- mccr8 parentEach tab can be a dozen or more processes nowadays, thanks to site isolation.
- One longstanding issue with gradients was fixed recently.
- In my personal opinion, while the flexibility of the old XUL addons was amazing, the two big issues are compatibility and performance.
Compatibility: these addons could be broken very easily because they could depend on almost anything, and with the monthly release cycle, it is very difficult for mod authors to keep up. For instance, some addons would work by taking a core browser function written in JS, convert it to a string, run a regular expression to edit the string, then use eval to create a new function to replace the old one. In some release, the syntax of the "convert a function to a string" output changed slightly and it broke these addons, because it broke the regexp they were using.
Performance: XUL addons could do all sorts of things that are horrible for performance, and there was no real way for a user to tell what was causing it, because the addon wasn't isolated in any way. I ran into somebody who was having severe performance issues because the browser was generating colossal amounts of garbage for no reason. It eventually turned out that on a whim they'd installed a "LaTeX the World" addon, which would look for LaTeX typesetting instructions on pages and replace it with the nice looking output. The problem was, the way it worked was that every 10 seconds or so it would convert the entire contents of every single tab you had open into a zillion strings, search those strings, then throw them out.
- rlbox is used for more than one library: "Now, we’re bringing that technology to all supported Firefox platforms (desktop and mobile), and isolating five different modules: Graphite, Hunspell, Ogg, Expat and Woff2"
https://blog.mozilla.org/attack-and-defense/2021/12/06/webas...
- Firefox uses unified builds, where a bunch of .cpp files are globbed together and compiled at once. That helps a lot, but a build still takes a bit of time unless you are on an absurdly fast machine. Chrome used to also support this, called "jumbo builds", but they didn't want to deal with the maintenance overhead. Presumably all of the Chrome developers employed by Google are using some kind of massive distributed build infrastructure so there's little impact of slower builds on individual developer productivity, so the use case of building on a single computer is not as prioritized.
- According to news stories, Apple received $20 billion dollars in 2022 from Google to make Google the default search in Safari.
https://www.theverge.com/2024/5/2/24147007/google-paid-apple...
- There's not a lot of context in this submission, but presumably it is being linked because the release notes for this CVE says "Google is aware of reports that an exploit for CVE-2024-0519 exists in the wild."
https://chromereleases.googleblog.com/2024/01/stable-channel...
- Here's the diff: https://chromium.googlesource.com/v8/v8/+/389ea9be7d68bb189e...
- Battery status was disabled in Firefox in 2016.
https://www.theguardian.com/technology/2016/nov/01/firefox-d...
- The paper does imply that, but I would disagree that it is more hardened. I would guess that this strict process per tab model is Safari's attempt to get some degree of isolation despite not having true site isolation.
> Given that both the calling window and the newly opened window share mutual references to each other, isn't the next side channel attack lurking around the corner, even if these windows are rendered by separate processes?
Non-same-origin opener references only allow very restricted operations. It is possible that there are undiscovered issues, but it is a lot less powerful than running in the same process. It isn't like having a raw pointer from one window to another.
- Chromium and Firefox have implemented site isolation on their desktop browsers, so pages that are not same site should never be loaded in the same process. On mobile browsers, Chromium's site isolation is limited, and Firefox has not finished implementing it.
https://www.chromium.org/Home/chromium-security/site-isolati...
- FWIW, I filed a bug a few days ago for the issue I was seeing. A profile showed that Firefox was spending all of its time evaluating a regex. Which is weird because Chrome uses the same regex engine. https://bugzilla.mozilla.org/show_bug.cgi?id=1845775
- Comparing CVE counts is a bit nonsensical. For instance, Chrome and Firefox don't individually assign CVEs for internally reported vulnerabilities.
For instance, in these patch notes Chrome lists "Various fixes from internal audits, fuzzing and other initiatives" and doesn't even look to have a CVE:
https://chromereleases.googleblog.com/2022/05/stable-channel...
Or for Firefox, there's a dozen or so bundled together in a single CVE under "Memory safety bugs fixed in Firefox 101":
https://www.mozilla.org/en-US/security/advisories/mfsa2022-2...
- The quote the article is based around is discussing a new web API in the context of deciding what Mozilla thinks about it. If Mozilla isn't going to have any opinions on new web APIs, then what is even the point of Firefox? (Disclaimer, I work on Firefox but I know anything about specs.)
- This is probably referring to some work to use Stencil for self-hosted code. That reduced process overhead by 6%, which is quite a bit: https://bugzilla.mozilla.org/show_bug.cgi?id=1688794
There might have been some other Stencil work that landed in 92 to reduce memory.
There's a description of what Stencil is, and some work related to it that landed in Firefox 90 and 91, here: https://spidermonkey.dev/blog/2021/07/19/newsletter-firefox-...
- I think the overhead is something more like 15MB per process, on Windows. It is higher on other OSes, due in part to the way they load executables. In practice, the total overhead is less bad than you might expect, because people usually don't have that many unique sites open. Telemetry shows that unique sites per tab decreases as the number of tabs increases.
It really depends on what web sites you have open. If you have a single tab with an ad-laden news site, the overhead will be high, but if you have a bunch of Google Docs tabs open, there's no overhead.