Live data from Hacker News

So you want to build a browser engine

robert.ocallahan.org

31–40 of 134 posts

Re: So you want to build a browser engine

#31

I was going to suggest: > initially try just being a faster, lighter or lower-power Electron or WebView. But he mentioned it himself, though maybe someone might want to try this with no intention to become a full browser. Can you skip any of the tricky security requirements if it'll be bundled into an app? Or is that just asking for trouble?

Tauri basically?

No. Tauri is not a web browser. It uses the existing platform browser.

This would be more like Servo which I believe is focusing on embedded use cases. It makes sense because for Electron/embedded you don't need it to work for every site (really really hard), you only need it to work for one site. (Or a few hundred/thousand if you count all your users.) That is several orders of magnitude easier.

Re: So you want to build a browser engine

#32
post #16
post #5

Earlier quoted context omitted.

> Or is that just asking for trouble? With the interactions an electron-like app might be doing with external services and the ton of JS third party library it could use, I think it would be indeed risky.

None of the security mitigations described in the post (nor any of those implemented in any browser engine) are aimed at protecting developers against themselves when they run an agglomeration of third-party modules as a single bundle under the same policy.

CSPs and mechanisms against cross site scripting are such protections. They would block a script from calling home or executing arbitrary scripts or displaying images that could exploit vulnerabilities.

So browser engines definitely protect developers against themselves a bit.

Although I agree with you that there's only so much you can do for the devs bundling crap themselves, I was wrong on this indeed.

Still, I would not be overly confident with web code running in a browser where security is not well studied if it has any network capacity. Especially if the app displays any external content in something like an iframe.

Re: So you want to build a browser engine

#33
I'm writing one for fun: https://sr.ht/~bptato/chawan/

"Fixed-width text to a grid" makes things easier (sometimes), but I think it still qualifies.

On the article itself; it might be better to start with more... basic things than the optimizations it talks about:

* Cascading & layout must be cached and optimized - far from trivial. Layout is one of the hardest parts to get right at all, to make it fast as well is another level... and I'm just talking caching, not even multi-threading.

* The "web platform" contains a very large amount of poorly thought out features harmful for user privacy and/or security. You can choose between convenience (opt out) and privacy (opt in), or try to balance the two as major browsers do. Both is often impossible.

* "Serialize the entire application state" sounds like the most complex thing you can come up with as a distinguishing feature. Much more low hanging fruit exists if you give up on writing a Chromium clone. e.g. a fun side project I've had is making my browser "protocol-agnostic", or adding a bunch small QOL stuff for myself. You can probably find new ideas easily once you start out.

* Older browsers are useful for inspiration too. The coolest features in mine are often just carbon copies of the same things from w3m, just a bit more polished. Reading about what historical engines did - even IE! - is often enlightening too. Sometimes it's just a smaller scale of what engines do now, and easier to implement. Other times it's a whole different approach.

* It's easy to get lost in the details - careful with perfectionism. As you start getting more components interacting, it will slowly become clear when the naive approach is wrong and how to improve it.

Overall, it takes time, but is also fun and rewarding - you will learn a lot, even without replacing Chromium.[0] That said, if you want to learn how "modern" browsers work, getting involved with a "modern" engine itself is probably much more productive.

[0]: To write a Chromium replacement, you may have to reincarnate as awesomekling ;)

Re: So you want to build a browser engine

#35

I was going to suggest: > initially try just being a faster, lighter or lower-power Electron or WebView. But he mentioned it himself, though maybe someone might want to try this with no intention to become a full browser. Can you skip any of the tricky security requirements if it'll be bundled into an app? Or is that just asking for trouble?

I think sooner or later you're going to want to load lower-trust content --- IFRAMEs of third-party Web content, or sandboxed extensions, or something like that. Building your entire architecture on the assumption you'll never have to do that is very risky.

Re: So you want to build a browser engine

#36
post #18
post #15

Earlier quoted context omitted.

Yeah that is what I meant. To my knowledge, Andreas is the only person crazy enough to do it and also do it in the open. You have to watch some of his YouTube videos to appreciate the insanity that goes into getting things to work, but he at least has some help from the OSS community: building automated tests, scripts, etc. As I was reading the post I thought he would at least shout him out too!

Ah that's 'statistically nobody' vs 'nobody'.

The word directly under "Nobody" is "Andreas."

Re: So you want to build a browser engine

#37
post #9

Who is this post intended for? Nobody builds their own browser engines. And I mean nobody. I didn’t get the feeling that he wrote this for pet projects either. Andreas over at Ladybird is probably the only one (and Servo?) who is really doing it the way that this post describes. Still, the last couple of paragraphs made me think that this is more of a reflection of his own time over at Mozilla: could have / would hav…

I was inspired to write it by reading about Ladybird, so I wrote it for Andreas Kling basically :-). But there is also Flow: https://www.ekioh.com/flow-browser/ and Servo. Maybe in the future someone else will try. Also I think it's fun to think about these things even if you're not building a browser engine. It only took about 90 minutes to write.

Re: So you want to build a browser engine

#39

I'm writing one for fun: https://sr.ht/~bptato/chawan/ "Fixed-width text to a grid" makes things easier (sometimes), but I think it still qualifies. On the article itself; it might be better to start with more... basic things than the optimizations it talks about: * Cascading & layout must be cached and optimized - far from trivial. Layout is one of the hardest parts to get right at all, to make it fast as well is an…

I guess one of my points is that layout algorithms are not really part of the "most basic" decisions anymore. Replacing layout algorithms is actually a lot less disruptive to the engine architecture than switching to site isolation, say.

Re: So you want to build a browser engine

#40
> So You Want To Build A Browser Engine

The only correct answer is, "don't".

I mean, if you want to build a toy browser engine for a CS class or fun or something, then sure.

But the idea that "you want to build an engine that’s competitive with Chromium" is, quite simply, nonsensical.

If you want your own browser engine, you're going to fork Chromium or Gecko (Firefox). I mean, even Microsoft gave up on maintaining its own independent engine and switched to Chromium.

I literally don't understand who the author thinks this post is supposed to be addressed to.

Building an independent browser engine could have made sense in 1998. These days it would cost hundreds of millions of dollars in dev time to catch up to existing engines... just to duplicate something that you already have two open-source versions of?

Post reply on HN