Why is XUL still relevant?

Discussions about the development and maturation of the platform code (UXP).
Warning: may contain highly-technical topics.

Moderators: trava90, athenian200

User avatar
athenian200
Contributing developer
Contributing developer
Posts: 1537
Joined: 2018-10-28, 19:56
Location: Georgia

Re: Why is XUL still relevant?

Unread post by athenian200 » 2024-02-26, 10:01

soundmodel wrote:
2024-02-26, 09:37
I also noticed that single-threading in browsers and native code are a bit orthogonal.
In what way?
Possibly, this is why WASM modules might be more appropriate for the near-browser part (as per Google).
WASM is indeed a very powerful modern tool... but it seems like it would have its own security concerns, given that it actually DOES compile stuff from websites into some kind of intermediate representation, sort of like a Java Virtual Machine, if I'm not mistaken? I'm just wondering, how is that more secure than allowing user-installed extensions to access native GUI APIs? It seems to me like WASM would have all the security issues of a JVM, and it's integrated into the browser... meanwhile, all XUL does is allow user-installed extensions to be rendered using a supported subset of whatever native GUI toolkit the browser is running on top of. Certainly, it doesn't allow the use of all features of that native toolkit without limitation.
Yes, it has started to feel to me like XPCOM/XUL is overkill for the browser's needs. But it could have made sense as a general framework between all the other object models.
Yeah, I definitely can understand that perspective. For a lot of people, it's overkill and their needs are met by other options, plus it may not be worth the risk and responsibility of making sure you can trust all your extensions. The most secure way to run any browser, even Google Chrome, is to use it the way it comes out of the box and never use add-ons at all.

But... if you ever do need that kind of functionality, that's what we're here for. The few people that would need or want such a thing.
"The Athenians, however, represent the unity of these opposites; in them, mind or spirit has emerged from the Theban subjectivity without losing itself in the Spartan objectivity of ethical life. With the Athenians, the rights of the State and of the individual found as perfect a union as was possible at all at the level of the Greek spirit." -- Hegel's philosophy of Mind

User avatar
soundmodel
Hobby Astronomer
Hobby Astronomer
Posts: 24
Joined: 2023-05-14, 06:21

Re: Why is XUL still relevant?

Unread post by soundmodel » 2024-02-26, 10:15

athenian200 wrote:
2024-02-26, 10:01
soundmodel wrote:
2024-02-26, 09:37
I also noticed that single-threading in browsers and native code are a bit orthogonal.
In what way?
Well, because such single-threaded software would not directly benefit from multi-threaded high-performance OS parts anyways. Or i.e. maybe just some API for data transfer is enough. Asking it to be more is about the same as asking Electron or Node to be more. But then, would you compromise the benefits of the individual strengths?
athenian200 wrote:
2024-02-26, 10:01
soundmodel wrote:
2024-02-26, 09:37
Possibly, this is why WASM modules might be more appropriate for the near-browser part (as per Google).
WASM is indeed a very powerful modern tool... but it seems like it would have its own security concerns, given that it actually DOES compile stuff from websites into some kind of intermediate representation, sort of like a Java Virtual Machine, if I'm not mistaken? I'm just wondering, how is that more secure than allowing user-installed extensions to access native GUI APIs? It seems to me like WASM would have all the security issues of a JVM, and it's integrated into the browser... meanwhile, all XUL does is allow user-installed extensions to be rendered using a supported subset of whatever native GUI toolkit the browser is running on top of. Certainly, it doesn't allow the use of all features of that native toolkit without limitation.
Because if it's malicious code then at least it compromises only some browser environment, not parts of the OS or other software. I am just finding that for browsers the combination of Native messaging + WASM + JS/HTML/CSS has about the same as XPCOM, but it's just better abstracted. I would see XPCOM as generating Native messaging + WASM + JS/HTML/CSS from a configuration file though. XPCOM sounds like its place could me more along Simplified Wrapper and Interface Generator https://www.swig.org/. This is also suggested here: https://wiki.mozilla.org/Mozilla_2/XPCO ... plications

The thread could've asked about XPCOM/XUL.

User avatar
Moonchild
Pale Moon guru
Pale Moon guru
Posts: 35653
Joined: 2011-08-28, 17:27
Location: Motala, SE

Re: Why is XUL still relevant?

Unread post by Moonchild » 2024-02-26, 13:57

I'm sorry but I won't be putting any more time into this thread myself as I don't see my answers being taken to heart and instead being snowed under by more tangents and links to only borderline-relevant adjacent topics. I've answered the main topic question.
"Sometimes, the best way to get what you want is to be a good person." -- Louis Rossmann
"Seek wisdom, not knowledge. Knowledge is of the past; wisdom is of the future." -- Native American proverb
"Linux makes everything difficult." -- Lyceus Anubite

User avatar
soundmodel
Hobby Astronomer
Hobby Astronomer
Posts: 24
Joined: 2023-05-14, 06:21

Re: Why is XUL still relevant?

Unread post by soundmodel » 2024-02-26, 16:09

Yes, so XUL/XPCOM can surely be relevant where it is now, but my main issue is calling it XPCOM (rather than Mozilla Object Model) when there are numerous other projects with similar features or even goals. XPCOM to me seems more limited than MS COM in scope, but the naming suggests that the project is significant.

User avatar
Bilbo47
Fanatic
Fanatic
Posts: 240
Joined: 2017-11-18, 04:24

Re: Why is XUL still relevant?

Unread post by Bilbo47 » 2024-02-26, 18:03

This guy reminds me of the people who say WASM is more secure than XUL add-ons because the extra security belongs to the corporate big-brother website, and not to the browser's user.

User avatar
frostknight
Fanatic
Fanatic
Posts: 210
Joined: 2022-08-10, 02:25

Re: Why is XUL still relevant?

Unread post by frostknight » 2024-02-26, 18:51

The fact that mozilla took the lazy route rather hen getting more people to "vet" their addons, is infuriating.

Always these corporations and software projects take the path of least resistance... screw that.

I detest such behavior.

Why should I trust any organization or group that thinks that way.

Now that's what I can total stupidity.

Btw, that would make a good song especially in today's modern age. :P
Freedom is never more than one generation away from extinction. Feelings are not facts
If you wish to be humbled, try to exalt yourself long term If you wish to be exalted, try to humble yourself long term
Favourite operating systems: Hyperbola Devuan OpenBSD
Peace Be With us All!
Also, say NO to Fascism and Corporatism as much as possible!

User avatar
athenian200
Contributing developer
Contributing developer
Posts: 1537
Joined: 2018-10-28, 19:56
Location: Georgia

Re: Why is XUL still relevant?

Unread post by athenian200 » 2024-02-27, 02:05

soundmodel wrote:
2024-02-26, 10:15
Because if it's malicious code then at least it compromises only some browser environment, not parts of the OS or other software. I am just finding that for browsers the combination of Native messaging + WASM + JS/HTML/CSS has about the same as XPCOM, but it's just better abstracted. I would see XPCOM as generating Native messaging + WASM + JS/HTML/CSS from a configuration file though. XPCOM sounds like its place could me more along Simplified Wrapper and Interface Generator https://www.swig.org/. This is also suggested here: https://wiki.mozilla.org/Mozilla_2/XPCO ... plications

The thread could've asked about XPCOM/XUL.
The thing is, though, I feel like you're ignoring an important context here. This isn't just some random forum that discusses the benefits and disadvantages of various toolkits and frameworks. This is the Pale Moon forum, a place that is mostly dedicated to Pale Moon development, and also to the development of XUL extensions and other applications based on the UXP platform. People here are generally pretty invested in this platform.

Given that context, what exactly is it you want me to say? That XUL might not be the best choice for new projects in all cases? Well, it's not like we're going around seriously advocating for XUL to be used in new projects, though it would obviously be nice for us if more people did use it in new projects. Most of the desire to keep it around comes from people who have existing investments in XUL and don't want to rework their entire project to rely on other stuff instead just because Mozilla decided it doesn't need to exist anymore. I think we've been pretty transparent about that fact. Do you want me to say that what we've spent the last 6 years working on doesn't need to exist? Well, I'm obviously not going to agree with that, so if you're waiting for me to say that, you'll be waiting a long time.

After working with this code for 5 years, I have mostly come to the conclusion that Mozilla has been hemorrhaging the institutional knowledge they need to keep their codebase alive and properly documented since the death of Netscape/AOL, and is slowly declining for a reason. Chromium inherited the benefits of KHTML which was better designed from the ground up. It's not that Google's engineers are so much better or that Google has more money, though that helps... it's that they had a better foundation to start with, because they built on KHTML. Plenty of Google's past projects have flopped, and Microsoft had plenty of money to throw at Internet Explorer as well, yet they couldn't keep that relevant.

Frankly, XUL was the only thing Mozilla ever had going for them, and the only reason why anyone cared to use their browser over Chrome or IE in the first place. I suspect a great deal of Firefox's remaining market share is actually forks of Firefox that falsely report their useragent rather than actual Firefox, and that Mozilla has even fewer users than they think. The fact that most of those users are on desktop would seem to underscore that possibility. There's been Waterfox, SeaMonkey, Pale Moon, and there are even forks of Pale Moon that target older operating systems like New Moon. Many Mozilla forks have kept XUL around, with only Waterfox abandoning the technology and accepting modern Firefox as a substitute. Even then, that decision resulted in Waterfox Classic forking off from Waterfox. But overall, if you look at the big picture, Mozilla is slowly dying, and all their forks are dying too. The ecosystem of Mozilla and forks is bitterly divided and fighting over a small desktop marketshare and ancient grudges, as Mozilla has failed to make inroads on mobile for the exact same reason why they couldn't supplant IE in the 1990s... their engine is not superior, and they are not the default browser on any mobile operating system. I mean, sure, maybe it is fair to say our project is not relevant... but only if you also concede that Firefox was never that relevant to begin with, and forks of it are by default even less relevant. From that perspective, I suppose I could see your point.

XUL was never perfect, mind you, but it was the one major thing people valued in Firefox that Chrome didn't have. Now, Firefox has nothing to offer that cannot be found in Chrome. XUL is probably mostly irrelevant by now... and Firefox is even more irrelevant, because it's missing the one thing that used to make Firefox relevant. So fine, I'm answering your question... XUL is irrelevant to most people, because Firefox is and always was irrelevant to most people, as is anything forked from it. Firefox was never more relevant than IE back when everyone was using Windows, and it's not more relevant than Chrome now that everyone is using Android. But... a few people bought into Mozilla's hype surrounding XUL, and put all their faith in that, invested in it, touted it as a reason to use Firefox and built stuff on top of it hoping to showcase how amazing the project was. And it was those people that suffered the most when Mozilla abandoned the technology and left it in the hands of the community.

The other thing to keep in mind, is that we are not the original architects of XUL, and there are limits to the degree to which we can be held accountable for its design and architecture. We inherited a lot of the shortcomings and awkward parts of the technology from Mozilla when we forked off, and none of the original people who designed or implemented it came from Mozilla to work with us. So we are still learning a lot about the inner workings of it. Mozilla left the documentation in a terrible state, and we only recently managed to restore XULRunner to a working state. XUL as it exists in our codebase is more of a life preserver for existing XUL projects than it is a choice I could heartily recommend for new projects... although if people did want to build on top of it and work with us to address some of the issues, that would obviously help us out.
"The Athenians, however, represent the unity of these opposites; in them, mind or spirit has emerged from the Theban subjectivity without losing itself in the Spartan objectivity of ethical life. With the Athenians, the rights of the State and of the individual found as perfect a union as was possible at all at the level of the Greek spirit." -- Hegel's philosophy of Mind

User avatar
moonbat
Knows the dark side
Knows the dark side
Posts: 4984
Joined: 2015-12-09, 15:45

Re: Why is XUL still relevant?

Unread post by moonbat » 2024-02-27, 06:40

athenian200 wrote:
2024-02-27, 02:05
Mozilla left the documentation in a terrible state,
They didn't have any worthwhile documentation to begin with. It seems to have been created as an afterthought - lots of it is contributed by external volunteers, not Mozilla employees. That's why it's a mess of broken links, orphaned articles repetitive tutorials (why is there a XUL School and a XUL tutorial, why couldn't they hire a few decent technical writers to keep it updated, etc) - they could've pushed their application platform as a viable alternative for cross platform desktop apps as I said earlier, or partnered with Eclipse Foundation to include XUL WYSIWIG GUI editing tools on that IDE..it was total lack of vision as the Pale Moon easter egg says.

Coming to XUL itself, I think it's an amazing technology that rivals other desktop GUI creation tools; it shouldn't be seen in the context of browsers alone. But again as I said - the real Mozilla crown jewel was the application platform that Firefox, Seamonkey & Thunderbird were based on - they chose to throw it all away including XUL XPCOM and turn the browser into a bloated monolith like the one it's imitating.
"One hosts to look them up, one DNS to find them and in the darkness BIND them."

Image
Linux Mint 21 Xfce x64 on HP i5-5200 laptop, 12 GB RAM.
AutoPageColor|PermissionsPlus|PMPlayer|Pure URL|RecordRewind|TextFX

User avatar
soundmodel
Hobby Astronomer
Hobby Astronomer
Posts: 24
Joined: 2023-05-14, 06:21

Re: Why is XUL still relevant?

Unread post by soundmodel » 2024-02-27, 07:05

athenian200 wrote:
2024-02-27, 02:05
soundmodel wrote:
2024-02-26, 10:15
Because if it's malicious code then at least it compromises only some browser environment, not parts of the OS or other software. I am just finding that for browsers the combination of Native messaging + WASM + JS/HTML/CSS has about the same as XPCOM, but it's just better abstracted. I would see XPCOM as generating Native messaging + WASM + JS/HTML/CSS from a configuration file though. XPCOM sounds like its place could me more along Simplified Wrapper and Interface Generator https://www.swig.org/. This is also suggested here: https://wiki.mozilla.org/Mozilla_2/XPCO ... plications

The thread could've asked about XPCOM/XUL.
The thing is, though, I feel like you're ignoring an important context here. This isn't just some random forum that discusses the benefits and disadvantages of various toolkits and frameworks. This is the Pale Moon forum, a place that is mostly dedicated to Pale Moon development, and also to the development of XUL extensions and other applications based on the UXP platform. People here are generally pretty invested in this platform.
Yes, so certainly it makes sense as legacy Mozilla for this particular project. But viewing Pale Moon as the sole (?) maintainer of the XPCOM framework, I didn't find any other place for this discussion. Stack Overflow has some discussion that compares this to D-BUS etc. though. Again, the main issue I have is that I feel that XPCOM implies more than Mozilla application framework. But it doesn't feel like it's as extended as e.g. MS COM. Nor do I know whether it's planned as such. GLib or GNOME seemed very ported, and it's also in a lot of apps. This causes confusion. Particularly, GObject and XPCOM seem very similar in goals.

Yet, I still think that in the context of comparing to what other browsers are doing, this is on-topic.

User avatar
Moonchild
Pale Moon guru
Pale Moon guru
Posts: 35653
Joined: 2011-08-28, 17:27
Location: Motala, SE

Re: Why is XUL still relevant?

Unread post by Moonchild » 2024-02-27, 07:49

soundmodel wrote:
2024-02-27, 07:05
But viewing Pale Moon as the sole (?) maintainer of the XPCOM framework
There is no "XPCOM framework". XPCOM is just an object model. It's one of the technologies used inside the XUL-based platform that UXP is. You seem to be laser-focused on XPCOM but that certainly isn't the end-all of UXP. Just FYI. Most people using UXP or XUL never have to touch XPCOM directly.
"Sometimes, the best way to get what you want is to be a good person." -- Louis Rossmann
"Seek wisdom, not knowledge. Knowledge is of the past; wisdom is of the future." -- Native American proverb
"Linux makes everything difficult." -- Lyceus Anubite

User avatar
soundmodel
Hobby Astronomer
Hobby Astronomer
Posts: 24
Joined: 2023-05-14, 06:21

Re: Why is XUL still relevant?

Unread post by soundmodel » 2024-02-27, 08:02

Moonchild wrote:
2024-02-27, 07:49
soundmodel wrote:
2024-02-27, 07:05
But viewing Pale Moon as the sole (?) maintainer of the XPCOM framework
There is no "XPCOM framework". XPCOM is just an object model. It's one of the technologies used inside the XUL-based platform that UXP is. You seem to be laser-focused on XPCOM but that certainly isn't the end-all of UXP. Just FYI. Most people using UXP or XUL never have to touch XPCOM directly.
Yes, because I thought XPCOM and XUL are the cross-platform parts that could have appeal outside of Mozilla. In comparison to Windows COM or whatever.

User avatar
soundmodel
Hobby Astronomer
Hobby Astronomer
Posts: 24
Joined: 2023-05-14, 06:21

Re: Why is XUL still relevant?

Unread post by soundmodel » 2024-02-27, 09:07

In fact, since GObject is C-oriented, then what options are there for C++ + JS except wxWidgets and XPCOM?
Last edited by soundmodel on 2024-02-27, 09:09, edited 2 times in total.

User avatar
athenian200
Contributing developer
Contributing developer
Posts: 1537
Joined: 2018-10-28, 19:56
Location: Georgia

Re: Why is XUL still relevant?

Unread post by athenian200 » 2024-02-27, 09:08

soundmodel wrote:
2024-02-27, 07:05
Yes, so certainly it makes sense as legacy Mozilla for this particular project. But viewing Pale Moon as the sole (?) maintainer of the XPCOM framework, I didn't find any other place for this discussion. Stack Overflow has some discussion that compares this to D-BUS etc. though. Again, the main issue I have is that I feel that XPCOM implies more than Mozilla application framework. But it doesn't feel like it's as extended as e.g. MS COM. Nor do I know whether it's planned as such. GLib or GNOME seemed very ported, and it's also in a lot of apps. This causes confusion. Particularly, GObject and XPCOM seem very similar in goals.

Yet, I still think that in the context of comparing to what other browsers are doing, this is on-topic.
Well, we mostly call it XPCOM because Mozilla called it that. It wasn't really our choice to name it that, and renaming it something else now would probably cause even more confusion. That said, there is one example I know of where a fork of XPCOM was used in a totally different context than a browser application.

https://github.com/Virtualbox-OSE/Virtu ... /xpcom18a4

If you look here, you see that a fork of XPCOM is used as an IPC mechanism in VirtualBox. I'm not sure to what extent this was extended, but the reason I noticed it in the first place was because at one point, my VM was giving me feedback that said things like "NS_ERROR_FAILURE" in various logs when things went wrong, and I did a double take to make sure I wasn't nuts... and sure enough, the old Mozilla code made it into there.

Probably that version of XPCOM has diverged too much from mainstream to have anything of use to us, but it's an example of a non-Mozilla application actually using XPCOM, a proof-of-concept if you will that shows it isn't totally useless outside the context of Mozilla applications.
"The Athenians, however, represent the unity of these opposites; in them, mind or spirit has emerged from the Theban subjectivity without losing itself in the Spartan objectivity of ethical life. With the Athenians, the rights of the State and of the individual found as perfect a union as was possible at all at the level of the Greek spirit." -- Hegel's philosophy of Mind

User avatar
Eduardolucas1
Hobby Astronomer
Hobby Astronomer
Posts: 29
Joined: 2024-02-05, 03:15

Re: Why is XUL still relevant?

Unread post by Eduardolucas1 » 2024-02-29, 06:31

soundmodel wrote:
2024-02-26, 09:37

Because if it's malicious code then at least it compromises only some browser environment
Why would i trust the browser environment code from Gecko and Blink (most importantly, the code related to IPC tasks tied up to Windows IPC) to be safe and clean as the code from a kernel or from something as D-BUS or Solaris Doors?

I certainly would not trust that considering the amount of CVEs related to them and to chromium and firefox themselves, as they are bloated, complex, and monolithic.