Hacker News Reader

Comment by minitech | Hacker News Reader

> Also, the lack of a Javascript engine makes it a very secure browser. Whenever I try to open a link that I am suspicious of, I do so in dillo.

I would suggest using a Chromium or Firefox profile with JavaScript and webfonts disabled for this instead of questionably maintained C software that doesn’t have a sandbox for any of the complex and commonly exploited things it does (image decoding, HTML/CSS parsing, network protocols, local file access).

View on HN

I would say there is a chance that there are fewer vulnerabilities in the 60k~ lines of code contained within dillo than the in the however many million lines of code it takes to do anything with firefox or chromium.

running dillo in a bubblewrap container would probably be fine and not eat all of your available resources.

[i got my 60k loc number from running tokei in the dillo repo, doing the same in the gecko repo took multiple minutes and pegged 8 cores at 100%, might be a bug in tokei or maybe 21 million lines of code is just enormous]

I would recommend not opening suspicious pages in any browser at all. If you don't have the choice, then maybe download it with curl(1) and then inspect it with hexdump(1) or more(1), so you can see the content before sending it to an HTML parser.

Hey, nice to see you here Mr Stallman, thank you for all the hard work all these years :)

Mr Stallman would probably be using wget which is a GNU project, if not downloading directly from Emacs.

Or just use eww from Emacs.

For some reason I started using w3m with emacs integration years ago and am very comfortable with it. I know eww exists, but I think I only tried it once or twice.

> I generally do not connect to web sites from my own machine, aside from a few sites I have some special relationship with. I usually fetch web pages from other sites by sending mail to a program (see https://git.savannah.gnu.org/git/womb/hacks.git) that fetches them, much like wget, and then mails them back to me. Then I look at them using a web browser, unless it is easy to see the text in the HTML page directly. I usually try lynx first, then a graphical browser if the page needs it.

Source: https://stallman.org/stallman-computing.html

Sure, Dillo in a sandbox is a big improvement over Dillo not in a sandbox (don’t forget an isolated X instance when you’re doing bubblewrap, ’cause FLTK 1.3 doesn’t support Wayland). I’d still feel more comfortable with mainstream browsers (and yes, they can handle many tabs on a still-small amount of memory).

Reply on news.ycombinator.com