Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ladybird browser spreads its wings

lwn.net

Post reply on HN
Print view View original

151–160 of 319 posts

Re: Ladybird browser spreads its wings

#151

Post by voidwtf »

peoplefromibiza wrote: post #56
voidwtf wrote: post #35

I don't want to discourage the developers working on this project, but I'm curious why we're still writing applications that will almost certainly execute or process hostile content in languages that don't maintain strict memory safe contract? Have we not learned our lesson yet, or am I misunderstanding the situation? I believe it was a Microsoft study that linked unsafe memory access to ~70% of exploit chains.

> in languages that don't maintain strict memory safe contract? for the same reason people still use the English language, despite being full of crazy inconsistencies and being very hard to become a native speaker, coming from another language: proficiency. Proficiency is one of the most, if not the most, valuable metric when choosing the tool you will use to take on some complex/daunting task.

This makes the most sense and thank you for offering a genuine answer to my question. Which leads to a follow-up question.

Has the rise of these memory safe languages caused any shift in the proficiencies of the average developer?

I see a lot of younger people gush over python early in their careers but see a lot of Java/.NET in enterprise.

I personally grew up learning Delphi, PHP, and HTML. Java and .NET came later, but I rarely had a hand in initiating the projects so my language proficiency typically flowed with the job/project I was working on professionally.

Re: Ladybird browser spreads its wings

#153

Post by the_other »

manuelmoreale wrote: post #10

I’m irrationally excited for this project. The idea of a community built browser is incredibly appealing considering the current landscape where all browsers are either Chrome, Chrome in a trench coat, or Firefox

Safari is 18% of global web traffic, 7x that of Firefox.

(from a hasty scan of caniuse.com)

Re: Ladybird browser spreads its wings

#154

Post by bilekas »

Andreas Kling is a great role model in the world of development I feel. The decision to step away from the Serenity OS makes a lot of sense. There are plenty of them, nice projects to do, but they'll never have an immediate impact if any at all. But the browser space, Ladybird is viable as a daily driver for people. I'm still today astounded the work that has been produced just on this.

> Somewhat ironically, it was not possible to log into Discord using Ladybird. It does a fair job of rendering pages, but speed and stability are still wanting.

Fascinating to see people expecting everything to work out of the box whilst being writter from scratch.

And as an avid rust appreciator, all the comments about "rewrite it in rust" as if that solves anything the OP spoke about is really frustrating.

Let the team cook, if you dont like the dish, help cook it. The project has been super interesting and honestly I feel we need more like this in the browser scope.

Re: Ladybird browser spreads its wings

#155

Post by worksonmine »

bongobingo1 wrote: post #143
worksonmine wrote: post #75

Earlier quoted context omitted.

Studies are not ad tracking. It's worse and more like a backdoor for A/B testing of browser features. A few years back an update broke the Metamask extension and it was fixed by pushing via studies. At that point users weren't very aware the feature even existed and it caused some backlash since users realized there was a backdoor to push code into their browsers. The backlash resulted in studies being opt-in, and I…

Am I being a total chud? These don't really seem egregious? I already accept (and expect) that Firefox receives background updates in the background. https://i.imgur.com/S7d4ZXg.png https://i.imgur.com/n2euIrQ.png https://i.imgur.com/BUjukOy.png

I don't mind the feature as opt-in, just like telemetry it can be useful. But depending on the threat model it can be a big problem. I still use Firefox as my main browser.

Re: Ladybird browser spreads its wings

#156

Post by voidwtf »

alexvitkov wrote: post #126
voidwtf wrote: post #35

I don't want to discourage the developers working on this project, but I'm curious why we're still writing applications that will almost certainly execute or process hostile content in languages that don't maintain strict memory safe contract? Have we not learned our lesson yet, or am I misunderstanding the situation? I believe it was a Microsoft study that linked unsafe memory access to ~70% of exploit chains.

Because rust is a cargo cult. We're nearing 10 years since 1.0 and there's still not a single serious, widely used, large software project to prove its viability. Maybe make one instead of trying to passive aggressively convince others to do it for you?

I didn’t mention rust, I don’t know Rust and if I were trying to start a similar project I might do so in .NET Core because of my familiarity with .NET. I’m asking because I don’t know if there is a reason it would not be viable, is the garbage collection too much of a hurdle to get decent performance while trying to interpret JavaScript? Is there too much overhead tracking claims on memory and doing the bounds checks? I’d assume the same checks eventually have to be written in C++ too?

Re: Ladybird browser spreads its wings

#157

Post by torstenvl »

oriolid wrote: post #105
torstenvl wrote: post #84

Earlier quoted context omitted.

Nobody is saying there is a programming equivalent of the language of diplomacy. He said that using Rust to achieve memory safety is analogous to using French for diplomacy, in that, whatever value the language itself might bring to that goal, you are not likely to achieve it if you are not proficient. If you are not proficient in French, you likely ought not to conduct diplomacy in French. If you are not proficient…

Ok, I'll try to explain. - French itself does not add much value to diplomacy. The reason to use is that everyone else who does diplomacy is expected to know French (and probably isn't a native speaker which makes things a bit more equal). English is probably taking over there, like it has done in other domains. - The recent C++ versions are not actively promoting shooting yourself in the foot like older variants, bu…

Don't do this. Requesting an explanation just to get an excuse to launch into a spiel is deeply dishonest. Furthermore, ideological battle is against HN Guidelines.

Re: Ladybird browser spreads its wings

#158

Post by jraph »

voidwtf wrote: post #130
znpy wrote: post #85

Earlier quoted context omitted.

>> I'm curious > Is it really curiosity though? I'm kind of annoyed at this whole train of comments ("I'm curious..."). In so many occasion I see something cool and the main comment track is "why hasn't this been writte in rust?" (or some other allegedly safe/better programming language). It's like seeing a beautiful painting being painted and arguing about the kind of paintbrush the painter has used. It's so sad.

That’s a pretty cynical view. It’s more like asking why a car manufacturer is developing a car without modern safety mechanisms despite knowing those mechanisms save lives. If this is a work of art whose code is to be admired and only viewed as a creative work, fine I’m sorry I asked the question and that it was criticism of one’s vision. However, if this is something that is intended to be “driven” by other users in…

It's not cynical. It's how many of us feel when we read a comment like this.

I believe you are right. But I also think that your phrasing is not very nice. It shows a lack of empathy and understanding and feels entitled.

You could convey essentially the same message but be way nicer to everyone involved, and that would be way more efficient.

If your ideal is a browser engine written in a safer language, and want to work towards that goal, phrasing things the way you did in your comment is one of the worst way to do it because you risk putting off people and they will associate this bad feeling to your idea. See how people react to comments about Rust.

Some of your options are:

- writing a browser engine yourself, in a safer language

- contributing to an existing browser engine like Servo

- convince projects to switch to a safer language, or to accept contributions in a safer language

- convince someone or a group of people to do those things

- fund such an enterprise

At this point, the world needs proof that a browser engine can practically be written in something else than C++, because it's what all three major engines are written in. There are strong evidences that Rust can be an option given the existence of Servo, but look how Ladybird is progressing so absurdly faster than Servo.

If you don't work yourself towards your goal, you can only humbly share your wish.

Lobbying is fine too, but you really need to make sure you don't make others hate your idea because of the way you communicate. Specifically in this topic, you need to take in account that many people are already annoyed by the numerous "why not Rust" comments, so you are walking on eggshells.

What's more, don't forget the global picture, and that security (although critical, we agree) is only one aspect. Security is irrelevant in a project that doesn't even exist. C++ is better than other languages for a lot of reasons in other aspects and you will need to address this, in the context of writing a browser.

Good luck in your endeavors, I hope you succeed, I believe it's a good ideal.

Re: Ladybird browser spreads its wings

#159

Post by komadori »

PrayagS wrote: post #150
antihero wrote: post #145

Earlier quoted context omitted.

Also they stopped developing Servo :(

As in Mozilla stopped developing officially? Because I have seen active development on GitHub and monthly updates on their blog.

Yes, that's correct. It was later adopted by the Linux Foundation with some industry support: https://www.linuxfoundation.org/press/press-release/open-sou...

Re: Ladybird browser spreads its wings

#160

Post by lukan »

PrayagS wrote: post #150
antihero wrote: post #145

Earlier quoted context omitted.

Also they stopped developing Servo :(

As in Mozilla stopped developing officially? Because I have seen active development on GitHub and monthly updates on their blog.

Yes, a while ago. But fortunately people continue. Just not with the billion dollar budget of Mozilla and with seemingly less traction. I have not heard of them in a while.

But I very much endorse both. And yes, in theory energy should be focused, but I rather have 2 smallish projects, but with potential, than one slightly bigger one, with fighting about direction all the time.

Post reply on HN