Why is Pale Moon so slow?

[walmar]

If Dactyloidae is using e10s on a UXP basis then that is really dangerous because there are literally thousands of vulnerabilities in e10s that can cause exploitable crashes.

Based on my own practical experience using e10s in Waterfox 56, the following applies: Should a crash occur, it will most likely affect a tab's web content process — and for a different reason entirely — rather than the entire browser, as I would expect with Pale Moon.

For my part, I already use the uBlock Origin and NoScript extensions to reduce the security risk with Waterfox Classic. Additionally, Container Tabs, URLVoid.com via Flagfox and in some cases Sandboxie Plus. But thanks for pointing that out.

So caution strongly advised.

Furthermore, it is known that the user — at least in Firefox versions 53 through 56 — can select the option "Open in new non-e10s window" via the tab context menu. Therefore, it might be possible to additionally implement a user interface within the browser that allows the user to whitelist (opt-in) trusted document domains for e10s mode, while all other document domains are opened in a non-e10s window.

[UCyborg]

This might seem too obvious, but have you gone over your addons, or are you using a computer with failing hardware?

I've seen that you seem to struggle with Pale Moon in some areas, while most others have no issues at all.

(I even seem to recall that it's been brought up before, in relation to PassiFox)

Hardware is OK. Add-ons do have some tax, but they're not the main culprit (except that conflict between uBO and PassIFox on https://ekomunala.ibled.si/, though with my setup, uBO is disableable with two clicks - have to disable whole extension).

I did notice when testing Pale Moon on Rasperry Pi 5, that on Project VORAPIS welcome dialog, there isn't as much noticeable delay when you interact with it, compared with my usual desktop computer. And yeah, they say Pale Moon favors single-core performance, which is not something Phenom II is good at.

But stock YouTube is too damn slow regardless and it fucks up the garbage collector, so I don't see the reason to bother with it. Project VORAPIS does require to be logged in for streams to work reliably, which I considered a pet peeve in a not so recent past, but honestly, I don't care anymore. On the other hand, I can keep uBO disabled for youtube.com then and don't get ads.

[Moonchild]

Should a crash occur, it will most likely affect a tab's web content process — and for a different reason entirely — rather than the entire browser, as I would expect with Pale Moon.

You're missing the point. Look up "sandbox escape". Compromised content processes can induce crashes in the parent, often by manipulating the very IPC protocol separating the processes (which is N/A in Pale Moon). Unless Dactyloidae has addressed all applicable e10s/IPC bugs (which have been categorically dismissed in our development where not related to plugins and NPAPI), they are vulnerable through that mechanism to a whole host of overflow, UAF and RCE bugs. Hence my note of caution.

[walmar]

I greatly appreciate your thoughtful and profound insights. I am by no means claiming that the warnings are unjustified. I apologize if my text can be interpreted in that way. And yes, the average user would be well advised not to take on this additional risk.

[andyprough]

You're missing the point. Look up "sandbox escape". Compromised content processes can induce crashes in the parent, often by manipulating the very IPC protocol separating the processes (which is N/A in Pale Moon). Unless Dactyloidae has addressed all applicable e10s/IPC bugs (which have been categorically dismissed in our development where not related to plugins and NPAPI), they are vulnerable through that mechanism to a whole host of overflow, UAF and RCE bugs. Hence my note of caution.

Would you say then that Pale Moon is likely to be the safest modern browser for the average user to use, since it completely avoids the vast array of vulnerabilities and exploits available against the multi-process browsers?

For example, if you were to set up a browser for your dear old aunt, who knows absolutely nothing about browser security issues, and your only concern was that she not trip into some exploit, would you set her up with Pale Moon, Edge, Firefox, Safari, etc?

[Moonchild]

Would you say then that Pale Moon is likely to be the safest modern browser for the average user to use, since it completely avoids the vast array of vulnerabilities and exploits available against the multi-process browsers?

Can't say if it is the safest, but it's certainly up there. There's a reason I kept up with known Mozilla sec bugs for the entire lifetime. Having less potentially exploitable features/gadgeteering is also working in our favour.

if you were to set up a browser for your dear old aunt, who knows absolutely nothing about browser security issues, and your only concern was that she not trip into some exploit, would you set her up with Pale Moon, Edge, Firefox, Safari, etc?

It all depends on the dear old aunt and if she is OK with some sites being a PITA. I would likely also suggest Edge as a fallback since that is a pretty hands-off experience and supports UbO to vastly reduce malvertising risk. I don't know enough about Safari on PC to make a determination, it might be a good alternative?. Hate to speak ill of our legacy but current day Firefox is not something I'd recommend anymore. While they may have a decent security setup at least for now, their rather chaotic direction and lack of focus on the browser core makes it more risky. A lot of unforced errors in the sec space I've seen.

[andyprough]

It all depends on the dear old aunt and if she is OK with some sites being a PITA. I would likely also suggest Edge as a fallback since that is a pretty hands-off experience and supports UbO to vastly reduce malvertising risk. I don't know enough about Safari on PC to make a determination, it might be a good alternative?. Hate to speak ill of our legacy but current day Firefox is not something I'd recommend anymore. While they may have a decent security setup at least for now, their rather chaotic direction and lack of focus on the browser core makes it more risky. A lot of unforced errors in the sec space I've seen.

I'm thinking of one of my dear old aunts in particular. She likes to read the celebrity gossip and British royalty gossip websites and check the weather and watch her stocks and bonds go up and down all day long. Nothing with a ton of video content, no Facebook or Instagram. Her problem is she will click on absolutely any link in her AOL emails, so she's always just one click away from getting malware. I had her on MX Linux for awhile, but she got a Windows 11 laptop from Amazon recently that puts her back at risk of all the Windows-only malware. I'm going to try to put her on Pale Moon, see how it goes.

[dinosaur]

The issue with slowdowns caused by certain sites is because they create a complex document tree that is interlinked with itself. It becomes impossible for the garbage collector to trace and clean up, so it gives up and even if you no longer use the website, it will remain in memory and the garbage collector still tries to clean it up.

A possible solution would be to use jemalloc (preferably the genuine, current one, not Mozilla's old fork) and to create a new memory arena (pool) for each new tab: then direct all allocations made by JS (and by JS only) in that tab to its private arena, and when the tab is closed, you can just trash the whole arena...
As long as no shared memory (with other tabs, the browser UI, etc) is involved, there is no risk trashing the whole arena once the scripts using it have been stopped/unloaded, and it saves from using the garbage collector at this point (i.e. after the tab is closed).

[ownedbywuigi]

If Dactyloidae is using e10s on a UXP basis then that is really dangerous because there are literally thousands of vulnerabilities in e10s that can cause exploitable crashes. So caution strongly advised.

You can disable e10s if you do not like it. Dactyloidae gives the user a choice, you don’t have to use e10s if you don’t like e10s.

It’s a optional thing to boost performance whilst I’m working on my own better fix because nobody else is working on performance.

[athenian200]

You can disable e10s if you do not like it. Dactyloidae gives the user a choice, you don’t have to use e10s if you don’t like e10s.

You're providing the choice, we are providing the warning. Seriously, this response from us is tame... in the old days when we were a bit stricter, you would likely be banned by now. We found that approach doesn't solve anything and are more diplomatic now.

Our point is only that we don't want our users trusting this, it's like the NoScript thing. Yes, we know a bunch of half-wit tinkerers with more ego than brains will stumble their way into making it "work" and be happy with the results because they don't understand the architecture enough to know what a monumentally terrible decision it is. Enabling e10s is like putting sawdust in your engine. I mean, if a sick person comes to me, and I show them a list containing a witch doctor, a faith healer, and a licensed physician as "a series of neutral choices," because the other options worked for some people and made them happy, I feel like I'd be doing them a disservice. And to be fair, it's not just on UXP's architecture... I don't think anyone should use Firefox either, Chromium is probably safer these days. It's that bad.

But hey, that's just me... apparently a lot of developers (including the Mozilla developers who left us with a mess and made Firefox worse after our fork point) and users like hacky paths that get them the results they want today, with minimal or no effort, no matter how bad an idea they are. We just have to learn to grit our teeth and tolerate it a bit better, and not take the nuclear option, because if we do, we'll be isolated and have people mad at us. I mean, not that I put a lot of effort into Epyrus myself these days... maybe I should just stop caring so much. Obviously no one else does. I mean... maybe our standards were too high from the beginning for a project like this. EDIT: Just to add more context about my tone, I'm not really angry with you in particular, I'm annoyed with the state of a lot of things in the project (and in my life) lately, and sorry if it felt like I was taking it out on you.

[andyprough]

Yes, we know a bunch of half-wit tinkerers with more ego than brains will stumble their way into making it "work" and be happy with the results because they don't understand the architecture enough to know what a monumentally terrible decision it is. Enabling e10s is like putting sawdust in your engine.

Seems a bit harsh. It's just two weeks ago you were giving this 17-year-old dev advice on the same project - https://forum.palemoon.org/viewtopic.ph ... 93#p273093

I for one kind of hope he sticks around, seems smart and resourceful and creative. May benefit from some guidance from wise older devs who have already seen all the wrong paths, but who wouldn't?

[honorific]

I will word this as politely as I can from somebody who has followed the development of Pale Moon and UXP for many years.

other factors that Google have little to no control at all such as how fast JavaScript and CSS change/adapt. All programming languages change and add new features over time.

They are in large part responsible for pushing many of these changes through WHATWG and their contributions to the two languages you mentioned; the impact of V8 on JS development, for example, is not to be underestimated. Google's vertical web integration is not coincidental. While yes, browsers should aim for some compatibility (in my eyes, Pale Moon has plenty), bending to the whims of a corporation that has zero regard for the end user with the standards they push is not the ideal way to go about it. This includes haphazardly including support for draft standards.

Off-topic:
I suspect you have already come to the conclusion that this is not what most of the userbase desires, going by your and Basilisk-Dev's recent all-but-split. Bringing me to my next point...

because nobody else is working on performance.

I suspect this is an attempted jab at UXP's development seeing as you and Basilisk-Dev have recently, without zero forewarning or willingness to cooperate with upstream development, branched off into your own thing. It's quite a light jab, considering it's quickly disproven by checking the UXP repo's commit and issue history. athenian and Moonchild (and yes, you and Basilisk), have all been working toward improving performance. Passive-aggressive jabs such as this are quite immature when the reality is different. I suppose it's easier to just push cooperation to the side and splinter a development team.

And finally..

Please don't make assumptions for me, what my beliefs and views are, or about me.

Perhaps if you communicated with the rest of the project, instead of vaguely masking your discontent behind sentence fragments such as "I agree", this wouldn't be a mess in the first place. The beliefs you are stating are clear from your splintering, so I'm not sure why you are up in arms regarding "assumptions" being made.

[athenian200]

Seems a bit harsh. It's just two weeks ago you were giving this 17-year-old dev advice on the same project - https://forum.palemoon.org/viewtopic.ph ... 93#p273093

I for one kind of hope he sticks around, seems smart and resourceful and creative. May benefit from some guidance from wise older devs who have already seen all the wrong paths, but who wouldn't?

Yeah, it probably was. Of course, I don't really want him to leave the community. I don't take back the e10s being sawdust in the engine remark, but I acknowledge the "half-wit tinkerer" thing could have come off as a personal attack even though it's not directed at him specifically so much as it's a more general description of how I see that type of thinking. The way people here are just... has a tendency to wear me down. I feel like I just got involved in UXP again after a long hiatus, and I already want a long break again, though. I'm going to try and stick around myself, though. I really like working on this project and occasionally people surprise me with their understanding.

[Mæstro]

Of course, I don't really want him to leave the community.

Neither do I. Whenever I see him, I always cannot help but think of his age above everything else, simply because I believe that this fact explains more to the neutral observer than anything else about his choices. He is too young to remember a time before iPhone-centric design became the mainstream. He grew up with Metro and Windows 10 ‘apps’; he was in early childhood when Firefox went Quantum. Through his eyes, since most teenagers and many adults lack any real sense of historical perspective which is not heavily filtered, Web Extensions, Electrolysis and the rest are just the way things are, making us the oddballs for rejecting these. Google is not a poisonous viper to him, but drew up how people his age would view the web’s essence, so he cannot see anything wrong with just ‘working together to build a better browser’, the way Google wants people to see it. If all this sounds harsh on him, it is not meant as such; he did not choose to be born so late. Rather, there is a real cultural gap between us, who watched the old order give way, and true natives of Google’s regime, and teaching him our ways, if he should choose to accept them, is bound to take time.

[frostknight]

in the old days when we were a bit stricter, you would likely be banned by now. We found that approach doesn't solve anything and are more diplomatic now.

Off-topic:
In those days, I got my account deleted. Although to be fair, I was still pretty damn arrogant back then.

This was I think in the 2010s...

I got pissed off about people's beliefs on how copyright is somehow okay to last for 50+ years.

I have since doubled down on this even more, but I have tried to be more tame about how I phrase such irritations.

Basically, be more polite... and less crass.

My point I guess is, hopefully he can learn too.

Although not sure how old he is. I was in my 20s when I was over the top.

I don't know about him.

And yes, google is not to be trusted. I don't know how anyone trusts these proprietary corporations.

The only thing good about Google is buying an unlocked pixel phone for GrapheneOS which is ironically the most degoogled phone lol. just realized I should mark this off topic.

[athenian200]

Neither do I. Whenever I see him, I always cannot help but think of his age above everything else, simply because I believe that this fact explains more to the neutral observer than anything else about his choices. He is too young to remember a time before iPhone-centric design became the mainstream. He grew up with Metro and Windows 10 ‘apps’; he was in early childhood when Firefox went Quantum. Through his eyes, since most teenagers and many adults lack any real sense of historical perspective which is not heavily filtered, Web Extensions, Electrolysis and the rest are just the way things are, making us the oddballs for rejecting these. Google is not a poisonous viper to him, but drew up how people his age would view the web’s essence, so he cannot see anything wrong with just ‘working together to build a better browser’, the way Google wants people to see it. If all this sounds harsh on him, it is not meant as such; he did not choose to be born so late. Rather, there is a real cultural gap between us, who watched the old order give way, and true natives of Google’s regime, and teaching him our ways, if he should choose to accept them, is bound to take time.

Yeah, more importantly, he's also new to the forum. That means he hasn't seen how many people have asked about e10s over the years, how many weird hacks people have tried to reenable it and the smug justifications and feelings of satisfaction we've seen from that crowd before when they "crack the code" and get speed. He doesn't know that we keep answering the same questions and cautioning people about the same things over and over again... about e10s, NoScript, moving a Firefox profile straight into Pale Moon, various other "clever" things people do that seem to work at first but are not good ideas.

I really hope he doesn't hold it against us that I snapped, it wasn't an appropriate way for me to act as a senior dev. In general, I just need to learn to think more like an engineer and stop treating this codebase, this architecture like it's my baby or something just because I've invested a lot and I believe in it. I need to accept that people will do what they want to do, no matter how I feel about it, and keep building things in the way I think is right, without trying to defend that way constantly. Still want to caution people when I see something like this, almost instinctively, but I think ultimately I really do have to learn how to work with people who don't want the same things I do, who might want to work more independently and treat them amicably when they show up here and talk about what they're doing, without expecting them to share our goals or perspective. That's a hard lesson to learn, but I'm trying to do better.

[ownedbywuigi]

Off-topic:

Yeah, more importantly, he's also new to the forum. That means he hasn't seen how many people have asked about e10s over the years, how many weird hacks people have tried to reenable it and the smug justifications and feelings of satisfaction we've seen from that crowd before when they "crack the code" and get speed. He doesn't know that we keep answering the same questions and cautioning people about the same things over and over again... about e10s, NoScript, moving a Firefox profile straight into Pale Moon, various other "clever" things people do that seem to work at first but are not good ideas.

I really hope he doesn't hold it against us that I snapped, it wasn't an appropriate way for me to act as a senior dev. In general, I just need to learn to think more like an engineer and stop treating this codebase, this architecture like it's my baby or something just because I've invested a lot and I believe in it. I need to accept that people will do what they want to do, no matter how I feel about it, and keep building things in the way I think is right, without trying to defend that way constantly. Still want to caution people when I see something like this, almost instinctively, but I think ultimately I really do have to learn how to work with people who don't want the same things I do, who might want to work more independently and treat them amicably when they show up here and talk about what they're doing, without expecting them to share our goals or perspective. That's a hard lesson to learn, but I'm trying to do better.

I knew I'd promise to myself I wouldn't respond to this thread after you snapped, but I've got to make a "final response" to clear up issues.

I don't hold it against this community or the devs that you did in fact snapped, I was kind of stupid for mentioning e10s at all in my response, I just wanted to clear up a statement Moonchild stated about e10s in Dactyloidae (which I will remove e10s a future release, likely in 14.0 or a future release in 13.x). Again, I apologize for that, I can be a PITA sometimes and I just don't realize it.

Addressing the elephant in the room:

Off-topic:
I suspect you have already come to the conclusion that this is not what most of the userbase desires, going by your and Basilisk-Dev's recent all-but-split. Bringing me to my next point...

because nobody else is working on performance.

I suspect this is an attempted jab at UXP's development seeing as you and Basilisk-Dev have recently, without zero forewarning or willingness to cooperate with upstream development, branched off into your own thing. It's quite a light jab, considering it's quickly disproven by checking the UXP repo's commit and issue history. athenian and Moonchild (and yes, you and Basilisk), have all been working toward improving performance. Passive-aggressive jabs such as this are quite immature when the reality is different. I suppose it's easier to just push cooperation to the side and splinter a development team.

I don't know how much I can reveal without Basilisk-Dev going mad at me, but I have got to clear this up to avoid future drama between us two and the rest of the community.

We branched off and made eUXP around a week or two ago because there were enough (web compatibility and performance) issues in upstream UXP that the upstream UXP devs did not want merged in, that we just branched off to fix said issues ourselves. All of the new web compatability fixes is just stuff Basilisk-Dev has had archived for a while, but upstream UXP maintainers did not want it merged in.

I'm moving changes from Dactyloidae into two sections (since I still am not finished with that): ones that I think upstream UXP would like merged in, and ones that I think they don't.

I don't know if Basilisk-Dev is still contributing to upstream after eUXP has been made, but I will still contribute to upstream UXP for issues that I think you all would want merged in.

[andyprough]

We branched off and made eUXP around a week or two ago because there were enough (web compatibility and performance) issues in upstream UXP that the upstream UXP devs did not want merged in, that we just branched off to fix said issues ourselves.

Good enough, let's move past the stage of belittling and berating and test the code. If it works and it's not massively insecure and it doesn't break fundamental architecture doctrines, then I would think this community is big enough and open enough to test the new branch alongside the stable branch. Doesn't sound like anything wrong with that, especially given the long Basilisk history of being a bit different from the norm.

[Moonchild]

Off-topic:

We branched off and made eUXP around a week or two ago because there were enough (web compatibility and performance) issues in upstream UXP that the upstream UXP devs did not want merged in, that we just branched off to fix said issues ourselves. All of the new web compatability fixes is just stuff Basilisk-Dev has had archived for a while, but upstream UXP maintainers did not want it merged in.

You're full of shit.
Sorry to be blunt but this is a pack of lies. Are you gaslighting?

I haven't seen even the first attempt at things being committed to the repo, and sure as hell have not rejected things that were landed on "eUXP". There wasn't even as much as a peep on any of the issues that things were being worked on.

[athenian200]

We branched off and made eUXP around a week or two ago because there were enough (web compatibility and performance) issues in upstream UXP that the upstream UXP devs did not want merged in, that we just branched off to fix said issues ourselves. All of the new web compatability fixes is just stuff Basilisk-Dev has had archived for a while, but upstream UXP maintainers did not want it merged in.

I'm moving changes from Dactyloidae into two sections (since I still am not finished with that): ones that I think upstream UXP would like merged in, and ones that I think they don't.

I don't know if Basilisk-Dev is still contributing to upstream after eUXP has been made, but I will still contribute to upstream UXP for issues that I think you all would want merged in.

Off-topic:
I think there may have been a misunderstanding here. Moonchild was busy moving servers recently and maybe wasn't merging PRs in as fast as Basilisk-Dev wanted, but we never said anything about "not wanting" web compatibility fixes. I could have merged some of it myself, if I'd known slow movement on PRs meant a fork was on the table, but I didn't think he was that fed up with waiting around for review, or thought the pace of integration and testing was too slow, etc. Or maybe he missed a merge window or something and misinterpreted that as rejection? This all seems out of nowhere from where I'm standing. If that's the case, I wish he'd said something before going this far.

But yeah, at this point we just have to live with it... a fork exists, and now we'll have to watch and integrate stuff like we do from Firefox. I'm not thrilled, but I'm also going to not hold it against you or Basilisk-Dev for wanting a bit more freedom to work independently from us for whatever reason. This is just something that happens in open source projects and we have to learn not to take it personally. Sometimes people just want to write their code in their own space and don't want to collaborate. Dealing with programmers is like herding cats sometimes.