What will a Chromium-only Web look like?
mnot.net
mnot.net
Without a second browser engine to test pages in, it's really hard to know what is a bug and what is intentional. Devs don't know all the specs by heart. They write whatever happens to work for them, but sometimes they accidentally depend on obscure edge cases in the implementation that were never meant to exist.
In the long term it's paralysing for the engine maintainers, because any change in implementation could be changing some subtle behavior that breaks some pages. W3C requires two independent implementations, so that they'll share intentional behaviors, but hopefully their bugs will differ.
The single-engine Web will be as fun to maintain as Windows: Windows 11 Explorer has a shiny new context menu with an option to reopen it as an older, uglier context menu, because Microsoft couldn't touch a line of code of the old context menu without breaking apps.
They aren't even bugs. The spec allows for interpretations.
Even if the spec was as precise as a source code of another browser, that's not what devs are writing for, so code in the wild web will inevitably deviate from the spec.
And by the way - I'd argue that HTML and CSS are not more "forgiving" towards the user, "silently failing" would be a more appropriate definition. I'd rather have an error message saying there's an unclosed tag so the page couldn't be properly rendered rather than the browser trying to infer meaning from broken HTML and misapplying CSS, generating a dadaist poetry piece instead of a blog page.
These bugs were the worst, because they happened to end users. Users couldn't do anything about unclosed tags or unescaped ampersands, not even notify the developer of the page that refused to display.
Back then HTTPS was rare, but young mobile ISPs loved "optimizing" middleboxes that were messing up the markup. Even if you generated a flawless markup, your pages still wouldn't work for some users. Users were told that your page is bad, and it's your fault, and couldn't contact you about it. ISPs didn't care, because hardly anybody actually used the strict XHTML parsing mode (it made pages inaccessible to IE that had 80% market share). Most "XHTML" pages worked fine thanks to being parsed as regular HTML with invalid extra slashes.
I know this isn’t everyone’s experience, but I believe adding IE11 support to my personal website improved the quality of my code.
There were a lot of things I hadn’t specified explicitly, and for whatever reason Chrome/Webkit and Firefox just happened to make the right guesses. IE11 did not, so I had to go back and be clear about exactly what I actually wanted.
Building a browser for the modern standards-based web is effectively impossible, because it costs too much, takes too long, and requires a standing army to keep up with.
We are at an impasse. The standards cannot be deprecated because they are used all over the web, and because they are used all over the web a new browser maker has little choice except forking chromium or firefox. Even microsoft couldn’t afford to keep adding all the standards to their browser engine. Normally the solution for a messy overgrown implementation is a grand reboot. But we can’t do a grand reboot of the web because we cannot get rid of the legacy. The only viable strategy I see to have real browser engine diversity without giving up on compatibility is moving as much of the standards implementation as possible into JS modules, so new browser makers can start with a small engine that loads the publicly hosted standards modules.
>Building a browser for the modern standards-based web is effectively impossible, because it costs too much, takes too long, and requires a standing army to keep up with.
I wonder which company grew their browser marketshare through ruthless advertising on their already-a-monopoly search engine, then began to compete with the other browsers by purposefully breaking their websites on other browsers (all by accident of course, hundreds of times), then began to implement their websites with alpha versions of their proposed web standards that only their browser properly implemented, leaving other browsers with a dreadful polyfill that had horrible performance on purpose, only to then basically force their proposals through the web standards body that they had made because they couldn't control the W3C, leaving everyone having to follow such great APIs as WebUSB or other badly-implemented-but-only-by-them flavor of the day API, all the way to forcing dreadful protocols like QUIC and HTTP/3, justified by their need to save up three bytes per request and making the user's experience better while they serve 2MB of tracking javascript and ads through DNS-cloaked servers.
I think the name was like... Gogle ? Golgool ? Can't remember.
That is the standardization process. The W3C won't ratify a standard that does not have draft implementations in the wild.
Making it the default and making the fallback only reasonably accessible by installing an extension that will rewrite your links (that all send back to the alpha-using version), causing every browser that isn't Chrome to slow down to a crawl while you happily display a "Hey, did you know the web is faster with Chrome?" isn't working through the standardization process, it is weaponizing it to sabotage other browsers.
A body of web standards that they lobbied for and to be in the form that they are...
As an example, Google holds 18 of 39 seats on the Web Assembly Working Group. This means that if they whip their seats, they only need 2 additional votes to pass anything.
That's making big assumption: that decisions are made by votes, and those votes are done purely based on participation.
And they're not. For decisions within the WG, they're normally done by some notion of rough-consensus (frequently, lack of significant dissent); actual votes within most WGs are relatively rare.
For decisions at the W3C level, it is admittedly done by votes, but it's one-Member, one-vote, so in that case all W3C Member are equivalent in power: Google, Apple, Microsoft, Mozilla all have their votes count as one.
This is pretty normal within industrial standards development organisations: voting happens at an organisational level, representing the industrial members, not based on individuals participating from those members. (There certainly are negatives associated with a disproportionate number being from a single organisation, but that's mostly related to disputes in meetings ending up with one individual arguing against ten.)
The first step in saving the web needs to be to stop adding so many new standards that are only needed for "apps".
> Building a browser for the modern standards-based web is effectively impossible, because it costs too much, takes too long, and requires a standing army to keep up with.
> We are at an impasse. The standards cannot be deprecated because they are used all over the web, and because they are used all over the web a new browser maker has little choice except forking chromium or firefox.
the browser just becomes an execution engine, the current "web stack" becomes a (cacheable) downloadable library, meanwhile other languages, ui frameworks etc can flourish in the browser (now a much more simple thing that anyone can implement)
maybe just pie-in-the-sky?
The web works because of HTML. HTML is scanable, searchable. It's what allows search engine to exist at all. HTML enables extensions. HTML is also generally responsive. HTML allows uses to be in control (see extensions). HTML allows uses to copy and paste and even for sites that try to prevent it users can go into devtools to get the text. HTML supports all of unicode and so is inclusive across all languages.
A world in which the browser is just an executable environment and people make random UIs means pretty much all of the above disappears. No more searching for content, no more extensions to block ads or block distrdacting feature. No more extensions for language translation, braille, accesabiltiliy. No more all language support, only whatever each framework decides to support, every page with different limits at different versions of the frameworks.
Anyone who writes a compiler or engine for WebAssembly is going to have to deal with the mess of web standards, unfortunately.
What might happen is that it ushers in technically-unrelated fashions, such as standard WASI interfaces to something slightly less insane than DOM+Javascript.
Just Canvas-over-WASI isn't the answer because of accessibility, but something like it might happen.
Heh. Now you have two problems. One of them is JS, which was a mistake in the first place and now we can't get rid of it for similar reasons.
what exactly is the benefit of having a byzantine set of standards in the first place? Like why not just have a standard and not dick around with it?
If there are things browsers can't do natively, then someone will build their own way to do it and then you end up with non-standard implementations.
It's better to get everyone on the same page and develop an open standard.
Adobe / Macromedia started from the designer perspective but Flash soon became a goal of its own because Adobe wouldn't give up that marketshare.
Only now all parties realise it's too big for one company to own. Well except Google perhaps.
Users and website creators wanted these features and Flash was the way to do them.
Sure, other technologies like Microsoft's Silverlight allowed similar things, but Flash was so widely used it could be relied on to offer these features.
Even now things like clipboard access aren't supported in the same way across all of the major browsers.
They got exactly what they wanted, but its not their fault?
The problem is not in the lack of browser rendering engines, but the lacking innovation and product features of the browsers running these rendering engines.
> we can’t do a grand reboot
(inb4 XKCD) Yes, like a new standard.
>While Android is open, it's more of a "look but don't touch" kind of open. You're allowed to contribute to Android and allowed to use it for little hobbies, but in nearly every area, the deck is stacked against anyone trying to use Android without Google's blessing. The second you try to take Android and do something that Google doesn't approve of, it will bring the world crashing down upon you.
Sure, the license is open, and Chromium is therefore technically open. But it's dangerously close to not being usable in any real practical meaning of "open source".
The way things are, we do indeed stand on the precipice of a Chromium-only web with—for all practical intents and purpose—no open browser. Firefox is the last thing that stands between us and that reality. It's just a shame that they seem to be wasting hundreds of millions on admin and management instead of just throwing it all at their developers.
I can't see anything about this anywhere giving any reasons; is it simply that they're released frequently and there aren't really any long-lived branches?
And we still have to see if other browsers will block the Topics API spyware or not.
As for the Topics API, It looks like to be a new copy of FLOC, which flopped immediately on release, as no body adopted it other than chrome.
Microsoft just did whatever they wanted with the web "platform", and so will Google.
In Microsoft's case what they wanted was nothing. They weren't a web business, saw it as a threat to their platform leverage, and so just left it abandoned and stagnant for years.
Google is simultaneously better and worse: they won't leave it stagnant because the web is their platform, but on the other hand they have a lot more to gain by abusing control of it.
We already have a number of Chromium based browsers that go against some of Google's most fundamental interests (e.g Brave).
Costs matter, and Web development costs are high. Google benefits from coordination, funding, and one migh presume, cost advantages, which would be exceedingly difficult for any comparable US or EU effort to match.
Development in lower-cost-of-living regions, perhaps most viably China, might pose an alternative.
Open source is that option. The economics of starting from scratch vs starting from Chromium's latest commit are fundamentally different.
I'm not saying that it's easy, only that it is not remotely comparable to the IE situation.
MSIE was bypassed not by a code fork of MSIE (itself originally based on the Spyglass browser, which was a fork of the NSCA's Mosaic codebase), but by independent implementations of an HTML-standard parser. Microsoft had some influence over Web development (noteably through ActiveX) but far less than Google has now.
My point is that Open Source of itself is not sufficient, and moreover simply is not viable. Glibly asserting that it is ... is utterly unrealistic.
Though the alternative of forking a Web-like markup and transport, as Gemini is attempting to do, is one option. For other technologies which have become sufficiently baroque, similar worse-is-better alternate paths have been pursued.
Otherwise, this is an antitrust issue, and Google very badly need busting.
And I didn't claim that it was. My point was merely that Chromium being open source changes the equation pretty fundamentally compared to the IE situation.
Whether it's enough to make a Chromium monopoly consistent with an open web, I really don't know. There are very good reasons to be sceptical.
So you’re not claiming open source is sufficient but you are seemingly defending it is a better situation.
While I and some other commenters are signaling we don’t think the situation is better.
To me the fundamental part of the equation is outsized power and influence. Being open source or not is part of the equation, but not as close to as fundamental as the core issues with this. This is made much much worse now than 20 years ago with the costs to get your own browser going so much higher. Which leads back to the outsized power being the fundamental issue.
Open source can even be argued to be a benefit to Google retaining power. Having enough attention diverted to the possibilities of open source when Google has only monumentally gained from open source with paltry benefits that are usually brought up as defenses against its power. Like AOSP mattering because China doesn’t use Google’s Android and some other irrelevant projects.
Any fundamental differences so far are giving Google and any other major central powers more power.
I'm not seeing your more recent statement as consistent with the first, given my own response: "Open source without the option for an alternate development organisation to drive or steer development direction means vey little."
Again: Microsoft's locus of control was not based on source code or standards, but on its control over the PC desktop market. MSIE shipped by default with that desktop, and any other browser, including Chrome, had to find its way to that desktop.
Microsoft has now ceded its own browser engine (Trident, I believe) for Google's (Blink), with Microsoft Edge. As this browser still ships by default with Windows, Chrome owns that platform by default.
Google also controls its own operating systems, Android (mobile and tablets) and ChromeOS (Chromebooks). Given Android's overwhelming numerical advantage in overall devices,[1] Google effecitely have Microsoft's previous leverage mechanism to themselves.
Google as the dominant search provider have an advertising advantage in advocating their browser, both within search and on Google properties with "works best with Chrome" or equivalent.
And again, Google effecitvely dominate both development of Chrome and Chromium, including gatekeeping over what code makes it in to each project, and through its own browser development, dominance within WHATWG, and ranking preferences withing Google Web Search, as well as compatibility favouritism through popular Google properties such as YouTube, Web standards themselves.
Microsoft's monopoly lock-in had a single peg, Google has four (OS, promotion, Chrome development, Web standards).
I do have to admit though, yes: It is a completely different situation. Microsoft's advantage was far weaker than Google's now is.
________________________________
Notes:
1. "As of April 2022, Android, an operating system using the Linux kernel, is the world's most-used operating system when judged by web use. It has 43% of the global market, followed by Windows with 30%, Apple iOS with 17%, macOS with 6%, then (desktop) Linux at 0.98% also using the Linux kernel." https://en.wikipedia.org/wiki/Usage_share_of_operating_syste...
My point was merely that Chromium being open source changes the equation pretty fundamentally compared to the IE situation
I don’t think they are. That fork then immediately finds itself in the same position as other engines, where now the fork is going to need to keep up with whatever Google is adding to Chromium.
You might then think, “Then the fork can just pull from upstream.”
Okay, so then:
a) Your fork probably isn’t differentiated enough to matter; and more importantly
b) Google is still effectively calling all the shots!
Even more so the fact that Brave was able to build an alternative ad network on top of Chromium.
That's where Firefox is right now, unfortunately.
I've told some people to switch to Firefox. A lot of them switch back to Chrome after a while, simply because it's faster.
Linux itself is at least not a proprietary and commercial entity, though quite arguably its development has largely been captured by a set of proprietary and commercial entities. There's enough multilaterality in that group that fixed loci of control don't seem overwhelmingly apparent, but I'd definitely watch for those.
I've been concerned over numerous elements of Linux development (including viewpoints expressed by senior developers) for a decade or so. I think you'll find some level of concern expressed by others, including some very senior former Linux devs. (I'm not positive A.C. has said as much, though that's a vibe I get.)
The same thing has happened to Linux which was ok as long as it was chasing commercial Unix, spawning POSIX even; but look what happened with systemd, wayland, snaps/flatpacks, Docker, k8s, and all the other erratic developments - all the while not a single end-user app was created in the last decade.
Strongly disagree. Desktop Linux is better than it's ever been before, and not at all comparable to the degenerate hellhole that is the modern web.
systemd isn't perfect, but I think it's an improvement from traditional init. If you prefer the simplicity of traditional init systems, then you're free to use a non-systemd distro. Wayland is a much-needed modernization and simplification of the graphics stack, and again, nobody's forcing you to use it - X11 won't disappear any time soon. Snap, Flatpak, Docker, etc aren't exactly my cup of tea either, but again, nobody's forcing us to use them. Debian, Arch, etc are chugging along just fine. Meanwhile, PipeWire is a significant improvement compared to bare ALSA or Pulse+Jack, and iwd is a significant improvement compared to wpa_supplicant+NetworkManager.
As for new end-user applications, how about Sway?
This is the tragedy of the Linux Desktop. The problem with F/OSS is the "Free" part (as in "Beer"); as long as users resist paying for software, you will never have a rich enough ecosystem to develop that very software. The problems you list with "systemd, wayland, snaps/flatpacks, Docker, k8s, and all the other erratic developments" is that they are largely meant to solve corporate problems.
Safari definitely does not just follow suit (see https://caniuse.com/?compare=chrome+102,safari+15.5&compareC... for example).
Many of those features can be used to comprehensively fingerprint your device allowing advertisers to track you across sites even without cookies. Forget about any laws or privacy efforts it would all be moot. And many of us value privacy far too much.
Apple even implemented the "do not track" API and advertisers completely ignored it.
Call me when I can install Safari on linux (or any platform other than macOS/iOS).
Until then - the ugly truth is that Apple intentionally underfunds and underdevelops the browser because they see it as a fundamental risk to their control and revenue from the App store.
It's there because "they have to have a browser" not because they're doing anything novel or clever. And many of the things they refuse to implement aren't related to ads or Google's control at all - they're things that would have narrowed the gap between what a website can do on iOS, and what the App store apps could do.
Again - Apple is acting EXACTLY like microsoft here. Underinvesting in the browser because they see it as a fundamental risk to their best revenue stream - much like how MS ignored IE when the focus was all on local apps (the king of which was still MS office).
These APIs are one of the big areas where chrome/google have tried to expand the remit of what's possible with web apps, for example the file system api can be used by a web app to access files directly on a users machine.
Where things went off the rails was the things Microsoft refused to implement due to their monopoly position. They had a binary component architecture, but it wasn't sufficient to run Java. They had Java, but it was a vestigial and crippled version. Their HTML/CSS engine was just "odd", incompatible not only with emerging standards but with any published standard at all.
Basically "the problem" with IE wasn't that Microsoft "did whatever it wants", it was that it did (or didn't do) very specific things intended to prevent users from wanting to use IE at all, in a vain attempt to favor desktop applications or IE-specific implementations.
Ironically, Safari is more similar to IE in that regard. The web isn't Apple's platform, either, so they're not too interested in continuing to develop it.
Oh and early on they had URL prefetching, but that led to badly written web interfaces from executing operations that shouldn't happen.
It's perfectly possible for Google to be engaging in similar behavior to Microsoft during IE era, while websites decide to support more than one browser for the moment. In the long run, Google's behavior could contribute to more websites deciding to support fewer browsers.
I'm already seeing the occasional website that doesn't work properly on Firefox - for the moment this is rare, but I wouldn't be surprised if it becomes more common.
For users, IE6 was an era of unrivaled simplicity where the essential hypertext purpose was already fulfilled. Trident (its layout engine) wasn't great but it got the job done. And that same era spawned alternative browsers around that engine, the same way we have Chromium derivatives today, where the real innovation happened. Tabs, ad/popup blocking, easy per-site searching, auto-cookie cleaning, etc. were all present in browsers like NetCaptor (https://en.wikipedia.org/wiki/NetCaptor) or Maxthon (https://en.wikipedia.org/wiki/Maxthon), which all used IE. Nobody had to worry about "will this page work in my browser".
For devs, IE6 was the closest thing to a real standard the Web ever saw... more than at any time before or since. Its monopoly created a much stronger de facto web standard than anything the W3C has tried to coerce or the WHATWG has tried to suggest. It allowed innovation around a common web layout, in terms of browser features, instead of overloading the DOM with flashy interactives that nobody asked for.
Then ActiveX came and went, competed with Java applets, Flash took over, Firefox and Webkit started taking off, Javascript got more powerful... and Microsoft's beautiful walled garden collapsed. What do we have to show for it, two decades later? Slower pages with unnecessary complexity, written in transpiled languages ten layers deep, with a UX more focused on dark patterns than getting to the point. What's your typical complex web app... Gmail? It's good, sure, but in replacing Eudora, we ended up with the messiest, jankiest, hackiest ecosystem in the history of consumer computing.
It was really too bad Microsoft was the one who got away with IE6's monopoly. If it had been a proper browser vendor who took (and maintained) control from the early days, the web would be a much cleaner ecosystem, like the walled garden app stores we have today.
Even today, we're back in the same situation with on iOS, where every browser is just WebKit underneath. iOS web browsing is thus a lot cleaner than than crapfest on Android, where every browser ships their own renderer and no two cheap Android phones ever render the same website the same way.
<old man yells at cloud>Frankly, I'm just not sure it's worth it? Twenty years of web dev later, and honestly I think it's just gotten worse. Most people still just want to look up restaurant hours or send a message to their friends or whatever. The rest is crust.</old man rant>
Edit: well, that and ActiveX, but that's not a good thing...
modern DOM, Ajax, modern CSS, bunch of other small details of JS, all iirc came from IE.
It could be just apathy towards choice. I've observed this behavior among GNOME advocates as well. Some of them would rather see GNOME as the only de facto choice for a desktop environment on Linux and considering how it's installed by default on most major distributions, those words and their effect aren't far fetched.
That's what it looks like to me as well but whenever this is asserted, GNOME folks are quick to point out that they are understaffed and GNOME is a community project. I suppose we'll never know the reality.
> Despite being an even larger collection of s/w than GNOME and strongly supported by SuSE
I remember reading on HN that SuSE has people for GNOME developement but no one for KDE development. IIRC, they also ship with GNOME as the default choice.
> That shows the power of big corporate money's ability to take over even ostensibly "FOSS" software that's theoretically free but practically still dominated by a few companies
I've mentioned GNOME being similar to Android and Chromium in its nature of "look but don't touch" open source (unless you are part of their "community") but this hasn't been received well.
openSUSE has a KDE team, but I'm not sure to what extent they do upstream KDE development. [0] Also, openSUSE does not have a default desktop choice. I don't know where the enterprise offering differs from the community offering in these matters.
[0] https://en.opensuse.org/Portal:KDE
[1] https://en.opensuse.org/openSUSE:Desktop_FAQ#How_to_choose_a...?
Mozilla (Firefox) was our chance for something different. They were ahead of IE once but they watched on and did nothing whilst they had their pockets lined up with Google's money and allowed them (Google) to overtake everyone and now everyone is complaining about it. It even goes back before Chrome was a thing when the Mozilla CEO declared that they could move away from depending on Google's money. [0] Now 14+ years later, they are still unable to do so.
Since then it is only Google (Chrome) and Apple (Safari) again, just like for Android and iOS. All other attempts at stopping them was a complete failure like Firefox OS was and now Mozilla and Firefox are the ones fizzling out of existence as they are unable to make money as the majority of users are running to Chrome, Brave, Edge and Vivaldi.
It is no wonder websites are beginning to not only break on Firefox, but also tell or block users from their web apps to instead use Chrome.
[0] https://web.archive.org/web/20120105090543/https://www.compu...
Really close to gnome 3 spirit, it continuously removed user features and personnalisation.
Gnome 3 really epitomized that but it's a general trend of linux on desktop catching up to proprietary os in first 2 decades culminating with the bonus coolness of compiz fusion.
And then the 2010-2020 were most of the time was spend changing the technologies (removing XUL,going to system-d,wayland) and the user experience suffered.
I think open software has a special responsibility to empower users not only through programming but also through their interface, it can be extension or extensive settings but it has to.
It ends up making more practical, feature reach software and open source needs that because we don't always all the resources to make the most polished software.
All of this I saw in the last few years, some of that is still valid today.
Browser compatibility bugs absolutely exist.
See https://github.com/webcompat/web-bugs/issues for some more examples.
Which was very frustrating given they are both free software :(
1: https://github.com/jitsi/jitsi-meet/issues/4758#issuecomment...
System requirements for Google Earth
- Google Chrome 67, Firefox 63, Edge 79, or Safari 11.
- Make sure that you turn on hardware acceleration.
But I do know that Apple Business Manager wont run - not sure why as it seems to be a fairly basic interface and says Firefox is supported, but yea I have to use Chrome for that
That seems like it'd be google nerfing other browsers, they're pretty anticompetitive. If it doesn't work in FF and is still maintained I bet if you change the browser identity to pretend it's chrome it'd probably work.
macOS-specific browser share numbers are hard to come by, but on our own moderately sized website we see about 60% of macOS users choosing Safari. Even if iOS allows other browser engines, presumably a similarly large number of iOS users would also choose Safari, either because it's the default or because they like it. So regardless of what happens with iOS regulation, it seems likely there will always be significant Safari usage on the web.
So then the only way we end up with a Chromium-only web is firstly assuming a worst-case scenario for Firefox essentially falling out of use, but its usage on desktop appears to have stabilised around 7-8%. Secondly Apple would then need to decide to ditch WebKit for Chromium. I can't imagine they'll ever do that. Apple have a strong desire to do things their own way and keep full control over how their browser works. So I think we're a long way from a Chromium-only web.
If they wanted to, they could switch Safari to Blink just like everyone else did, but still keep adding features on top of it (privacy, iCloud integration, whatever), the same way Microsoft does.
No user asks for a different layout engine, that's corporations fighting with different values and priorities. The differentiating features for users are layers above that and arguably held back by renderer differentiation.
Safari and iOS mobile are the main outliers. Firefox is a little behind too, but few people use that anymore.
Chromium/Blink development is what actively drives the web forward, with everyone else playing catchup. Apple just doesn't care about that (or is perhaps purposely trying to slow it down) in favor of their own priorities and platforms.
>Google had a plan called “Project NERA” to turn the web into a walled garden
https://twitter.com/fasterthanlime/status/145205394150468403...
It's not that they're one judgment away from that day. They know that. It's just that they want to get as much mileage as they can before they too abandon Safari and first allow, then switch to Chromium. That will happen in the next 5 years.
What might come of it all would be a reset where new branches form and new innovators get to introduce new proposals. Standards aren't a bad thing if they're open. If Safari dies then Google will be next in the line of fire for antitrust action anyway... things will fragment again. I'm personally pissed at the number of great technologies left as litter along the road, not least AS3, just to get to this shitty middle ground / cold browser war between two companies I hope die and one that won't help itself. Let the standards win and let's have a standard platform to innovate on top of.
That's one reason, but not the only reason. Security is another big one in that the WebKit process is running with privileges that Apple does not want to award to any other app process on the platform, much less a third-party one.
They also want to make sure that if they fix the next security flaw what will undoubtedly be reported in WebKit, that all the apps with an embedded browser will get the fix and won't continue to be vulnerable due to them not updating whatever version of Chromium they were embedding.
Of course, between sandboxing and not allowing JIT compilation, those vulnerabilities couldn't do do much harm, but that embedded Chromium also wouldn't be much fun to use.
Which means, if you let me make a prediction of the future, that when Apple is forced into allowing other browser engines, articles will be written about how Apple is complying by the letter of the law but not the spirit by "seriously hampering 3rd party engines" compared to their own by now allowing JIT compilation.
If they had to then also allow those 3rd party engines to do JIT compilation and bypass the sandbox in means that browser engines need to, then we'll be in a much worse position security wise.
We'll see how this is going to play out, but I'm pretty sure exerting control is not the only reason for Apples' stance.
Yes, because Chrome and Firefox have such a terrible track record with security /sarcasm
Lets face it, that's a conveniently plausible excuse, not an actual reason.
It’s like the skepticism over the Steve Jobs “Flash” memo… why do nerds have such a hard time accepting that Apple might actually be sincere about wanting to make a decent product?
The Jobs Flash memo was crystal clear about why Flash was being booted off his platform. It was to avoid "a third party layer of software coming between the platform and the developer".
HTML5 by and large didn’t have this problem. Was it possible to write a grossly inefficient HTML5 site? Yes, of course, but it wasn’t the default state, as evidenced by how much happier those same machines mentioned in the last paragraph were when running e.g. the HTML5 YouTube player instead of the flash one.
Safari developers optimize for battery life whereas Chrome developers seem not to care about client-side resource use.
The real bullshit about the Jobs Flash memo wasn't that it was justifying not shipping Flash Player on phones, but that it was justifying banning apps that used any third-party developer tool. Adobe had decided to just ship a packaging tool that let you stick a SWF and Flash Player into an iOS app; which Jobs considered to be a way to pollute the App Store with garbage apps. Except this wasn't a ban of one specific developer tool, it applied to everything that wasn't entirely C, C++, Objective-C, or JavaScript[1]. This only lasted about 3 months because...
1. A lot of mobile game developers were already using scripting tools that violated the new rule, and the games they were shipping were not garbage
2. The FTC was threatening to sue Apple
After that, Apple caved completely. In fact, if you've played iPhone games, you've probably already used Flash Player on iPhone. Jobs' fear was mostly unfounded because developers absolutely could make performant mobile games in Flash and ship them as apps. The problem was that they had to work around all of Flash's legacy crap to get there.
[0] Safari has several UI affordances for mobile web usage that Flash never got. Notably, those "cutting edge floating menus" still work because Safari treats finger touches as either a hover or a click, and picks between the two based on how the page changes when it simulates a hover.
Furthermore, browsers around this time were moving to GPU compositing internally, but Flash has always been built around a particularly quirky scanline renderer. Getting that to work on GPUs was apparently too much for Adobe, and even Ruffle has rendering problems caused by it.
[1] The language in the developer agreement was "originally written", so no, transpiling doesn't get you out of this.
The same people will say Flash was slow by default. I remember running canvas vs flash rendering tests in mobile Safari when the plugin was still available, and Flash blew canvas rendering away. Of course it was all about what you chose to do with it... no one was writing really complicated behaviors in canvas at that point, and wasm didn't exist, so if you wanted special animation or complexity you used Flash. The appropriate thing would have been to have Flash off by default until someone tapped an embed to load it.
W.R.T. compositing, browsers took a long time to move to even just GPU based compositing, and full GPU based rendering took longer still. Certainly, if Flash hadn't been killed off so prematurely it seems reasonable that either they'd have done the work to keep up, or users would have organically abandoned the platform.
Indeed, you make a good point that it was really a fight over forcing devs to use Objective C and nothing else. Flash was just roadkill in that fight.
If they really cared about security then they could subject their browser to an independent security audit, and require the same audit be passed for any other browser that's allowed on their platform.
Why don't they do this?
As it stands now, WebKit and the processes hosting it (Safari, WKWebView) are probably the most complex piece of software running on our iOS devices and as we can see, they are full of security flaws.
But so are the engines of all other browser makers.
Audits is not what uncovers security flaws. Detailed research, fuzzing and effectively unlimited time to do both on the side of white-hat hackers and unlimited budget and criminal energy on the side of black-hats is what does.
Same is true for other engines of course.
But being restricted to a single engine shipped and updated as part of the OS with tailor-made support by the OS for sandboxing and JIT restrictions for this one engine does help to reduce attack surface.
Also, my initial concern isn't as much about third parties shipping their browsers (though, consider how many third party browsers exist and how many are well-maintained), but much more about apps embedding a vulnerable version of an engine and never updating it ("it works fine for us - no need to change a running system")
What it does is hold part of the system constant, so that attackers know ahead of time that iOS users will be running WebKit. Reducing variability makes attacks easier and increases the value of WebKit vulnerabilities.
Audits aren't supposed to be an ultimate guarantee of security, but provide a minimum, independently judged hurdle that has to be passed to get on the platform.
If there's a better, independent way to judge what browsers are "secure enough" to be on the platform (ie. not just "Apple says no"), I'd love to hear about it.
Because the idea that all you need to do to ensure software is secure is hire an expensive consultant is ridiculous.
Especially with a web browser which are highly complex pieces of software.
Taking Apple's word for their browser being secure and other browsers not is just as if not even more ridiculous.
What fair, independent way of determining browser security would you suggest be used instead of an audit?
While that's just Safari and Chrome, that's probably ok. But what happens when it's Safari, Chrome, Firefox, Opera, Brave, etc, etc?
For the security test, there are various ways that an org builds software with integrity, and it's the sort of thing that requires a huge amount of effort to get right. Standards like FedRAMP, SOC2, ISO9001, etc etc are the sorts of standardized things that exist (containing things like 'all code must be reviewed'). I think for a browser, if you were Apple and were looking to accept other browser partners, you'd likely do something like this; regular audits of quality, requirements that must be met to maintain access, pentests, basically a continuous process that's to be met by the supplier (similar to how hardware suppliers must meet many requirements).
While users can choose their primary browser, they have no control over what embedded browsers third party apps use, and so if embedding Chromium becomes popular in third party apps it will unavoidably cut the battery life of many if not most users.
When/if Apple starts allowing third party engines on iOS, I think they should require engines to meet minimum efficiency levels to prevent this issue. As a bonus, it’ll allow savvy laptop users to use community builds of desktop Chromium/Firefox with iOS efficiency compliance flags switched on if they want to extend the battery lives of their laptops by an hour or two.
I'm not a great future-reader myself, but I don't see this happening soon. The web is a great threat to their app (and also subscription) revenue stream, and they have a lot to lose with little to win for their platform. They lag behind because they want to, not because they can't.
This is as ridiculous today as it has been every year since the iPhone began.
Mobile web apps are terrible and despite all the years of promises that "feature X" will fix this nothing has changed. And you can't blame Apple because Google et al could easily have made mobile web apps work on Android.
If you want to make a mobile web app then go right ahead. Apple isn't stopping you. But just don't be surprised when no user is interested in it.
People tried it with PhoneGap for years and it failed. I even built some of them.
It has nothing to do with Apple and everything to do with the experience being objectively terrible.
So bad in fact that even Google gave up trying and built Flutter.
> While WebKit is making progress on PWA support, at the time of this writing, PWAs remain a second-class citizen on iOS. The iOS App Store’s support for PWAs is non-existent, requiring a web view-based solution like PWABuilder’s.
> Additionally, because iOS doesn’t allow 3rd party browser engines, your PWA is limited to WebKit’s PWA capabilities, which are currently lagging behind other browser engines.
Google isn't abandoning PWAs, and in fact Chromium continues expanding support to make them as native as possible:
https://web.dev/window-controls-overlay/
Might I also add that the web app manifest is also an open standard, that Safari is lacking on:
webkit is a bit behind in some areas like APIs but ahead in others like CSS
This is why I'll use firefox until it's gone. Considering the push for mv3, I'd rather have a functioning ad blocker that actually blocks ads instead of having pages 100% work 100% of the time
And don't even get me started on "accessibility". The web's barely-acceptable kludges for accessibility could easily be accommodated in a layered, more programmable system.
The web platform is rife with abstraction inversion, employs declarativity where programmability is necessary, and vice versa. It puts magic in pretty much all the wrong spots. And its event-based programming model that puts all JS on the "main" (actually UI) "thread", forcing a painful and awkward asynchronous programming model that we are gaslighting into believing is good for us, is frankly just dumb. But the web has always thought designers and developers are dumb, so it's fair play to just hate it right back.
which machine??? genuinely curious
Many of the solutions given in this thread are similar to ones we give to someone who wants to escape from the monolith mess. Namely, move towards a very slim core, make everything as modular as possible etc etc. And the problems towards such an approach are the same as well i.e., what do we do about the legacy stuff?
The important question here is: what can be done better if we start from scratch? The main issue I see with browsers is that they have become so big that building a new one in a reasonable amount of time is next to impossible. This makes all the open standards pointless because no one can do anything with them except the few already established browsers.
Unfortunately there's no clean way out of this.
1. Microsoft: MS was never interested (until it was far too late) in having a standards-compliant, performant browser. It was a spoiler move to keep people Windows dependent.
2. Mozilla: I honestly don't understand what Mozilla is doing other than raising top exec pay while Firefox users go down [1]. As best as I can tell, Mozilla is the Yelp in this situation. Yelp has spent over a decade extolling the evils of Google while doing absolutely nothing to improve their product. It's a great way to collect a fatter and fatter paycheck but you're ultimately doomed.
3. Apple: Safari has almost always been bound by its own ecosystem. It's dominant on iOS because you have no other choice (for now; you can install other browsers but they're still the Safari engine basically). A lot of people use it on MacOS. For a brief time there was a Windows port but it died. This doesn't seem like an area that Apple wants to compete in. I mean at the end of the day Safari and Chrome share a common Webkit lineage.
So I see a lot of failure, lack of prioritization, missed opportunities and finger-pointing in this space so is it any wonder that a massive engineering company has been able to dominate this space?
I don't see us repeating the IE6 era however. The Internet is core to Google's business in a way that it never was to Microsoft.
That being said, I think this is one area where government intervention may well be needed sooner rather than later. Google has (and continues to) use their properties to advance Chrome (IMHO) eg [2].
There can be a fine line between advancing the browser space and simply crippling your competitors.
[1]: https://calpaterson.com/mozilla.html
[2]: https://mspoweruser.com/engineer-accuses-google-of-sabotagin...
Depends on what your takeaway from the IE6 era was--if its that MS abandoned development and the web stagnated, then I think you're correct. However if you takeaway was that too much power was concentrated in a single private entity who has the defacto ability to control development and standards and channel them towards their best interests, not the users, then I think it would be the IE6 era all over again.
Firefox is responsible for such a low percentage it's sad (the stats I have for the sites I work on it's usually on the 1-2% range). I think it's mainly because of the horrible leadership at Mozilla. I want to use Firefox and promote it but every time I think they've changed Mozilla does something new that boils my blood. You can donate to Mozilla, but not directly to Firefox and they seem to spend a lot of money on political projects. It's a 'get woke, go broke' situation and I have watched the fall of Mozilla in real time over the past years.
I really wish Mozilla changed focus, I would gladly pay for Firefox+ or something if I knew that the money went to Firefox development and not to some racist white male hate project.
So I'll continue using Brave and hope for the best, the future the author is talking about is basically already here.
This is repeated ad nauseum on this site and needs to be called out. The Mozilla management may be rather self serving but Firefox is a fine browser and more than viable alternative to Chrome. The reason they're losing market share is because Chrome is bundled everywhere as default, not just Android, but often as part of desktop Windows too, by OEM. And now Edge, which is Chromium under the skin, is the default on MS Windows. So Firefox is used only by those who specifically seek it out, which means just a small portion of the tech community.
Firefox had the IT-sector with them. I think this does a lot for spreading the usage. Even just one IT-guy can probably give Firefox hundreds of users. Now, this is no longer the case and increasingly they have not only just been just as good or worse than chromium but they have gone out and actively angered a lot of their core user base with political things.
It is a fine browser, I haven't said anything else. It is the leadership that is bad. I would definitely be one of their strongest promoters if Brendan Eich were CEO.
But no, they kicked him out for a bs reason and employed a PC-dictator that fires most of the company and gives herself a promotion even though the usage is falling drastically.
Then they post shit like this:
https://blog.mozilla.org/en/mozilla/we-need-more-than-deplat...
https://book.mozillafestival.org/10-years-of-activism-commun...
and fund people like:
https://www.mozillapulse.org/profile/3116
If you consistently support specific political views it's not strange that the people who do not support these views will stop seeking them out and start recommending other browsers, how good Firefox may be doesn't really matter. They have turned Mozilla from a tech company to an activist company and now they will have to reap what they have sowed.
What happened is much simpler: Chrome worked better than Firefox, most of the tech people switched to recommending Chrome, and it was bundled with a lot of software and advertised on the Google homepage. And nobody ever switched back, and they started justifying why in various ways.
Edit: Also, I don't think it's particularly reasonable to single out an individual being funded by Mozilla without a very good explanation as to why. Is there something that Leil Zahra has done which makes you think they are inappropriate to be associated with Mozilla? Or are you just upset by their identity as a queer person?
No I just don't think Mozilla should fund political projects at all. I know that if I donate to Mozilla, my money will go to activists and not to the continued development of Firefox.
The reason why I singled out one individual was because it shows that they support specific political agendas (and was the one I found after a quick search to give a sourced example). There is a pattern in the type of activists they support. I welcome you to find someone who would represent the opposite political side, you probably won't because they wouldn't.
> Or are you just upset by their identity as a queer person?
I don't care, people can have whatever views or identities they want.
What will the tech community do if Google starts promoting a certain political direction, if they haven't already? Will they stop seeking employment at Google, or stop using/developing for Chromium in protest?
Sometimes the larger goals should outweigh the immediate disappointments.
If there will be a Blink only future I hope that regulators will force Google to invite others to decide what to do with it.
> Sometimes the larger goals should outweigh the immediate disappointments.
I agree and that's what make me feel bad, like there is no good choice available to me. I don't know what to do. It's just like the phone OS market, I dislike both realistic options (ios, android) but since my state and banks require me to use one of these I have to make a choice even if I rather use a linux based phone.
Surely, most of the time Firefox will work just fine or at least good enough and by that standard I am sure that a site that has put some focus for it being easier to read with a screen reader is more important?
Don't take it like I'm trying to be snarky, it was just funny to be in two minorities with contradicting significance for the developer.
[1] https://www.schneier.com/blog/archives/2017/01/class_breaks....
> However, they can’t (quite) go cowboy/cowgirl and do it on their own right now – they’ve all agreed to work together on the definition of what ‘the Web’ is in a Standards Developing Organization (SDO), most often the W3C.
I didn't think that was what was going on at all. Has this changed again since last time I was paying attention, has the W3C regained some influence on browser implementations?
> it’s more fundamentally a question of how do we organize society so that important decisions are made well? And, what will be considered legitimate governance of the Web?
Indeed.
I'd only just posted that the only organisations I see being able to sustain a divergent development effort which could match Google might come from China.
And I don't see that as necessarily, or even at all, benign.
You’re asking for an open network and then putting restrictions on individuals right away by saying they can’t use blockchains on it. Some people want to use blockchains (or any other technology) and an open network shouldn’t put restrictions on how people participate.
If what you really want is to change what other people want you will stay disappointed.
Seems quite an article for something that's founded on just an unsourced and unquotable rumor.
Most webdevs I know consider Safari to be the new IE - they often lag years behind implementing features that are key for new capabilities like WebAssembly multithreading - and it's not hard to see why - the web is a primary competitor to their App Store business.
On the other hand, I feel like the browser is almost done. With WebAssembly and WebGPU and a bunch of other stuff, I can think of very little in terms of capabilities that need to be added to browsers in the future.
I would also like to see a lightweight native API for DOM queuing ala React.
Layout engines are difficult to write and adapt. Especially adapt as they're so complicated.
I read part of the ORC Solver paper and there is algorithms in that paper for writing a layout engine and there's code on GitHub.
https://github.com/YueJiang-nj/ORCSolver-CHI2020
I would like to adapt this approach but write the code myself but it is obviously a challenging area.
I am yet to write a branch and bound optimisation algorithm. But from my understanding you greedily try a number of rows or columns and try arrange objects preferred width and preferred height into the space available. ORCSolver uses intervals and eliminates attempts that are not viable. ORCSolver uses Z3 for the final step to actually get coordinates when the system has been constrained. I plan to use ORTools.
For simplicity I plan to break up text into letters and try place them all in a flowing horizontal then vertical layout. I can use GetTextExtents of WX widgets to predict size of a rendered letter. It shall be slow but then how else do you begin writing a layout engine? I would need to read TeX or the Art of Computer Programming.
Layout is expensive especially for grid based layouts with flowing. I wonder if website authors could prerender at different resolutions and provide start point sizes and coordinates for speed. Generally everybody reaches the same numbers on everyone's machines and we don't need to try a lot of aborted work to relayout.
I am the author of additive GUIs which is a declarative rendering approach for bootstrap layouts. https://GitHub.com/samsquire/additive-guis It's not really a layout engine but it does layout things according to mutually recursive rules.
Competition is a great way to drive innovation. What will motivate innovation on the web platform going forward? Will there be stagnation? Will another company emerge to push the web forward?
What will this mean for companies that have enjoyed all of the innovation on the web platform in recent years? How much longer will it take for bugs to get fixed?
This will not be a sudden shift. It will happen gradually.
That's what happened with Internet Explorer but the reason Microsoft was perfectly happy to stall the development of the web once it took over the browser market was because it didn't really have any incentive to use the web in the first place (it was better off if people just used desktop apps), and it only developed IE so that if the internet was going to take over it could be the one in the position to control it.
On the other hand, outside of Android, Google is extremely reliant on the web for its products on desktop and on chromebooks (there used to be chrome os apps and chrome browser apps but they have already been deprecated).
Google actually has an incentive to add new features to try to give PWA's feature parity with desktop apps, so rather than ceasing development, it may be more likely that they start just adding new features that aren't compatible with other browsers.
E.g. they could probably now go back and immediately undeprecate WebSQL and just say, "we don't care what firefox thinks now." If they announced that, they have enough market share that they could probably get people to start using it again and that would immediately break compatibility with firefox.
If they decide to add new amp integration or similar features, for example, that can give them more control of the Internet even if you are using those features through Edge rather than Chrome.
Seeing Google's goal as getting everyone on Chrome is missing the point: it's just as good from their perspective to simply have everyone using chromium based browsers.
Microsoft must have realised that picking Chromium would dramatically increase the odds of a Chromium-only web? On the surface I'd have thought it would make more sense for Microsoft to support the Mozilla Quantum project. Perhaps they just wanted to take the easy route though. Chromium is certainly more popular and has Google's backing. I understand why so many projects use it.
Mozilla killing off support for embedding Gecko in other UI toolkits was a massive footgun, even if they didn’t realize it at the time.
A significant part of the internet already thrives outside of the traditional browser sphere. Apps and mobile are the future. Eventually no one will be using web browsers. Or the internet web browsers serve up will be like cable TV or AOL: a zombified booby trap of nothing but ads, scraped content and links eager to serve you ransomware.
Maybe I've read too many dystopian novels though.
It's good that Chrome is finally on track to provide MathML support (which Firefox has had since version 4), and as of version 91 supports counter styles (Firefox supports it since version 33), but I wonder how much of that will happen if/when Chrome is the only actively developed browser on non-Mac platforms, resulting in WebKit/Blink being the only engine developed for the web.
I'm also concerned about what will happen in regard to the web standards, given that the browsers have abandoned the W3C in favour of continually changing documents, and only seem to be interested in the needs of web browsers. That makes it difficult for other uses like in ePubs to steer the direction of HTML and the associated standards.
The only way to stop this is personal choice: don't use Chrome or Chrome derived software. There's no other actions any human person can take with more impact.
That doesn't mean it will be easy, but I have little doubt that with enough pressure, some people will start their own browser from scratch, and some of them will be successful.
(Maybe by that time I'll have to spoof feature flags too, but honestly I doubt it)
IT'S REALLY NOT THAT BAD AS PEOPLE WOULD MAKE YOU THINK!
Competition is great, forcing me to use Webkit on iOS is not how you fix this. Please go promote and support Firefox in any way you can.