Hacker News Reader

> My suspicion is that, when Pale Moon asks you not to use Web Components, they're doing so because their engine is old

They address this:

> Full disclosure: While it is absolutely true that it is in our direct interest that web developers don't use something we are still working on implementing ourselves (considering our limited capacity as a smaller non-profit community, which is likely the same for any other true Open Source/Libre projects out there), the impact of what is outlined above is much more far-reaching than just our own projects; not only is it pushing for a proprietary web that is vendor-locked, it also, as stated, becomes something that will be impossible to archive, save or process.

So, yeah, they have special interest, but that doesn't take away from their point.

It takes away from the point when it's untrue. Web Components is a standard. Multiple implementations exist. They don't have one and are sore.

This isn't the first time the topic of browser monoculture has been brought up. Why does it matter that it was Pale Moon that brought it up this time? If I or anyone else would have written the post instead of them, would then people focus on the issue instead of on who brought it up?

> It takes away from the point when it's untrue

What exactly are you saying is untrue? Can you quote the part?

There are comments[1] right in this same thread that confirm Pale Moon's statements about the inability to save or archive pages.

> Web Components is a standard. Multiple implementations exist.

Are you sure it's not Google that's controlling what's to become "standard" and Firefox that chases after them? And I say Firefox specifically, because, besides Safari, they seem to be the only other implementation on the market. Edge uses Chrome's engine. Indeed, with Chrome's 64% in market share[2], anything they do becomes "standard" automatically. With Firefox's 4.5%, I don't think they can do anything but chase after the Chrome guys to wherever they decide to take the web.

Isn't the point of a standard to help foster a rich ecosystem of diverse, interoperable implementations? I feel that a standard that evolves too fast (as made possible by an implementation monoculture) fails at fostering one.

This is what I believe Pale Moon is getting at when they say:

> The more additional "features" are tacked on to these components, the less likely it is for non-Google clients to be able to display sites in full or properly.

It gets harder and harder to make a new web engine from scratch. It's a step backwards from gaining a more diverse browser ecosystem.

The fact that Web Components specifically makes it harder to parse content (for archival or indexing purposes, etc.) is a separate issue, and for it, it doesn't matter if it's standard. In fact, it makes it worse.

[1] https://news.ycombinator.com/item?id=22605069

[2] https://gs.statcounter.com/browser-market-share

Some of my browser extensions depend on querying the DOM, and I'm also worried about not being able to fully inspect web pages that use closed shadow root elements.

WebExtension in Firefox get access to open and closed shadow roots: https://developer.mozilla.org/en-US/docs/Web/API/Element/ope.... I think there are open bugs for some further improvements.

How does Pale Moon maintain security for these legacy technologies?

How do pigs fly?

I'm not sure they could, even if they wanted to. The security problems with those technologies aren't due to implementation goofs. They're fundamental issues with the design of those platforms, all of which were designed back in the '90s, when we didn't appreciate just how dangerous an environment the Internet could become.

There's no way to fix issues that run that deep without breaking backwards compatibility with all the existing code written for those platforms, which would negate the entire point of the exercise.

> all of which were designed back in the '90s, when we didn't appreciate just how dangerous an environment the Internet could become.

No, it was in the 2000's and 2010's. And even more than 10 years ago, people were aware of how Internet can be dangerous, as shown by Internet Explorer.

Moreover, Firefox had sandboxing before Chrom* and Electrolysis:

1. https://developer.mozilla.org/en-US/docs/Archive/Add-ons/Sec...

2. https://developer.mozilla.org/en-US/docs/Archive/Add-ons/Dis...

3. https://developer.mozilla.org/en-US/docs/Archive/Add-ons/Int...

The "sandboxing" you're referring to was very limited in scope. It essentially amounted to not giving content scripts any references to non-content objects like the browser chrome; poorly written extensions often broke this "sandbox", and it provided no protection whatsoever against browser exploits -- any arbitrary code execution exploit would allow an attacker to run unrestricted code on the user's system.

Read these links:

1. https://forum.palemoon.org/viewtopic.php?f=65&t=22399

2. https://forum.palemoon.org/viewtopic.php?f=65&t=22270

3. https://old.reddit.com/r/palemoon/comments/evywwj/how_secure...

4. https://www.palemoon.org/releasenotes.shtml

They also maintain an in between version. https://www.basilisk-browser.org/

If the core problem is that you don't have enough resources to do everything you set out to do, splitting those resources between two separate products doesn't help matters.

Exactly my thought... How is fragmentation exactly gonna help this?

Well, if I as developer would realize that i pose my users under certain risk and i am unable to do anything about it, then the only logical and morally correct option would be, to tell that my users and cease operation.

Everything else is selfish and delusional!

I tend to agree, but if the Pale Moon developers agreed they would have shut the project down long ago. The legacy APIs they're clinging to are loaded with security risks -- that's part of why Mozilla ditched them in the first place. And there's not much evidence that Pale Moon et al. are doing anything substantial to remove or mitigate them.

Yes sounds like they should just cut their losses. They gave it a try and discovered you can't maintain a fork of a browser that easily.

> and cease operation.

I hate when that happens. I choose the applications in my workflow for specific reasons or for some unique value that they offer. It's one thing when a developer moves on from a project and leaves it in an unfinished state. It's an entirely different story when the developer basically throws up his hands and tells their users they give up because xxx is too hard. Just tell me what's wrong and let me decide! Then if your userbase crashes you can make the decision if you want to continue or not. Deciding for yourself what's important to me is extremely frustrating as a user. Kinda like when Microsoft deprecated the SmtpClient Class in .NET and told people to use MailKit instead.

So now it's taboo to use the perfectly good Microsoft class which only takes 6 LOC to send an email and everyone is crapping their pants trying to make 300 LOC mailkit scripts to perform the same task. Because some clown at Microsoft got a hard-on over MailKit and decided to burn their own house down.

.NET Core? We are still mostly on .NET Framework land and happily using SmtpClient.

It doesn't make sense to me to ask developers to not use a newer technology that can make their lives easier and affect bottom lines for business just so we can accommodate a single project with likely a very small set of users. I'm surprised they would even think that is an OK thing to ask.

Anyone can write an open letter. Whether somone acts on that is another matter.

Reminds me of the invocations of old to ensure that websites support disabling Javascript, and/or text-only browsers like Lynx. While there are those who still (understandably) want these things, I think we all realize it's largely a lost cause at this point.

Google, Microsoft, Apple and even Firefox have an incentive to reduce competition by making the web as complex as possible. If the web is to be free, it must be radically simplified. To call that a lost cause is just a self-fulfilling prophesy.

I don't disagree (although I'd be curious to hear your rationale on Mozilla; their incentives are... curious). I suppose what's hard to not view as a lost cause is the idea that accessibility to non-JS/Lynx/etc is best-practice or the default. But there are counter-examples of less-is-more good citizens (Craigslist and HN itself come to mind).

As flawed as browsers (and their vendors) may be, I come at it from the other direction: from the perspective of end-user adoption, the open web and federated email are our last two bastions of open computing ecosystems of any kind, holding back the tide of walled-garden apps and clouds and such from taking over completely. While radically-simple "good citizens" of the open web may not be the norm, at least they're possible, which can't exactly be said for the computer-as-appliance model.

Other way of looking at it is that google is the new Microsoft and play the Embrace, extend, and extinguish game.

You are attacking the post ad hominem. But, your comment does not change the validity original argument.

I’m interested in knowing your opinion about the arguments, thou.

> My suspicion is that, when Pale Moon asks you not to use Web Components, they're doing so because their engine is old

Your suspicion is entirely wrong.

1: https://forum.palemoon.org/viewtopic.php?t=22270

2: https://forum.palemoon.org/viewtopic.php?t=22399

> Your suspicion is entirely wrong.

In what way? Could someone summarize these sources?

These are both basically MoonChild saying "it's not true" which doesn't change whether it's true.

MoonChild also told everybody that Let's Encrypt is a terrible idea, untrustworthy and nobody should use it. How did that end up?

I will give them props for actually doing it (plenty of people went "I'll just fork it" when Mozilla decided to change things but very few of them actually did all the resulting heavy lifting) not just talking about it. That's not nothing, but it doesn't make them right.

Neither of those really even contradict what smacktoward said, much less disprove it. In those posts, Moonchild disagrees with the idea that Pale Moon is "a rebranded rebuild of an old Firefox version" and more broadly that it corresponds to any particular Firefox version since there has been years of parallel development. He also affirms that Pale Moon has kept up with other browsers in security. It is entirely possible for all of that to be true and for smacktoward's suspicion — that Moonchild's primary problem with Web Components is that they work poorly in Pale Moon and it would be a lot of trouble to fix that — to be true.

> It is entirely possible for all of that to be true and for smacktoward's suspicion — that Moonchild's primary problem with Web Components is that they work poorly in Pale Moon and it would be a lot of trouble to fix that — to be true.

It is not true

for the simple fact that the next milestone release (v29) of pale moon will support WebComponents

> Neither of those really even contradict what smacktoward said, much less disprove it.

smacktoward repeats the same tired oversimplifications that PM is just "rebased itself on mainline Firefox circa Firefox 52" both my links prove that the above statement is fundamentally wrong.