Comment by Sylos | Hacker News Reader

Comment by Sylos | Hacker News Reader

Parent Full thread

Servo is actually not typically viewed as realistically completable. Even Firefox, which is being developed full-pelt, is behind on web standards (like any other browser is).

So, for Servo to catch up to the current state of Firefox and to then also keep pace with new web standards, it would have to be developed much quicker than Firefox is being developed. So, that would require more than double the development capacity that Mozilla currently has, as they can't drop Firefox development either.

There is some points that could alleviate this: <ul> <li>A smaller project grows quicker, <li>it being written in Rust might speed up development in the long run and <li>several components are now shared between Firefox and Servo, meaning that the development and maintenance work is shared as well, <ul> but it still is far away from realistically completable.

Which is also not what the project is meant to be. It's a research project. Trying out new things, creating components that can be used in Firefox, and doing experiments with VR or similar are exactly what it can be used for.

It's helluva more completable then any VR project Mozilla is going to try. It will be another Firefox phone project.

And you don't have to repeat 20 years of Firefox to complete Firefox, a lot of it were dead-ends like XUL (themed GTK would do), a lot of it were non-essential features like Pocket and a lot of it were rewrites and mistakes that they won't have to repeat and like you said being written in Rust should speed things along. Lastly, I don't care if Servo is released standalone or if Firefox gets replaced by Servo like the ship of Theseus, all I care about is browser that is less explodable, otherwise I'll continue on Chrome.

They already have completed VR projects: https://vr.mozilla.org/

Pocket required essentially no work. They bought an existing service and stuck a fancy bookmark for it into Firefox.

And well, I'm mainly just repeating what Mozilla devs have said. They are deeper into the matter than both us, they can better judge just how much work it is. And it's easy to forget just how complex web browsers are. None of the major browsers use a browser engine which's development started in this millenium for exactly this reason.

I'm also not aware of Chrome being less explodable. I'd say, it's more explodable with its malware-filled extension store, default unencrypted sync service and annecdotally a vulnerability like this [1] being left unfixed for years and careless behaviour like this [2].

[1]: https://github.com/anttiviljami/browser-autofill-phishing

[2]: https://www.wired.com/story/chrome-yubikey-phishing-webusb/

Firefox used to have a worse security architecture, but it's essentially equivalent now. The only real difference that I'm aware of, is that Firefox by default groups processes for tabs, meaning if a webpage manages to exploit a major vulnerability in Firefox to gain control of the process it's being executed in, then it has access to 1/4 of your tabs and therefore might potentially be able to steal sensitive data, whereas in Chrome it would then also have to exploit a vulnerability in the OS to do that.

> They are deeper into the matter than both us

Or execs are driving a bus into the wall. It wouldn't be the first time that happened for sure.

> I'm also not aware of Chrome being less explodable.

It used to be. It only took them 10 years to enable sandboxing.

> with its malware-filled extension store

And no rational person installs extensions from it for that reason without first checking who stands behind the extension.

> then it has access to 1/4 of your tabs and therefore might potentially be able to steal sensitive data

So essentially not equivalent.

Reply on news.ycombinator.com