “application” code is written in JavaScript. Chromium on the other hand does not expose certain areas that are sensitive to Google’s business. The most notable example is the address bar (where Cliqz search lives). Google has no interest in making it easy for others to take control of the address bar; the flow to the default search engine (Google) is protected. Of course one could create new APIs, but that would imply creating them on top of the source-code. This is not a big issue, we have already created a prototype, but then there is the problem of maintaining it."
For the question of "why not call it a browser extension or something" because "browser extension" already means something completely different. It's also a bit wonky to think choice of language should decide if you call something a fork or not in the first place, doubly so considering significant portions of the browser are already written in that language.
Suppose you wanted a deeper change like it to automatically add .com .org etc to the address entered as long as that’s not a phishing website. Now you needed to maintain that patch going forward and reapply it to every new version of the base browser. That’s much safer if the address bar’s code is isolated from the rest of the browser.
So in this case, the core framework being exposed to javascript is evidence of the expectation of external users, thus it will likely not be a moving target. If you're modifying some software, you will greatly prefer programming to an API than not.
In this case, going with Chrome would mean very invade changes to enable exposing things the upstream specifically wants to keep private in their codebase. Firefox instead requires only well-delineated, minimally invasive changes because there is a nice clean boundary between UI code and engine code (which incidentally matches c++/js boundary, the languages themselves don’t matter much), which means their changes can be isolated to the UI layer, which in turn means a much cleaner path to merging upstream changes
Initial version often involve heavy surgery. Then the maintainers have to manually merge from upstream essentially forever. Manual merges are not fun, they are tedious, and they are prone to errors (in part because they are tedious).
Over time these companies get a better grip on the bare minimum they need from Postgres' internals and file PRs. The goal is for their changes to be an add-on instead of a code fork.
From what I understand, Postgres team rarely has any vested interest in being antagonistic to these companies. Google's business model pushes them toward being antagonistic to any such efforts. Which means cliqz is stuck managing a fork forever, and may even run into cat-and-mouse games.
The only way to win is not to play.
Whether or not it's been bound to a scripting language does not make it any more or less "open" or stable (which is what they seem to actually be looking for - stability). They forked the code, everything is an "open API" at that point. There is no concept of open API vs. not when you're just talking about the source of a project.
Whether or not an internal API is stable is relevant. But that stability is independent of which language it's in, and the only way to determine that is to either look for author intent or history of the API. Just because it's currently exposed to JavaScript doesn't mean it's stable at all.
And just because it's internal doesn't mean it's not an API.
I don't understand why this sort of product exists though. As a user, whether or not I'm aware of the difference, I don't want the additional memory overhead of running a separate browser, the separate cookie jar, the delayed updates, the additional bugs... the better approach would obviously be to work with FF developers to add the extra extension APIs they need; I can only assume they took that path but got rejected. If you're a Firefox user, ie someone who inherently places their trust in the security and privacy decisions of Mozilla, that's probably a red flag.
Hi, I'm an engineer at Mozilla working on the address bar of Firefox. We recently released a rewrite of the address bar with the explicit goal of making it easier to extend and experiment with the address bar: https://bugzilla.mozilla.org/show_bug.cgi?id=quantumbar
You're welcome.
Good to hear that Mozilla changed their mind, when we proposed an open API for extensions to access the search area it was turned down
Fair enough, but to be fair to cliqz, we didn't turn down their API proposal due to privacy or security concerns. The old address bar stack was kind of a mess and hard to extend in a sane way.
> Do you think the address bar rewrite will be able to satisfy cliqz's needs and therefore allow them to unfork/go back to being an add-on?
The rewrite makes it technically possible to provide any APIs they'd need. I think we'd consider patches, as we did before, with a better chance of them getting accepted.
I hope to soon see a cliqz blog post about their project unforking, only spun as an ingenious way of saving memory, improving security and extending reach.
Unfortunately, as we mentioned in a previous post [1], Mozilla is not totally independent when it comes to the presentation of search in Firefox due to their existing search deals, so they couldn't continue with the integration. This is why we needed our fork.
Disclaimer: I work for Cliqz
[1]: https://0x65.dev/blog/2019-12-11/the-pivot-that-excited-mozi...
They claim to be open and most things are opt in but im not sure why their "human web" is not opt in.
https://news.ycombinator.com/item?id=20058697
And the back and forth on whether you really need it:
I don't use Chrome, so I can't tell how bad it is on a comparative basis, but (especially in private browsing mode) Recaptcha can make you cycle through a half-dozen different images looking for the traffic lights or what not before letting you continue.
That's when I just leave. If I'm feeling nice, I'll drop the site owner a note explaining why, but usually not.
Nobody's site is that great.
You can sometimes trigger similar changes in appearance to the search results view by switching to incognito or clearing your cookies - Google often A/B tests or performs slow rollouts of changes like this, a difference in appearance could just be because a new user agent string got you placed into a different release group.
Incidentally, this is far from the first time google has been caught heavily optimizing exclusively for their own browsers, which, to be clear, is quite probably not explicit policy - but is monopolistic abuse nonetheless. Remember the youtube polymer redesign? The Edge HW acceleration-breaking invisible layers? I get the feeling they just don't test in other browsers nearly as well.
Given google's history here you really shouldn't be giving them the benefit of the doubt in this matter; at best they're consistently, repeatedly negligent; but it's at least conceivable there's culture of giving additional other google teams; which is a form of monopolistic power abuse.
Honestly at this point I’d like to give up on the user agent header and have everybody say they’re Chrome all the time.
Not a fan of Firefox and I refuse to like or use chrome.
Yawn.
IIRC though the main issue with YouTube was a slow polyfill library which has been fixed since they updated to the standardized version of Shadow DOM.
In which case Firefox blocks a lot of trackers so naturally their marketshare appears less than reality.
While this is not nothing, this should be a few 0.x % of global browser marketshare
Even after more than one year you can still not make a one-line space between paragraphs in YT comments without editing the comment afterwards because YT will always insert additional empty lines for whatever reason.
It did though. See this comment: https://news.ycombinator.com/item?id=21826191
I use user agent switcher sometimes to poke around on sites, YT is totally broken and I ditched using google search about a decade ago due to their policies.
https://addons.mozilla.org/en-US/firefox/addon/open-with/
(If your desktop environment supports drag and drop, you can also drag and drop vimeo or youtube URLs into mpv.)
[edit] picked the first video from "staff picks" on vimeo and it worked fine in FF:
I've always found the old design better (just like reddit), so I disabled polymer for YT and got both more performance and better UX out of that deal.
To try it out, just append &disable_polymer=1 after any YT video url.
It seems like the investment followed from using FF, not the otherway around.
Why doesn't Microsoft open source their engine if they're not using it any more? It can't possibly still have any of the NSCA code in it.
Microsoft is still a scumbag, claiming to support open source, releasing some of their middle-wear and buying GitHub, yet refusing to release something that could actually make our web community more diverse.
That's kinda just two browser engines. Blink is a fork of WebKit, and WebKit is a fork of KHTML.
Though I'm partial to the argument that provided the main options are at least FOSS, diversity of implementations is of minimal concern.
(Just talking about the sales pitch here, I haven't used it so I don't know if it offers anything more)
While it makes hacking on Firefox easier, isn't this a liability for performance? Is this, perhaps, partly why WASM is such a focus for Mozilla?
It's great that part of the UI handling code is fast, but that doesn't mean all of it shouldn't be fast.
In general Chrome and Firefox have both moved a lot of stuff from C++ to JS (this is referred to as 'self-hosting') because it allows inlining across more calls and eliminates native<->JS transition overhead.
Of special note (and I bow to them) is how they've used such a domain name to spam their services. If they had used "cliqz.com" or whatever their actual domain is, fewer people would click, but when I see this I'm inclined to think this is some personal blog of a fellow software developer, and not blogspam of a shady ads company.
Please don't post insinuations about astroturfing, shilling, brigading, foreign agents and the like. It degrades discussion and is usually mistaken. If you're worried about abuse, email us and we'll look at the data.
https://news.ycombinator.com/newsguidelines.html
Speaking as a person who's done as much, and definitely is no fan of Cliqz:
https://news.ycombinator.com/item?id=21718650
https://news.ycombinator.com/item?id=21724844
They're really responsive, and they're very proactive about these things.
https://www.merriam-webster.com/dictionary/astroturfing
Brigading in the most famous English dictionary (see definition 2):
Shilling does have a NorthAmerican connotation: https://www.oed.com/view/Entry/178128?rskey=UvAWn2&result=4#...
While I understand the need for base training data to launch a competitor to a search engine like Google, I won't deny this gave the name an immediate bad taste in my mouth.
I work at Cliqz in the engineering team and have been involved with this advent project. I'd like to provide some background.
For a while, we have been thinking internally about having a tech blog for Cliqz engineering teams. It is fairly common for tech companies to have a separate blog for technical content, separated from the main website. We picked a name: 0x65.dev (0x65 being the hexadecimal representation of 101, the idea was that we would write about the tech at Cliqz in an accessible way).
To make sure we'd commit to writing on this new blog, we thought of organizing an "advent" for Christmas, where we would publish one article per day digging on one of the aspects of what we do: search, privacy, browsers. When creating the list of topics, we did not optimize for Hacker News (or any other community for that matter, we also post and twitter and Reddit equally), as this was suggested by some other comment. We really wanted to create a coherent schedule to explain why and how we do things, to have a logical progression in the topics (looking at the posts from first to last, it should hopefully make some kind of sense!). We started on day one with "Why the world needs more search engines", to motivate our efforts in this area, and started detailing on following days the way we built our engine from scratch.
One thing we wanted especially, was for engineers to write about the projects they work on, to get their perspective, without any filter. So far, many different people have contributed. If some of the technologies or keywords we use seem "trendy", it's because we are ourselves hyped about those, and we use them internally to build our products.
Before the event we never anticipated this would resonate so much with the HN community, and while very pleasant, it was not the goal. We were of course extremely enthusiastic when we saw the great feedback from the community. If anything, this proves that the topics which we are passionate about are also of interest for a part of the HN community (many of us at Cliqz read HN every day; in fact we all used our personal accounts to submit, comment or discuss about the posts). It also shows that what we do is not disconnected from reality, and that there is real interest around the topics of search, independence, privacy; a good validation for us!
It's not unusual for a company blog to have a different name. A simple example is Signal v. Noise [1] which is the Basecamp folks. I would not want to seem them penalized for doing what others have done for a long time which has been seen as fine.
Knowing who Cliqz is a bit about being an insider for certain technology circles. Many people do not know and many people do not care. Some folks having issues with the company should not stop interesting content from being upvoted. Some members here have issues with Google, Microsoft, and other companies. That never stops their content from being listed.
I am not a Cliqz user. I am curious of the motivations of people who use Chrome (put out by an advertising company) while having issues with Cliqz (being put out by a media company).
Increasingly buried underneath all the big talk about privacy and the blog spam, is the fact that Cliqz also is an advertising company: https://cliqz.com/en/magazine/press-release-cliqz-introduces...
They've literally resurrected the ad-riddled browser toolbar: https://myoffrz.com/en/
My bet is spinning off their own browser has nothing to do with anything but fear the browser vendors, Firefox and Chrome alike, will start blocking their real money maker.
This is not even a new strategy. Other companies have tried similar tricks over the years too, though most of them went with Chromium forks instead for their spy/adware laden wares.
Frankly, it's disappointing to see this even on here, but I don't blame anyone for it; they are really working hard to sugar up the pitch here.
If posts from Google and Chrome are OK for hacker news then why not from others with similar business models?
I'm not attempting to say that Cliqz has an OK model. I'm suggesting self examination and consistency.
I was thinking about trying their browser.
That press release is insane. Sharing "approximate location"?