I thank everyone who uses chrome/chromium derivatives for such a great technology possibly being adopted by every browser as a standard.
Goodbye World wide web, it was nice knowing you.
Shadow: New browser engine made almost entirely in JavaScript
101–110 of 303 posts
Re: Shadow: New browser engine made almost entirely in JavaScript
#102There’s something really beautiful about creating a browser that can run in a browser. We can finally steamroll a lot of those cross browser incompatibilities by replacing the host browser engine entirely. It’s like the nuclear option to fight against the new IE (Safari)
Which “standards” have been forced on the industry by Safari?
Re: Shadow: New browser engine made almost entirely in JavaScript
#103The fonts look terrible in LibreWolf and the FPS is only ~60. LibreWolf is also extension heavy. My default zoom on a page is 120% on a 1080 screen. It doesn't load in (updated) Firefox, which is interesting. It only shows that the FPS is around 60. Not as many extension (vs LibreWolf). I rarely use FF (opting for LibreWolf). On Brave (no extensions at all, except built in protections), the site runs at ~121FPS and t…
Zoom isn't taken into account so probably why it looks bad. The FPS is locked to your monitor's frame rate (or what your browser provides, LibreWolf might always send 60 to avoid fingerprinting).
As the post says, it's just for fun :)
Re: Shadow: New browser engine made almost entirely in JavaScript
#104Earlier quoted context omitted.
except without the local-system security risks
Says who?
As an SWE who used to work on Internet Explorer (yeah, laugh), I know I can't say that JS is somehow impervious to possible attacks and privilege-escalation out of the browser-imposed sandbox (which can and does happen), but when one compares even the basic nature of Flash's plugin/ActiveX control vs modern browser JS engines, the threat-model and browser-vendors' mitigation strategy, it means I have easily 100x more trust in in-browser JS as a far, far "safe"-er environment than Flash.
Re: Shadow: New browser engine made almost entirely in JavaScript
#105Earlier quoted context omitted.
I was worried from the very start of the WASM tech, that it would lead to the end of the user-controlled client. You don't even really need an embedded browser, a motivated provider could create a completely proprietary protocol for rendering their pages.
Taking power away from the user seems to be a large part of the appeal of WASM. Wasn't it just a year or two ago that it was being reported that 75% of WASM modules are malicious? A study from a previous year had said 50% of all websites using it were malicious so the trend line isn't looking great. I don't know how we got from "don't download and install random software from untrusted sources on your devices" to "le…
> I don't know how we got from "don't download and install random software from untrusted sources on your devices" to "let anyone with a website run code directly on your hardware. Sandboxes are impossible to breech!"
The whole point of WASM is that it's the alternative to downloading and installing random software.
Re: Shadow: New browser engine made almost entirely in JavaScript
#106Earlier quoted context omitted.
At that point I'm just going to have my ad blocker block the entire "inner browser." No website that would employ such a lovecraftian horror is worth visiting anyway.
Presumably the worry is that the big ad companies would get approximately every website in the world to use this technique, which is already the only reason web advertising is such a big problem.
Thankfully, the biggest ad company - Google - would hate it because it would dramatically reduce page performance. And webpage performance apparently has a big impact on ad clickthrough rates.
Re: Shadow: New browser engine made almost entirely in JavaScript
#107Earlier quoted context omitted.
Taking power away from the user seems to be a large part of the appeal of WASM. Wasn't it just a year or two ago that it was being reported that 75% of WASM modules are malicious? A study from a previous year had said 50% of all websites using it were malicious so the trend line isn't looking great. I don't know how we got from "don't download and install random software from untrusted sources on your devices" to "le…
> I don't know how we got from "don't download and install random software from untrusted sources on your devices" to "let anyone with a website run code directly on your hardware. Sandboxes are impossible to breech!" The whole point of WASM is that it's the alternative to downloading and installing random software.
Wasn’t that your parents point though?
Re: Shadow: New browser engine made almost entirely in JavaScript
#108There's a product here that's been waiting to happen for awhile. I've been anticipating somebody cross-compiling another browser engine to WASM but this works, too. Deliver your site only to the "inner browser" (that the user has no control over because it's heavily obfuscated and tricked-out with anti-debugging code) and you eliminate all ad blockers. Throw some DNS-over-HTTPS w/ certificate pinning in for good meas…
I was worried from the very start of the WASM tech, that it would lead to the end of the user-controlled client. You don't even really need an embedded browser, a motivated provider could create a completely proprietary protocol for rendering their pages.
I’d argue that “JS as a compilation target” already did everything WASM could do.
It hasn’t been the end of the world, but it hasn’t been great either.
Re: Shadow: New browser engine made almost entirely in JavaScript
#109Earlier quoted context omitted.
Taking power away from the user seems to be a large part of the appeal of WASM. Wasn't it just a year or two ago that it was being reported that 75% of WASM modules are malicious? A study from a previous year had said 50% of all websites using it were malicious so the trend line isn't looking great. I don't know how we got from "don't download and install random software from untrusted sources on your devices" to "le…
> I don't know how we got from "don't download and install random software from untrusted sources on your devices" to "let anyone with a website run code directly on your hardware. Sandboxes are impossible to breech!" The whole point of WASM is that it's the alternative to downloading and installing random software.
"Same malware, but with fewer steps" isn't exactly a win for WASM.
Re: Shadow: New browser engine made almost entirely in JavaScript
#110There's a product here that's been waiting to happen for awhile. I've been anticipating somebody cross-compiling another browser engine to WASM but this works, too. Deliver your site only to the "inner browser" (that the user has no control over because it's heavily obfuscated and tricked-out with anti-debugging code) and you eliminate all ad blockers. Throw some DNS-over-HTTPS w/ certificate pinning in for good meas…
People could have been doing this with JS for a long time. This is hardly the first virtual machine in JS and it seems like overkill. The far more likely way we'll see push back against Ad Blockers is by simply detecting that an Ad did not play and then refusing to display content until it does.
My browser: I totally played that ad to the user. Trust me bro.