Thoughts on the Future of Web Browsers

22 points by orib

apropos

I dunno, I find it hard to justify using a forked browser in this day-and-age. I'm actually in the process of switching back to Firefox from Librewolf, since Firefox (finally) added in an AI kill switch. Browsers are just such a huge surface area for seriously bad exploits. It's important to me that any browser I'm using is 100% on top of patches here, and I don't think I want to entrust that to volunteers...

(not to mention that security embargos are only going to be for upstream, not any downstream forks)

orib

A large fork becomes an upstream, and the amount of attackable surface area that Firefox is adding makes me less confident that it'll remain more secure than a browsing-focused fork.
- apropos
  
  I am 100% confident that upstream Firefox will remain more secure than any downstream fork. Mozilla, for all its faults, employs full-time browser developers and security experts.
  - orib
    
    Yes. And the relevant patches can be shared, while I expect that a great deal of extra vulnerabilities can be avoided.
    
    kingmob
    
    Maybe, but I doubt that reducing AI-related code vulnerabilities will compensate for:
    
    Relatively fewer developers to work on a fork
    
    The added delay period in applying upstream security patches lengthens 0-day windows
    
    Avoidance of LLM use in hunting for security bugs in new, non-upstream code
    
    LLMs are already better/faster than almost all devs at hunting for security-related bugs at this point, and any project avoiding them will routinely get exploited if it's popular.
  - hongminhee
    
    Browser engines stopped being something you could build from scratch a decade or so ago, and Chromium's dominance over the last fifteen years is most of the reason. New standards landed faster than any independent implementation could match. Opera gave up Presto for Blink, Microsoft gave up EdgeHTML, and now even Mozilla is struggling to keep pace with a feature set that outgrew what a small team can maintain.
    
    I want Servo to succeed. It's hard not to feel pessimistic about it anyway. A saturated standard is a moving target, and the gap between what a full implementation requires and what an independent team can build only gets wider.
    
    Half seriously: maybe the web needs something like a moratorium on new standards. Not forever, just long enough for the independent engines to catch up.