Why build another browser, from scratch, in C++?
Because its fun, and because it might break the chromium monopoly we're currently living in, some day far in the future.
Ladybird browser spreads its wings
71–80 of 319 posts
Re: Ladybird browser spreads its wings
#72Rather than C++ can it be done/mainly done in Rust?
It could be done in Rust, but I suspect a life long C++ expert would like to use the language they know the best, when writing something at this scale, rather than first learning a new language.
Re: Ladybird browser spreads its wings
#73Earlier quoted context omitted.
> in languages that don't maintain strict memory safe contract? for the same reason people still use the English language, despite being full of crazy inconsistencies and being very hard to become a native speaker, coming from another language: proficiency. Proficiency is one of the most, if not the most, valuable metric when choosing the tool you will use to take on some complex/daunting task.
The language “legalese” was invented when it turned out that being proficient in English does not protect you against malicious contract partners. (The success of legalese is still debated, but its existence is generally accepted)
legalese is a subset of English.
BTW Rust (or any other so called "memory safe" language) is not the equivalent of legalese, it's the equivalent of using French because it's the "language of diplomacy" (that's why many English words come from French) instead of English.
If you're not proficient in French, French legalese won't save you.
Re: Ladybird browser spreads its wings
#74I don't want to discourage the developers working on this project, but I'm curious why we're still writing applications that will almost certainly execute or process hostile content in languages that don't maintain strict memory safe contract? Have we not learned our lesson yet, or am I misunderstanding the situation? I believe it was a Microsoft study that linked unsafe memory access to ~70% of exploit chains.
I'll take an alternative browser engine, even if it's written in C++.
> I'm curious
Is it really curiosity though? Because the answer is straightforward, the project started as a hobby, the developer picked whatever language they were proficient in. Andreas is open with the fact that he started Serenity OS and LadyBird as a rehab project. Put too much barrier in this setting (like learning a new language and all the ecosystem) and it might not happen at all.
Re: Ladybird browser spreads its wings
#75Earlier quoted context omitted.
Can you elaborate on what you mean by your claims of firefox having “spyware and ads activated by default”?
Install a new version of firefox, have a look in settings under "data" (or whatever they call it in english). There you will see "studies" as activated, which is cryptic talk for ad tracking. And more recently, literal tracking for a advertisement company. And as a bonus, those were added and activated as features via update, without telling. At least for me. (and paid ads you have on the home screen)
Studies are not ad tracking. It's worse and more like a backdoor for A/B testing of browser features. A few years back an update broke the Metamask extension and it was fixed by pushing via studies. At that point users weren't very aware the feature even existed and it caused some backlash since users realized there was a backdoor to push code into their browsers.
The backlash resulted in studies being opt-in, and I thought it still was but I don't know, I use "policies.json" to setup my browsers.
Re: Ladybird browser spreads its wings
#76Earlier quoted context omitted.
Can you elaborate on what you mean by your claims of firefox having “spyware and ads activated by default”?
Install a new version of firefox, have a look in settings under "data" (or whatever they call it in english). There you will see "studies" as activated, which is cryptic talk for ad tracking. And more recently, literal tracking for a advertisement company. And as a bonus, those were added and activated as features via update, without telling. At least for me. (and paid ads you have on the home screen)
> And as a bonus, those were added and activated as features via update, without telling. At least for me.
Ouch, they were new to me and also activated.
Re: Ladybird browser spreads its wings
#77Earlier quoted context omitted.
I don't understand what is wrong with Firefox. It is open-source, highly configurable and reasonably secure (if you have the time to configure). Yes, it has shortcomings, but what doesn't.
Not every open source software has spyware and ads activated by default, while marketing itself as privacy friendly. Yes, can all be deactivated, I also use FF, but I do not trust Mozilla anymore.
Ikr. They're up to some questionable decisions since long.
- Acquire companies like Pocket, Anonym in multi-million dollar deals and also the millions in bonuses that the CEO likes to enjoy.
- At the same time, no significant expenditure towards developing its core software. Firefox is still ridden with bugs. They even went as far as firing the people that used to work on Servo, Rust, WASM, etc.
I think it's clear to them that there's not enough money to be made with small tricks like Pocket, VPN, Relay, etc. Firefox is still the only profitable product and contributes ~90% to Mozilla's revenue. Much of it coming from Google which is the one thing that people have been asking them to be less dependent on.
And we shouldn't be surprised if they double down on making more money off of Google and also introduce ads. Acquiring Anonym, an ads company, implies that it might have already started.
Re: Ladybird browser spreads its wings
#78Earlier quoted context omitted.
The language “legalese” was invented when it turned out that being proficient in English does not protect you against malicious contract partners. (The success of legalese is still debated, but its existence is generally accepted)
legalese is a subset of English. BTW Rust (or any other so called "memory safe" language) is not the equivalent of legalese, it's the equivalent of using French because it's the "language of diplomacy" (that's why many English words come from French) instead of English. If you're not proficient in French, French legalese won't save you.
Could you explain your thinking a bit more? To me the "language of diplomacy" equivalent for computers sounds more like C calling convention, HTTP and XML or JSON.
Re: Ladybird browser spreads its wings
#79I don't want to discourage the developers working on this project, but I'm curious why we're still writing applications that will almost certainly execute or process hostile content in languages that don't maintain strict memory safe contract? Have we not learned our lesson yet, or am I misunderstanding the situation? I believe it was a Microsoft study that linked unsafe memory access to ~70% of exploit chains.
On the v8 engine's blog, it is claimed that most of its vulnerabilities are caused by logic issues which Rust wouldn't help with. Perhaps it's a similar situation for Ladybird. >Memory safety remains a relevant problem: all Chrome exploits caught in the wild in the last three years (2021 – 2023) started out with a memory corruption vulnerability in a Chrome renderer process that was exploited for remote code executio…
I believe the fact that V8 vulnerabilities are not "classic" memory corruption can be attributed to their developers' experience and review processes.
This doesn't imply, though, that another project in C++ will share these traits.
Re: Ladybird browser spreads its wings
#80I don't want to discourage the developers working on this project, but I'm curious why we're still writing applications that will almost certainly execute or process hostile content in languages that don't maintain strict memory safe contract? Have we not learned our lesson yet, or am I misunderstanding the situation? I believe it was a Microsoft study that linked unsafe memory access to ~70% of exploit chains.
It's crap programmers that write buggy code, and they will write similarly buggy code in any language. It's not hard to write memory safe code, most people are not skilled enough to do it. I doubt they will be skilled enough to write good rust.