boredsquirrel (he)

If you like what I do, send me some Monero:

87ZN8URUY1M6GoXpxou4siDKJkLbLKDhT2RScrauzd4gbRyKgoY2ZX3Ut9WuMtkWebisViSE9EVRzVA1SD4kMdtAUPMiZBC

  • 65 Posts
  • 958 Comments
Joined 2 years ago
cake
Cake day: April 11th, 2024

help-circle








  • Edit: after reading the post, the below is not really relevant to the blog post


    Interesting one

    I guess it is fair that nobody wants to deal with GNOME and their reluctance of theming. I like theming and despise “light” (white) themes or not well readable dark themes (that dont save any energy on non-OLED displays).

    I am on KDE, using GNOME at work (it is okay but worse in like 20 aspects I regularly use). Tried COSMIC on lower end hardware and it was not great.

    I like that they support theming but agree, their desktop is pretty ugly.

    Tho I use GNOME with dash-to-panel and blur-my-shell as well as the breeze cursor. The default theme is kinda weird (not blurring wastes potential) and the macOS like top bar is worse to use and wastes screen space (most importantly on Laptops).

    GNOME is way worse than KDE, COSMIC has a couple of nice things but is worse than GNOME still for my use cases. No surprises.

    I have to stress though that statically linked binaries are not good. Many distros shipping COSMIC use those, wasting RAM, optimisations and potentially vendoring outdated dependencies.

    I also believe people when they dislike C++ and say KDE has a messy codebase. So I very much hope that COSMIC (with a substantial theme) can replace KDE for me. But I highly doubt that.

    More importantly is, how old DEs make the transition from C and C++ to Rust, Zig, Go or whatever else you prefer.

    With Windows going all in on Javascript you can see how not to do it XD


  • Fennec is slightly behind Firefox versions, Ironfox is also downstream so a bit behind but not as much.

    Ironfox has a ton of security and privacy hardening, as well as interface changes so users can do a lot of things themselves. Fennec just has a few incomplete telemitry changes.

    I do not recommend Fennec at all, unless people are too “technologically challenged” to tweak a few things, as some hardening like blocking JIT breaks a few websites


  • Content Isolation

    Firefox lacks support for a fork server that can deduplicate memory when using different sandboxing mechanisms, not controlled by firefox.

    On Android, the Zygote is the process spawning subprocesses, and it is used for app sandboxing and browser sandboxing. It deals with deduplicating memory so apps can share the same resources even though they are isolated.

    On Linux with Flatpak you have a similar scenario, while the Flatpak sandbox is way less low level compared to the Android sandbox (Android uses SELinux and unix users, Flatpak uses user namespaces).

    Firefox now started to work on it. If you use Ironfox, there is a setting where you can enable content isolation and zygote usage, and so far it “just works” for me! So it seems they are working on a fork server.

    There was an announcement, and there are bugzilla issues on this matter.

    So yes, currently on Android a Chromium based Browser (that actually uses the whole capabilities of Chromium on Android, which some browsers that just use the Webview may not) is still more secure, as it neatly integrates with the zygote and UUID sandbox native to Android.

    But Firefox is closing in. I daily drive Ironfox and recommend donating to the project.

    Content Filtering

    Keep in mind that Firefox has UBlock Origin and thus access to very powerful content filtering.

    While blocklist-based filtering is natively integrated in Brave, Cromite and Vanadium too, this is generally a bad approach as it follows “badness enumeration”. It lists all the bad things and the moment a new thing appears, you are 🦆ed.

    But it does not require any user tweaking and can thus be implemented easily without the need to actually offer user control (apart from an on/off switch maybe).

    UBlockOrigin allows to use the “expert mode” where you can disable everything by default. Then you allow content per domain, for this site only or globally. It lacks the “content type header” filtering of NoScript (like Images, CSS, Javascript), but both together are very slow, and uMatrix (which combined them) is dead with no actively maintained forks (sadly).

    It looks like this:

    This allows to easily prevent malicious code from running at all. If you dont make mistakes, this could eliminate the need for any sandbox (but as you have to allow all sorts of shit or the horrendous modern web doesnt work, you need one anyways).