News: 0000815315

DeVault: The reckless, infinite scope of web browsers

In 1995, I went to work for a company called Spyglass who had a license for a product called Enhanced Mosaic. Our corporate executives goal was to compete against Netscape by licensing our product into every ISP and OS as a default browser. We ended up writing the core of IE1 and IE 2 (and that code ended up being in parts until 5 I think). Pretty much in early 1996, there were 8 developers and 4 QA people and 2 sysadmins doing the work on 6 different Unixes, 2 different MacOS, and Windows. The Enhanced Mosaic browser was meant to be strictly standards compliant so no Javascript, no , no a dozen other things Netscape and IE had in them. We figured doing that would keep our scope down and we could just provide a core set that companies would buy and module into other software...

The core developers realized the race was over for a small team when they got the specifications back after the first set of conferences and had gone on a visit to IBM, Microsoft and Oracle to see how many engineers they had to do work on browsers.. the smallest was 200 developers and 30 QA people.. Those 200 developers were struggling to keep up in 1996 with all the changes and 'non-approved' standards that everyone had made a defacto standard by being in IE3 and Netscape and ... trying to keep up with a small team was not going to happen in a general format.

The small teams which did end up producing browsers ended up doing ones which were always a sub-set of the standards and for a particular work case. You go outside of that and you would end up with horrible misrenderings or crashes onto other crashes.. I think the later explosion of browsers in the early 2000's was due to a sort of slow down in specifications as HTML-4.x was always in progress. With the HTML5 standard being a living standard that you can't code to anything but yesterdays version.. it is now back to needing mountains of developers and also just saying somehow 'sorry cant render that mate'

DeVault: The reckless, infinite scope of web browsers

I am trying to remember who said the original but it was something like "The Web is like the fashion runways in Milan. Something always new and never in vogue for more than a month. The browser is like the clothes factory trying to keep up. Somedays you are a Gucci and the next you are a ripoff Gucki"

DeVault: The reckless, infinite scope of web browsers

I am trying to remember who said the original but it was something like "The Web is like the fashion runways in Milan. Something always new and never in vogue for more than a month. The browser is like the clothes factory trying to keep up. Somedays you are a Gucci and the next you are a ripoff Gucki"

DeVault: The reckless, infinite scope of web browsers

> With the HTML5 standard being a living standard that you can't code to anything but yesterdays version..

This is the thing that annoys me about the web the most. After support for Firefox 3.5 was dropped all concern for writing portable web was lost, to the point that YouTube doesn't even work with Firefox anymore if you don't send a Firefox user-agent (to which it then sends "compat" code).

DeVault: The reckless, infinite scope of web browsers

And isn't it strange that in 2000 a small bunch of unpaid volunteers released KHTML, which is the basis of the most-used browser engine in the world? No paid developers, no paid Q/A people...

I think they did a great job, but I remember one of the developers proudly showing off the tibook Apple had given him "for his work on what had become webkit".

DeVault: The reckless, infinite scope of web browsers

I would very much like to know how much work Apple had to do on KHTML to make Webkit, how big a team they had, and how much time it took.

I remember using Konqueror as my primay web browser a while back, some time around 2000. It was not bad! (I also used to use MSIE 5.5 in a fullscreen VMWare session, with my native Linux terminal windows floating in front. It also worked great.)

DeVault: The reckless, infinite scope of web browsers

I would very much like to know how much work Apple had to do on KHTML to make Webkit, how big a team they had, and how much time it took.

I remember using Konqueror as my primay web browser a while back, some time around 2000. It was not bad! (I also used to use MSIE 5.5 in a fullscreen VMWare session, with my native Linux terminal windows floating in front. It also worked great.)

DeVault: The reckless, infinite scope of web browsers

> How can a new team possibly keep up with this on top of implementing the outrageous scope web browsers already have now?

They shouldn't. There is no reason for there to be multiple code bases implementing the same thing. There should be a single open implementation used by everyone.

DeVault: The reckless, infinite scope of web browsers

Well, many people have expressed concern that Chrome and others that use its engine makes for an ecosystem so monogamous that it will put the old IE to shame.

Of course, the difference is that the Chrome engine is open source and cross platform. IE was neither.

The main concern now would seem to be a vulnerability in Chrome, or perhaps Chrome going in a direction we don't want, and it would be nice to have a fallback. Firefox is that. Glad they're keeping up so far. It's good to have two engines, but having a third is probably untenable and unnecessary.

DeVault: The reckless, infinite scope of web browsers

Well, many people have expressed concern that Chrome and others that use its engine makes for an ecosystem so monogamous that it will put the old IE to shame.

Of course, the difference is that the Chrome engine is open source and cross platform. IE was neither.

The main concern now would seem to be a vulnerability in Chrome, or perhaps Chrome going in a direction we don't want, and it would be nice to have a fallback. Firefox is that. Glad they're keeping up so far. It's good to have two engines, but having a third is probably untenable and unnecessary.

DeVault: The reckless, infinite scope of web browsers

> Of course, the difference is that the Chrome engine is open source and cross platform.

Google / the Chromium developers are diametrically opposed to accepting changes that make it more portable. This is kind of understandable when you consider the size of the project they maintain, but when someone offers to do all the work for you and you still refuse to merge the changes... it strikes as not being very friendly or "open source".

There is also the open question of whether all the various licenses of the software Chromium incorporates are actually compatible with one another. I believe someone was investigating this for the FSF but I don't think they ever finished.

DeVault: The reckless, infinite scope of web browsers

> Of course, the difference is that the Chrome engine is open source and cross platform.

Google / the Chromium developers are diametrically opposed to accepting changes that make it more portable. This is kind of understandable when you consider the size of the project they maintain, but when someone offers to do all the work for you and you still refuse to merge the changes... it strikes as not being very friendly or "open source".

There is also the open question of whether all the various licenses of the software Chromium incorporates are actually compatible with one another. I believe someone was investigating this for the FSF but I don't think they ever finished.

DeVault: The reckless, infinite scope of web browsers

> when someone offers to do all the work for you and you still refuse to merge the changes... it strikes as not being very friendly or "open source".

To be fair, merging work is one-time, but maintaining that work is forever. They're likely not so much declining the changes as declining to maintain the changes forever.

DeVault: The reckless, infinite scope of web browsers

> when someone offers to do all the work for you and you still refuse to merge the changes... it strikes as not being very friendly or "open source".

To be fair, merging work is one-time, but maintaining that work is forever. They're likely not so much declining the changes as declining to maintain the changes forever.

DeVault: The reckless, infinite scope of web browsers

> To be fair, merging work is one-time, but maintaining that work is forever. They're likely not so much declining the changes as declining to maintain the changes forever.

Drive-by fixes are common, but part of the beauty of open source is... you can onboard people to maintain those changes. This also incurs a cost of course. Now, I am not entirely familiar with the matter at this level, but I suspect the people who have a vested interest in making Chromium more portable would agree to maintain those fixes going forward...

DeVault: The reckless, infinite scope of web browsers

> To be fair, merging work is one-time, but maintaining that work is forever. They're likely not so much declining the changes as declining to maintain the changes forever.

Drive-by fixes are common, but part of the beauty of open source is... you can onboard people to maintain those changes. This also incurs a cost of course. Now, I am not entirely familiar with the matter at this level, but I suspect the people who have a vested interest in making Chromium more portable would agree to maintain those fixes going forward...

DeVault: The reckless, infinite scope of web browsers

There are serious problems with that. One big problem is that the only viable candidate for that single codebase is Chromium, and that is controlled by Google. Google has shown no interest in yielding governance to anyone else (e.g. an independent foundation). Eliminating all possible competition would increase Google's power dramatically (even starting from its current high baseline).

Another problem is that one of the things the Web currently has going for it is multiple implementations. You can distinguish "behaviour my app can rely on" from "Chromium bug" by testing your app on multiple browsers. This actually helps everyone, including Chromium developers. Going to a single codebase eliminates that advantage.

DeVault: The reckless, infinite scope of web browsers

> One big problem is that the only viable candidate for that single codebase is Chromium, and that is controlled by Google.

Chromium is controlled by Google in only in the sense that they are willing (and obviously able) to outspend everyone else combined, and nobody else has a hope of keeping up. Not even "billions in cash in the bank and a near-monopoly on the desktop" Microsoft.

> This actually helps everyone, including Chromium developers. Going to a single codebase eliminates that advantage.

While there are (mostly "bigger picture") disadvantages to a complete monoculture (although less so since we're talking about Free Software here) there are also significant advantages as well.

DeVault: The reckless, infinite scope of web browsers

> One big problem is that the only viable candidate for that single codebase is Chromium, and that is controlled by Google.

Chromium is controlled by Google in only in the sense that they are willing (and obviously able) to outspend everyone else combined, and nobody else has a hope of keeping up. Not even "billions in cash in the bank and a near-monopoly on the desktop" Microsoft.

> This actually helps everyone, including Chromium developers. Going to a single codebase eliminates that advantage.

While there are (mostly "bigger picture") disadvantages to a complete monoculture (although less so since we're talking about Free Software here) there are also significant advantages as well.

DeVault: The reckless, infinite scope of web browsers

Why do people keep giving more airtime to Drew? He has been banned from more communities than I can count on one hand and even when he has half good points he tends to be such an arrogant donkey about them that it makes any real conversation on the topic much harder.

Yes he has a point here but he also ignores any of the causes of the complexity nor does he prescribe any suggestion as to what to do about it. Sure the web standards are huge, and web browsers are complex beasts but complaining about it without any discussion of why and how we got there is of minimal use.

DeVault: The reckless, infinite scope of web browsers

There's so much wrong in this blog post. Start with the first paragraph:

> web browsers have been using features as their primary means of competing with each other.

Not at all. Users do care that the Web works in your browser, so you don't want to fall behind on platform features. Adding platform features beyond that does very little to increase your market share. What does increase market share is what Chrome rightly focused on at the beginning: performance, stability, security, marketing (especially via Google's prime Web real estate), and bundling deals (e.g. download Flash -> get Chrome).

> Browsers are the most expensive piece of software a typical consumer computer runs.

Depends on what you mean by "typical" but AAA game titles are far more intensive than regular Web sites. It's true that browsers are the most resource-intensive software for a lot of people, but that's because a lot of people do most of their computing in the browser.

> Web browsers are responsible for more than 8,000 CVEs.

Compare Web browsers to another application platform: Android. Android has 2563 CVEs.

[1]https://www.cvedetails.com/product/19997/Google-Android.h...

Considering that 8000 number covers multiple completely independent products, and Android is just one product, I'd say browsers as a category are not obviously worse (or better). And Web browsers tackle a harder problem: safely running content that the user doesn't trust at all.

> browsers have also been free to stop being the “user agent” and start being the agents of their creators instead. Firefox is filling up with ads, tracking, and mandatory plugins.

What the heck is this about? Firefox has taken major strides to block tracking over the last few years. Browsers, unlike competitor platforms, continue to provide powerful APIs so third-party extensions can manipulate content in all kinds of ways.

> The browser wars have been allowed to continue for far too long.

Allowed by whom? What exactly is actionable here? Is he calling for government intervention to make new Web platform features illegal?

Having said all that, I agree that the ever-expanding complexity of the Web platform is a problem. Some of that is due to technical errors, a lot of it is a reaction to the expanding scope of non-Web platforms. But there isn't an obvious solution that doesn't make things worse. "Tossing out the Web", "don't let the Web compete with native platforms", and "everyone use Chromium" would all make things worse.

[1] https://www.cvedetails.com/product/19997/Google-Android.html?vendor_id=1224

DeVault: The reckless, infinite scope of web browsers

> a lot of people do most of their computing in the browser.

I should add "on desktop computers" which I assume is the context for the comment I was responding to.

DeVault: The reckless, infinite scope of web browsers

> a lot of people do most of their computing in the browser.

I should add "on desktop computers" which I assume is the context for the comment I was responding to.

DeVault: The reckless, infinite scope of web browsers

All I'm hearing are laments that the browser has become the software platform for everything, and therefore requires APIs to support doing everything (and everything is a lot). As long as things stay open source and remain driven by published standards this is all to the good. If you'd told me in 1995 that the future of applications would look like a series of cross-platform, vendor-neutral (Google notwithstanding), open standards I would have told you that you were living in a pleasant fantasy.

I'm not saying this is the best possible future, but it's pretty nice.