Parallel page rendering with Mozilla Servo
lwn.net
lwn.net
Longer-term, we plan to incrementally replace components in Gecko with ones written in Rust and shared with Servo. We are still evaluating plans to ship Servo as a standalone product, and are focusing on the mobile and embedded spaces rather than a full desktop browser experience in the next two years.
Also powerful x86 CPUs are so good at shared-memory multithreading (cache coherency, large caches) that x86 is actually the best case for us (which is not to say we're bad on ARM, of course).
From the article:
parallelism results in power savings. Multiple threads working in parallel on a page-rendering job allow the CPU to complete the entire page in the same amount of time while running at a lower frequency.
If (when!) Servo continues to execute well, plans for integrating more risky pieces will require more top-down planning than the bottom-up, grassroots work that is going on today. As much as I love Servo, even I wouldn't argue we should stop the world and move 200 developers off of Firefox onto working on it full-time for the next year. Such initiatives rarely go as planned.
Since Mozilla doesn't have the ability to fund advertisement campaigns the way Google and Microsoft can they have to be more careful about momentum and not waist growth opportunities by spending them on a established product which is consistently shrinking in marketshare.
I'm hoping someone steps up to write a new lightweight servo frontend in rust.
What? Was this meant as a joke in relation to something else? -- Why shouldn't you log into banking sites with it?
e.g. how will 1.0 be any more secure than alpha aside from developers having more time to "run into" the security issues by sheer luck/accident?
Maybe someone vet the code by hand -- or maybe they will use a security testing suite to automate it? If so, wouldn't it make sense to do that before accepting code that could potentially introduce security bugs?
I think their point is that correct, well-thought-out and well-tested code (i.e. doing exactly what it needs to do, without side effects and errors) will inherently be more secure than any hacked-together it-runs-ship-it MVP/alpha/demo release (which is what Servo is, at the moment).
Security-specific tests would be done in the same way as they're done for any mainstream engine out there.
1) Probably won't have done the full sort of inspection of our SSL cert checking to really ensure you aren't being MITM'd.
2) We won't have a chemspill / 0-day security fix infrastructure in place, so we won't have a way to push down fixes to 0-day exploits in OpenSSL, the JS engine, etc.
I'd love to be at a better point on those features by the end of this year, but it's not likely with our current roadmap & resourcing plan.