Comment by jolmg | Hacker News Reader

Comment by jolmg | Hacker News Reader

Parent Full thread

>> * also, some of the changes that Firefox needed to remain competitive with Chrome were going to break most add-ons immediately, possibly all add-ons in the longer term;

This is probably the most important point. The other points apply to almost any software that supports addons, including emacs, vim, zsh, etc. and they're not really an issue.

>> * very quickly, add-on developers realized that anything they did could break anything else in the system, including other add-ons and Firefox itself, and they often had no way to prevent this;

So they're careful. Any add-on that breaks other stuff doesn't really get adopted. Emacs shares the same namespace for everything. Addon developers just namespace their stuff by putting a prefix on their identifiers. It's not really an issue even for them.

>> * similarly, anything Firefox developers did could break add-ons, and they often had no way to prevent this;

So don't change Firefox so drastically. Well, I'd say it's nice for software to be stable, but web browsers are a good exception to that. If Firefox didn't try to keep up with Chrome, Chrome would probably have greater dominance.

But yeah, other software would just be more stable. When a change needs to be made, the benefit is weighed against the potential of breaking addons, but I imagine that's probably OK with addon developers as long as the change was reasonable.

>> * oh, and by the way, since add-ons could do everything, they could very easily do anything to the operating system, from stealing passwords to pretending to be your bank.

Most times, addons are almost like any other program, and should be judged accordingly before installing. I imagine even after the restrictions were placed on addons, they're probably still capable of quite a bit of malice.

> Emacs shares the same namespace for everything. Addon developers just namespace their stuff by putting a prefix on their identifiers. It's not really an issue even for them.

I use and love Emacs (Spacemacs), and I am probably never going to move to another editor.

BUT as someone who maintains a Spacemacs config, no, Emacs addons break each other all the time. It's not just a namespacing problem, it's which events you're hooking around or interrupting, it's which system features you're changing that other addons rely on.

This kind of organized chaos works out OK in Emacs because I can read the source code of the offending Spacemacs layer or script and wrap around it to get it playing nicely with the rest of my setup. Emacs has very good debugging tools built into it, and you can hack on the editor in the editor. It also has a fairly decent community of people online who will help you debug configs as long as you're not being too annoying about it. This all ends up being pretty important, because you are going to need to debug configs.

Emacs expects you to be a power user that knows how to program, and if you are a power user that knows how to program, there are advantages to that. But even with those advantages, the sheer amount of time I've wasted getting EXWM to play nicely with other workspace addons...

I just think there's benefits and tradeoffs to both approaches, and I wouldn't be so quick to dismiss the engineers who decided that their users shouldn't need to learn how to program to keep a functioning set of addons running in their web browser.

My question is then: where's the hackabale power user browser implemented in something like Common Lisp with a REPL, hot swap debugging, and built in disassembly tools?

To be honest I'm surprised Emacs isn't a browser yet. It does everything else.

There are efforts, and there are things you can run, but I wouldn't personally recommend doing so. I am very paranoid about browser security, and I (frankly) don't trust smaller browser projects that aren't highly vetted by lots of people.

That's an entirely separate conversation.

My opinion is that it ends up being simpler and safer at the end of the day to just wrap the entire Firefox application in an Emacs buffer and then intercept keypresses to that buffer. But you do lose out on a lot of stuff by doing that; I'd love to have tighter integration.

It has a browser, eww (https://www.gnu.org/software/emacs/manual/html_mono/eww.html), and I think others.

eww doesn't work very well yet. Try it for fun only. And it's slow. Pretty certain it does cookies but not js.

I think there's an emacs web browser which delegates the actual mechanics to something external, and only acts as a front end for display/interaction. Never tried it.

I would love to know about this mythical browser, the web is one of the last things i don't have in emacs. I would dearly love to fix this.

https://html.duckduckgo.com/html?q=emacs%20%22web%20browsers... get you https://www.emacswiki.org/emacs/CategoryWebBrowser as the top link.

In the latter EAF isn't a web browser despite what it says. Have a look at the others. Piggyback browsers aren't going to be sophisticated, that's just how it is.

There is w3m inside Emacs though, which can be good.

And this is (one of the reasons) why it's wildly important that we have a diverse browser ecosystem rather than all building minor forks of Chromium.

And this is also why (disingenuous as they often are), some of the "web is too complicated" arguments can't be completely dismissed, because it is true that building a secure browser that's safe to use is a gargantuan task.

And this is also why it stinks that the Servo team got gutted, because Servo was shaping up to be an interesting new low-level embedded engine in that space.

Both sides are true. I understand completely why Mozilla went the route they did, and I agree with their decision to do so, and I also sympathize completely with the people who want to be able to live-hack on their browser in their browser. I want the ability to do that too.

But I think the only way to solve that is to have more browser diversity... somehow. I also don't want Firefox to be unusable for nontechnical users. I need a secure, reasonably private browser that's not based on Chrome that I can recommend to nontechnical friends and family.

Trouble is not only the complexity of a web browser (and security thereof) but that Google's "living standard" is a constantly shifting target. Even a company like Microsoft couldn't keep up with it and gave up. So long as Google is in charge and has infinite* resources to throw at it, nobody else is ever going to be able to keep pace.

Apple works around that by not really trying to keep up. It implements features in its own time (or else some third party contributes code to WebKit). But iOS gives Apple a captive audience which means it has much more freedom to be "slow" compared to Google. As much as I might philosophically dislike their policy of only allowing their own web engine on iOS, it is the only thing keeping WebKit alive as a major alternative.

Apple and Microsoft both have resources to dedicate as much man/machine-power as Google does for their browsers if they wanted to. They just don't want to play the neck-and-neck game any more. MS has opted to simply use Chromium while Apple as you say goes at its own pace. But they do have the capacity to match Google if they choose to, given some ramp-up time.

>I also don't want Firefox to be unusable for nontechnical users. I need a secure, reasonably private browser that's not based on Chrome that I can recommend to nontechnical friends and family.

My sister uses Firefox just fine, she doesn't know how to mess with addons.

Browsers are some of the most heavily optimized software out there, and they use a lot of memory.

I don't think switching from C++ to Lisp would work out so well.

Are you aware of how heavily optimized (for example) SBCL is? Similarly, significant portions of Firefox are implemented in JavaScript at this point.

I'm willing to accept a Fortran implementation via FFI for the truly performance sensitive bits though. /s

Nyxt is a browser that supports that. It wraps WebKit though, which is both good and bad I guess. Give it a try, it's nice.

What if I told you this is being enthusiastically developed and is supported by NLNet

https://nyxt.atlas.engineer/

https://github.com/atlas-engineer/nyxt/issues/887

https://nlnet.nl/project/NyxtBrowser/

This is amazing and sounds like exactly what I was imagining.

There is Nomad, which I think is either a GNU project or at least Free Software and written in (using?) GNU Guile. Not sure how mature it is.

You mean this one?

https://www.nongnu.org/nomad/

I've never once had issues with Emacs like you describe, and I've been using it for about 25y.

I think the key is that I don't use any deeply intrusive packages. No Spacemacs, no Evil; hell, I won't even touch EDE.

Still, my personal config is _packed_ with tweaks and custom packages, and I've maintained it continuously all this time.

> I think the key is that I don't use any deeply intrusive packages

Sure, but if you're not interested in using deeply intrusive packages or addons, then why does the sandboxing and forced separation between addons matter?

I can keep a clean Firefox config if I don't install addons that do anything too interesting, but if I don't install addons that do anything too interesting then I'm also not really going to be affected very much by the move from XUL to webExtensions. I think the core of the debate is about the intrusive packages, not the surface-level ones.

The only reason for Emacs to embrace the more dangerous kind of "everything is editable" levels of customization that people are advocating for within Firefox is so that we can implement stuff like Evil, EXWM, sidebar previews, embedded GTK apps, etc... Those are the power-user selling points of Emacs that keep me hooked on the platform.

I use interesting packages.

lsp, dumb-jump, projectile et cetera.

> So they're careful. Any add-on that breaks other stuff doesn't really get adopted.

This wasn't true at all. A lot of popular addons interacted with the browser XUL in incredibly intrusive ways. In particular, addons which altered the browser's tabbed browsing interface and/or behavior (like the various Tab Mix extensions, as well as Tree Style Tabs) tended to do so by making radical modifications to XUL, which would often break other extensions which interacted with tabs.

> Addon developers just namespace their stuff by putting a prefix on their identifiers.

That was not standard practice, unfortunately. Conflicts between extensions were commonplace; it was a rule of thumb to avoid installing multiple extensions which interacted with the same browser feature.

> So don't change Firefox so drastically.

This would have meant effectively freezing most UI development, to say nothing of more ambitious projects like e10s (multiprocess browsing). It would have led to the inevitable death of the project by stagnation.

> Most times, addons are almost like any other program, and should be judged accordingly before installing.

You heavily overestimate the degree of scrutiny that users applied to extensions. The fact that they could be installed from a web interface made users treat them very casually.

> I imagine even after the restrictions were placed on addons, they're probably still capable of quite a bit of malice.

XUL-era extensions had vastly more power than WebExtensions. They were equivalent in power to native executables -- they could run native code, read/write any file on the system, and communicate with any host, all without confirmation -- and there wasn't even any framework to allow developers to voluntarily restrict their power, because they ran in the same context as the rest of the browser chrome.

> You heavily overestimate the degree of scrutiny that users applied to extensions.

I apply scrutiny in the form of very carefully vetting the author's identity and reputation. At the end of the day that seems to be a fairly common and reasonably effective approach.

> XUL-era extensions had vastly more power than WebExtensions. They were equivalent in power to native executables

That was an important feature, not a bug (IMO). Sure WebExtensions are nicely sandboxed away from the OS, but the threat posed by a malicious version of uMatrix or Dark Reader is nonetheless difficult to understate.

Certainly many users made poor decisions. Certainly there were valid technical issues at play. But let's not pretend that all users are irresponsible or that there weren't serious drawbacks to what was done in terms of lost functionality. Some of the modifications I made use of still haven't been replicated in WebExtensions due to lack of ability (AFAIK). The only solution I'm aware of would be to patch the browser myself and recompile it, which is an _incredibly_ high barrier to entry (and that's before the ongoing maintenance burden).

There's a reason that phishing is the go-to infosec attack vector. It's because we still blame users for being tricked into doing things they shouldn't, rather than taking the time to build systems that prevent such vectors from working.

I'm happy that extensions no longer have such wide-reaching access to the system. Whatever we lost in power-user tinkerability isn't worth the high personal cost that the malicious extensions would have on the lives of unsuspecting users.

Hmmm. Apple seems to be making that same argument over gatekeeping apps on MacOS right now. I'm not convinced.

Maybe it's time to get off the consumer train.

> Maybe it's time to get off the consumer train.

What's that supposed to mean? We put IT in everyone's hands. We're not going to be able to just take it away from them.

I don't think this sort of security trumps everything else approach is a valid line of argument. Surely there are tradeoffs to be made, and surely one size doesn't fit all.

As to phishing in particular, I don't agree that the issue is a lack of willingness to design resistant systems or a misguided assignment of blame. I think it's because solving that problem at scale in the real world is (or at least was) legitimately difficult. The vast majority of people in the world don't carry a YubiKey on them and probably won't any time soon. There are even users in the US that still don't have reliable access to a mobile phone! A product that doesn't work for the actual users simply isn't viable.

>There's a reason that phishing is the go-to infosec attack vector. It's because we still blame users for being tricked into doing things they shouldn't, rather than taking the time to build systems that prevent such vectors from working.

Such system was already built in the bronze age: Troy.

>Any add-on that breaks other stuff doesn't really get adopted.

Yes it does, Firefox is a mainstream browser not a niche product used by experts. Most people couldn't even figure out which of their fifty extensions was causing issues. So they just used Chrome.

This is exactly it. Normal users don't think "Huh firefox is crashing, I'm going to disable addons one by one to work out if one of them is the cause" They just think "Wow, firefox is super buggy, I'm using chrome now" And then every time they see firefox mentioned online they leave their comment about how its super buggy and crashes all the time.

I just had an idea: to install an extension require authentication by a one time random password, show the password in a modal window without ability to copy, the user will have to remember the password and type it into a field. The password length is equal to the number of installed extensions, so to install 50th extension, you need to type 50 character password.

> But yeah, other software would just be more stable. When a change needs to be made, the benefit is weighed against the potential of breaking addons, but I imagine that's probably OK with addon developers as long as the change was reasonable.

We thought that too, for a time, but eventually, we had to realize that we were burning out our add-on developers.

(updated the article to clarify this)

Codebases and products aren't that simple.

Changes and maintenance cost money and time. In this case, they deemed it to not be worth the expense to resolve the potential security issues (which can never be truly resolved).

Reply on news.ycombinator.com