${THEY} continue crippling browsers...

andyprough · 2021-04-29 02:45:44

digdeeper used to be completely in love with palemoon. Then they disabled one of his favorite extensions and he eventually went on a bit of a rampage against it. But palemoon didn't really even block the extension he was mad about, just made you flip a bit in about:config to be able to install it. For example, he's upset that they "blocked" noscript, but I was still using noscript with palemoon quite recently by flipping that bit in about:config.

digdeeper also dislikes palemoon because chief devs moonchild and Tobin are mean and nasty to people on the palemoon forum. I actually go and read the forum to see who moonchild and Tobin have flamed recently, it's quite amusing to me. But I'm weird that way.

blackhole · 2021-04-29 17:15:36

Head_on_a_Stick wrote:

mstrohm wrote:
Pale Moon looks promising
No, it doesn't: https://digdeeper.neocities.org/ghost/b … l#palemoon

That article comes across as to being spurred by a particular agenda, but citations are relevant. The developers are making some very questionable decisions - and perhaps it's time the browser's fans cast their minds back as to why they stopped using browsers such as chrome or firefox?

The way the forum is administered and how the lead developers behave, may be irrelevant to the actual software itself, but the obnoxious and arrogant posturing and in particular the attitudes on show in the "insect" comment and the posting directed at the individual trying to work on an OpenBSD port, is in fact reflected in the code - in the decisions regarding tor, add ons, blocking user agent override, etc - in general foisting changes on users for a particular reason, while publicly offering another line of reasoning - not so plausible reasoning. For example the UA override removal and reasons stated for doing so were questionable - and it's likely that the same narcissistic reasoning of "branding" was behind that, as it was with the OpenBSD port situation - in that allowing users to masquerade as firefox his perceived "market share" suffers. It looks like it's - "Our browser, Our way"... Except in reality it's a fork, with the overwhelming bulk of that code being from decades of dev work at Mozilla (and Netscape before that).

snork · 2021-04-29 20:36:26

blackhole wrote:

For example the UA override removal and reasons stated for doing so were questionable

UA is actually one of the things that annoys me most about Pale Moon. I can set a single UA that will be used for all sites, or I can set UA on a per domain basis but must use the default UA for any sites I do not specifically set, but having a custom default UA with the ability to set custom UA's on a per domain basis is not an option? Bah! :-(

Ron · 2021-04-30 02:14:43

blackhole wrote:

The developers are making some very questionable decisions - and perhaps it's time the browser's fans cast their minds back as to why they stopped using browsers such as chrome or firefox?

If you're talking about the recent dustup over extensions, well, you can't expect frozen extensions to continue to work forever in a developing browser. Go ask any developer of those legacy extensions how many times they had to modify them when a new version of Firefox "broke" them. This isn't rocket science.

blackhole wrote:

The way the forum is administered and how the lead developers behave, may be irrelevant to the actual software itself, but the obnoxious and arrogant posturing and in particular the attitudes on show in the "insect" comment and the posting directed at the individual trying to work on an OpenBSD port, is in fact reflected in the code - in the decisions regarding tor, add ons, blocking user agent override, etc - in general foisting changes on users for a particular reason, while publicly offering another line of reasoning - not so plausible reasoning. For example the UA override removal and reasons stated for doing so were questionable - and it's likely that the same narcissistic reasoning of "branding" was behind that, as it was with the OpenBSD port situation - in that allowing users to masquerade as firefox his perceived "market share" suffers. It looks like it's - "Our browser, Our way"... Except in reality it's a fork, with the overwhelming bulk of that code being from decades of dev work at Mozilla (and Netscape before that).

Guarding one's branding isn't being narcissistic. Do you have anything that's branded? And Firefox was a fork also, and much of their code came from Netscape. What's your point? Is there one?

Last edited by Ron (2021-04-30 02:16:16)

blackhole · 2021-04-30 07:16:30

andyprough wrote:

But palemoon didn't really even block the extension he was mad about, just made you flip a bit in about:config to be able to install it. For example, he's upset that they "blocked" noscript, but I was still using noscript with palemoon quite recently by flipping that bit in about:config.

Mozilla have been doing this for years with firefox i.e. removing UI elements from the browser chrome and only allowing tuning them in js config. If you look at for example Seamonkey's configuration, you will have a rough idea of earlier firefox configuration. Firefox UI based configuration is unusable to the extent that it was designed to ensure the user easily misses the things Mozilla (and its paymaster google) want them to miss. My point is that its not an excuse to remove an on/off control and the insist that users can alter the js config to get that same result. Why remove that control if you're not planning to deprecate it?

Once a project goes down that route, they're already knee deep in the same philosophy as e.g. the gnome or chromium projects - i.e. contempt for the end user and manipulation of said users to use the software only in the way the UI designers intended it.

As a general rule - if the UI control is removed, the ability to tune that variable from the js will follow, then it will be a compiler flag, then gone altogether. If you consider it carefully there is no other viable reasoning for hiding a UA control in the first place other than to deprecate it altogether to stop users from changing it

Last edited by blackhole (2021-04-30 08:47:41)

andyprough · 2021-04-30 14:49:42

blackhole wrote:

As a general rule - if the UI control is removed, the ability to tune that variable from the js will follow, then it will be a compiler flag, then gone altogether.

I think the fact that moonchild has been loudly and publicly stating for years that they would be breaking and removing the ability of legacy extensions to work should have been the first clue. The fact that he has been demanding people maintain their own legacy extensions or build new ones that will work with palemoon into the future should have been the second clue. And quite a few people have begun building and maintaining extensions. digdeeper is complaining about something that we all knew was coming for years. Like a lot of us, he likes his legacy extensions and thinks palemoon should support them forever, but that's not the goal of the project.

mstrohm · 2021-04-30 15:55:17

blackhole wrote:

The developers are making some very questionable decisions - and perhaps it's time the browser's fans cast their minds back as to why they stopped using browsers such as chrome or firefox?
The way the forum is administered and how the lead developers behave, may be irrelevant to the actual software itself, but the obnoxious and arrogant posturing and in particular the attitudes on show in the "insect" comment and the posting directed at the individual trying to work on an OpenBSD port, is in fact reflected in the code - in the decisions regarding tor, add ons, blocking user agent override, etc - in general foisting changes on users for a particular reason, while publicly offering another line of reasoning - not so plausible reasoning. For example the UA override removal and reasons stated for doing so were questionable - and it's likely that the same narcissistic reasoning of "branding" was behind that, as it was with the OpenBSD port situation - in that allowing users to masquerade as firefox his perceived "market share" suffers. It looks like it's - "Our browser, Our way"... Except in reality it's a fork, with the overwhelming bulk of that code being from decades of dev work at Mozilla (and Netscape before that).

Too bad to see that the Palemoon developers apparently act in the same manner as Mozilla does in regard to unwanted changes (like the user agent setting). And the arrogant attitude of two main developers certainly doesn't contribute to a good working environment in the Palemoon project.

I took a quick look at the current Firefox source code (see https://hg.mozilla.org/mozilla-central/file ) to get a first-hand impression of the code quality. I looked at some files in the "browser" and "netwerk" folders. The files I looked at are written in C++98 (raw pointers, const char* instead of std::string), even the newer ones like those for the HTTP3 protocol. I haven't found a header file with documentation blocks, but instead multiple classes in one header file and cpp files with almost no comments. Furthermore, I found hints in the form of include directives that the Firefox developers implemented things like mutex and weak_ptr themselves instead of using the implementations in the standard library. If the rest of the code is the same way, then I can understand why Firefox forks are so rare... Then the only option indeed would be writing own browsers, made by the community, for the community.

Last edited by mstrohm (2021-04-30 15:56:15)

blackhole · 2021-04-30 17:08:52

I'm sure that if you look at most browsers and in fact the source code of many well known GUI applications, you'll find similar.

As headstick knows, Theo de Raadt gave a fairly casual "best of a bad lot" endorsement to chromium, as the code quality and security aspects are well ahead of Firefox, but chromium comes with many other problems such as horrible UI and being a google project. It's partially why there are so many forks. The problem I find is that none of the forks are any good or worthwhile or come with their own problems - Brave being one example. Or the fork is from the likes of Microsoft...

Terrible choices, but given all those choices Firefox still come out looking like a better option than many others. Aping chromium and taking google's money for years has gotten them to where they are now - fielding the only viable contender to a chromium / chromium based mono culture, having lost most "market share" to chromium, but with google in a position to pull the plug at any time... talk about "own the resistance".

Last edited by blackhole (2021-04-30 17:14:40)

mstrohm · 2021-04-30 18:01:04

Instead of forking Firefox or Chromium, one could also continue the development of the Dillo browser: https://www.dillo.org/

The source code has better documentation than the files of the Firefox source code I have seen: https://hg.dillo.org/dillo
And Dillo is released under the terms of the GPLv3, so there should be no trademark worries as with Firefox or Palemoon and no risk of building software that could be used in a closed source software as with the BSD-licensed Chromium.

Plus, Dillo has FTP support built-in

Last edited by mstrohm (2021-04-30 18:01:38)

yeti · 2021-04-30 19:50:45

mstrohm wrote:

And Dillo is released under the terms of the GPLv3, so there should be no trademark worries as with Firefox or Palemoon and no risk of building software that could be used in a closed source software as with the BSD-licensed Chromium.

Licenses wars again?
Please put that into an own thread.

mstrohm wrote:

Plus, Dillo has FTP support built-in

FTP is a DilloPlugIn: https://hg.dillo.org/dillo/file/tip/dpi/ftp.c

/*
 * Dpi for FTP.
 *
 * This server checks the ftp-URL to be a directory (requires wget).
 * If true, it sends back an html representation of it, and if not
 * a dpip message (which is caught by dillo who redirects the ftp URL
 * to the downloads server).
 *

I've playing with Dillo on my to do list because of its easy looking DPIs, but still some other topics have a higher position there.

Several stuff normally directly baked into the browser is realised as DPIs in Dillo:

—▷ https://hg.dillo.org/dillo/file/tip/dpi

And externally developed DPIs don't look sooooo scary...

—▷ https://github.com/boomlinde/gemini.filter.dpi

Ron · 2021-05-01 03:28:24

I'm still surprised some people are crying like babies over this. How many times did Firefox "break" these legacy extensions in the past? Why do you think some of those extensions had so many updates? You can't expect frozen extensions to continue to work forever in an actively developed browser. What's so hard to understand about that? I mean, people seem more upset over this than Firefox totally abandoning this type of extension in favor of webextensions. It makes absolutely no sense to me. I also get the impression that a high majority of people bitchin' over this don't even use Pale Moon (they just have a weird hatred of it).

Last edited by Ron (2021-05-01 03:31:54)

mstrohm · 2021-05-01 10:12:22

Ron wrote:

I'm still surprised some people are crying like babies over this. How many times did Firefox "break" these legacy extensions in the past? Why do you think some of those extensions had so many updates? You can't expect frozen extensions to continue to work forever in an actively developed browser. What's so hard to understand about that? I mean, people seem more upset over this than Firefox totally abandoning this type of extension in favor of webextensions. It makes absolutely no sense to me. I also get the impression that a high majority of people bitchin' over this don't even use Pale Moon (they just have a weird hatred of it).

This thread is not about browser extensions or the need to update them from time to time. It's more about Firefox (and Chromium) removing features like FTP that are still useful for some people while introducing other questionable "features" like Pocket, new UI and hiding useful configuration entries.

jobbautista9 · 2021-05-01 14:01:58

Welp, someone mentioned Pale Moon and the forums go nuts about it

yeti · 2021-05-01 14:14:33

It starts to derail the topic a bit ... or already an unsingned long?

Hit shappens!

jobbautista9 · 2021-05-01 14:22:12

Anyway, back on-topic, it seems that the justification by Mozilla's apologists for embedding JavaScript in PDFs is that "almost every webpage have JavaScript anyway, so why bother about security?"

But they are looking on the wrong direction. If you need dynamic content, you should use HTML for that, because that's designed for the web (unlike PDFs). PDF is already a PITA in terms of security in the past, why reintroduce that nightmare? When Adobe, which is native, does it, it's not okay, but when browsers do it, which never was meant to render PDFs, it's okay all of a sudden? I don't understand.

Last edited by jobbautista9 (2021-05-01 14:23:42)

dice · 2021-05-02 11:46:29

jobbautista9 wrote:

Anyway, back on-topic, it seems that the justification by Mozilla's apologists for embedding JavaScript in PDFs is that "almost every webpage have JavaScript anyway, so why bother about security?"
But they are looking on the wrong direction. If you need dynamic content, you should use HTML for that, because that's designed for the web (unlike PDFs). PDF is already a PITA in terms of security in the past, why reintroduce that nightmare? When Adobe, which is native, does it, it's not okay, but when browsers do it, which never was meant to render PDFs, it's okay all of a sudden? I don't understand.

exactly., they are trying to do far too much stuff imo. Years ago browsers did not have embedded pdf viewers, you needed outside software for this, namely adobe, but not anymore due to foss. Mupdf, ftw! Smart folks create website without javascript sorcery, but it seems it is the ever present cancer killing most websites these days.

yeti · 2021-05-02 13:52:17

TL;DR … I don't have answers, just more questions.

dice wrote:

exactly., they are trying to do far too much stuff imo. Years ago browsers did not have embedded pdf viewers, you needed outside software for this, namely adobe, but not anymore due to foss. Mupdf, ftw!

Some want a whole OS in the browser, others want it to do only HTML and code everything in it.
Wait!
Isn't the HTML-only browser an OS in HTML then?

Convergence of features means convergence of attack surface.

I think both strategies will converge in functionality, and that way the attack surface will converge too. If you "emulate" your favourite external applications in "active" HTML1337-extensions, they will be able to do the same harm as your external "PDF-browser (with JS)" sure can do too. I'm not looking at browser sandboxes now, because you could do the same with chroots, jails, containers, VMs in your real(?) OS too.

You download a PDF with JS internals, a LibreOffice spreadsheet/document with active parts or even an Emacs/Org/Babel text with executable Babel blocks inside and you may have an unwanted surprise soon.

The problem isn't the embedded PDF viewer with JS, the problem is allowing possibly dangerous functionality by default.

# local variables:
# visual-line-mode: t
# org-babel-noweb-wrap-start: "«««"
# org-babel-noweb-wrap-end: "»»»"
# org-confirm-babel-evaluate: nil
# end:

Sure that's (config vars at end-of-file, only one of these lines is a danger) neat with your private texts, where you know which text contains which active parts, but in this example Emacs will ask at loading time. It you put the same setting in your Emacs startup, it won't. Will you always read that config vars list Emacs wants you to confirm or just semi-automagically type the spell to allow continuing?

While clicking on foreign stuff you typically won't have the knowledge which stuff contains harmful contents and which doesn't. But will a question "Allow activating feature XYZZY for this text? [yes] [no] [always]" really help? How many individual "[yes]" clicks will it cost until René Average will click "[always]"?

Why have a walled garden, while letting everyone or everything inside?

But now for something completely different?

dice wrote:

Smart folks create website without javascript sorcery, but it seems it is the ever present cancer killing most websites these days.

Smart folks still live in caves and fire is their newest achievement.

Or: It isn't that simple.

If we would declare (TeX's) DVI files with links inside as default format for the web, sure lots of users would call for helpers to get active parts too. The development would repeat with just a different base format. There is some deeper problem/demand involved. Maybe Sasha Average looks at computer screens as new TVs?
They have to be wriggly and make sounds?

There is a demand for these features, and so we need to find ways to present them in a safe way, or at least, as not everyone is coding, should find ways to demand them being implemented in a safe way, and the right to make providers of unsafe stuff accountable for their damage.

We need the data cattle uprise...

I'd prefer a world where I don't need to wall and lock my house and garden.

...but that may stay a dream.

mstrohm · 2021-05-03 18:36:47

dice wrote:

exactly., they are trying to do far too much stuff imo. Years ago browsers did not have embedded pdf viewers, you needed outside software for this, namely adobe, but not anymore due to foss. Mupdf, ftw! Smart folks create website without javascript sorcery, but it seems it is the ever present cancer killing most websites these days.

JavaScript (or more geneal: dynamic content on web pages) has its benefits. You don't want to reload the whole page when you clicked a delete icon in a list to remove on entry out of it. But today there are websites that don't even load text when JavaScript is turned off. So your browser makes a request to load an empty HTML document, then some JavaScript and then the JavaScript makes AJAX requests to load the content. What a waste of energy and time!

The good thing is that the gemini protocol and its markup format doesn't allow script (as far as I know) so you will always be able to read the text on a gemini page. If Firefox/Chromium together with the HTML5/Javascript world continues to become a de-facto blob world, because the JavaScript is getting too complex to study its code, the gemini protocol with a wide variety of browsers will continue the goal of the internet: Make information available to everyone.

yeti · 2021-05-04 04:52:06

mstrohm wrote:

The good thing is that the gemini protocol and its markup format doesn't allow script (as far as I know) so you will always be able to read the text on a gemini page. If Firefox/Chromium together with the HTML5/Javascript world continues to become a de-facto blob world, because the JavaScript is getting too complex to study its code, the gemini protocol with a wide variety of browsers will continue the goal of the internet: Make information available to everyone.

Nope!

From Gemini's master's page:

$ printf 'gemini://gemini.circumlunar.space/\r\n' \
    | ncat --ssl gemini.circumlunar.space 1965 \
    | head

20 text/gemini
# Project Gemini

## Overview

Gemini is a new internet protocol which:

* Is heavier than gopher
* Is lighter than the web
* Will not replace either

And I bet he's right with the last line.

Please let's continue to dream of safe Browsers instead.

GlennW · 2021-05-04 08:43:25

I have webbrowser built and setup now. And none of the denial of "freezing/pausing" with palemoon. :-)

dice · 2021-05-04 14:26:58

@ yeti, im quite happy with plain text messaging, although many are not and need pretty printing to alleviate some form of ocd.

msi · 2021-05-05 22:09:05

dice wrote:

im quite happy with plain text messaging, although many are not and need pretty printing to alleviate some form of ocd.

Or, just maybe, some people really care about solid text formatting (for usability's sake), which you simply cannot do with plain text. And just because you prefer the primitive way of doing something, that doesn't automatically make it more reasonable. And it certainly doesn't mean that people who don't prefer it are mentally ill.

dice · 2021-05-06 01:51:21

msi wrote:

dice wrote:
im quite happy with plain text messaging, although many are not and need pretty printing to alleviate some form of ocd.
Or, just maybe, some people really care about solid text formatting (for usability's sake), which you simply cannot do with plain text. And just because you prefer the primitive way of doing something, that doesn't automatically make it more reasonable. And it certainly doesn't mean that people who don't prefer it are mentally ill.

My apologies for that off handed remark, i didn't realise ocd was a form of mental illness.

Im getting confused with meanings here also, what i mistakenly meant in my previous post by pretty printed is bloated websites and pdf's like forms, newsletters and such that are sometimes so bloated it takes a while for them to load and navigate, so just getting back to the js that is creeping up inside pdf's as a way of messaging like newsletters, notices, official documents and all sorts of ways that pdf's get used nowadays. I do care about text formatting for readability and usability, sometimes it gets taken too far in my opinion.

So of course it doesn't automatically make my opinion of it more reasonable to just use plain text messaging and my opinion is not going to change peoples minds, so again apologies if it seems that I inferred that.

Last edited by dice (2021-05-06 01:51:45)

golinux · 2021-05-06 02:47:40

[off-topic]

dice wrote:

My apologies for that off handed remark, i didn't realise ocd was a form of mental illness.

All humans suffer from the "metal illnesses" of greed, hated and delusion. IMO, there is no need to tiptoe around that. It is irrelevant that deluded Western "therapists" just have to assign a name and acronym for every quirk on the gamut when they themselves are equally "defective", each in their own way. The naming only excuses certain behavior. Would be nice if we could own and remove our own defects rather than pointing the finger elsewhere. Sadly, self-examination is not a popular activity in the West and thick skins are in increasingly short supply these days . . .

dice · 2021-05-06 13:44:19

golinux wrote:

[off-topic]
dice wrote:
My apologies for that off handed remark, i didn't realise ocd was a form of mental illness.
All humans suffer from the "metal illnesses" of greed, hated and delusion. IMO, there is no need to tiptoe around that. It is irrelevant that deluded Western "therapists" just have to assign a name and acronym for every quirk on the gamut when they themselves are equally "defective", each in their own way. The naming only excuses certain behavior. Would be nice if we could own and remove our own defects rather than pointing the finger elsewhere. Sadly, self-examination is not a popular activity in the West and thick skins are in increasingly short supply these days . . .

Their is a good George Carlin video about this.

Soft Language

https://www.youtube.com/watch?v=o25I2fzFGoY

Ah the english language! Maybe i should have just said obsessive, maybe my brain is too hard wired into the matrix!

Last edited by dice (2021-05-06 13:49:08)

The officially official Devuan Forum!

#26 2021-04-29 02:45:44

Re: ${THEY} continue crippling browsers...

#27 2021-04-29 17:15:36

Re: ${THEY} continue crippling browsers...

#28 2021-04-29 20:36:26

Re: ${THEY} continue crippling browsers...

#29 2021-04-30 02:14:43

Re: ${THEY} continue crippling browsers...

#30 2021-04-30 07:16:30

Re: ${THEY} continue crippling browsers...

#31 2021-04-30 14:49:42

Re: ${THEY} continue crippling browsers...

#32 2021-04-30 15:55:17

Re: ${THEY} continue crippling browsers...

#33 2021-04-30 17:08:52

Re: ${THEY} continue crippling browsers...

#34 2021-04-30 18:01:04

Re: ${THEY} continue crippling browsers...

#35 2021-04-30 19:50:45

Re: ${THEY} continue crippling browsers...

#36 2021-05-01 03:28:24

Re: ${THEY} continue crippling browsers...

#37 2021-05-01 10:12:22

Re: ${THEY} continue crippling browsers...

#38 2021-05-01 14:01:58

Re: ${THEY} continue crippling browsers...

#39 2021-05-01 14:14:33

Re: ${THEY} continue crippling browsers...

#40 2021-05-01 14:22:12

Re: ${THEY} continue crippling browsers...

#41 2021-05-02 11:46:29

Re: ${THEY} continue crippling browsers...

#42 2021-05-02 13:52:17

Re: ${THEY} continue crippling browsers...

#43 2021-05-03 18:36:47

Re: ${THEY} continue crippling browsers...

#44 2021-05-04 04:52:06

Re: ${THEY} continue crippling browsers...

#45 2021-05-04 08:43:25

Re: ${THEY} continue crippling browsers...

#46 2021-05-04 14:26:58

Re: ${THEY} continue crippling browsers...

#47 2021-05-05 22:09:05

Re: ${THEY} continue crippling browsers...

#48 2021-05-06 01:51:21

Re: ${THEY} continue crippling browsers...

#49 2021-05-06 02:47:40

Re: ${THEY} continue crippling browsers...

#50 2021-05-06 13:44:19

Re: ${THEY} continue crippling browsers...

Board footer