The future between Pale Moon and WebExtensions

[sinfulosd]

I spent some time reading this blog post about why Mozilla killed XUL addons, and I do see where they're coming from.

[*]very quickly, add-on developers realized that anything they did could break anything else in the system, including other add-ons and Firefox itself, and they often had no way to prevent this

[*]similarly, anything Firefox developers did could break add-ons, and they often had no way to prevent this

I could see that, since Firefox rarely (if ever) crashes, due to an add-on, during the time of 2019-2025 where they fully migrated to WebExtensions(Couldn't find a single incident between this time that crashed the entire browser. Everything else was related to either crashing the complicated add-ons, like uBlock and uMatrix, or some misconfigurations in the OS, like what happened in NixOS). Pale Moon, on the other hand, suffers a lot of crashes, like what happens from the infamous NoScript add-on, DeCDN crashed the browser on an Image-heavy page, and many more undocumented crashes by some add-on on Pale Moon.

If you were writing XUL-based add-ons, you quickly realized that preventing it from breaking stuff was… complicated. Several add-ons could modify the same part of the user interface, resulting in odd results. Several add-ons could accidentally inject JavaScript functions with the same name, or with the same name as an existing function, causing all sorts of breakages.

This issue, if not being seen right now, it could be more present in later years, when Pale moon addons gets updated with more and more lines of codes to accommodate to today's modern web that is already heavy on the modern web browsers. Eventually, Pale Moon add-on developers will start to face more hiccups and try to find a workaround on Pale Moon and keep up with the standards of the web and then there also could be a risk of Pale Moon updating its browser and engine and all of the sudden their addon crashes the browser, because some features that it asks for are no longer present and....

These issues seems to be inevitable, and this could be the main reason why Firefox just went with WebExtension (I'm not denying the possibility that it could've also done so, because uncle Google demanded so.), They made Jetpack, and according to the blog, they had the idea, even before Firefox was called Firefox. They already had the intentions and they knew how problematic the XUL addons would be in the future.

These issues would show up on Pale Moon and over the course of the time it would be more visible and bigger of a hurdle for the developers to deal with it. (Not to mention that the majority of the currently used addons that we have right now is barely being maintained, let alone each addon maintainer would cooperate with each other to have their addons not break when bundled together) Even some addons, when they're getting forked to Pale Moon, the maintainer themselves have no hope that it would be on the same performance as the original counterpart, like what uBlock origin addon developer has said.

I know that Pale Moon doesn't plan to introduce WebExtensions to its engine, but are we all really going to a path, where all of us are gonna deal with so many issues, that there even could be some core developers who would quit in the middle of it (I'm not saying names, but you already know who was one of the core developers who decided to leave at one point, back in 2022)? Are we gonna be used as a reference by Mozilla as "See?! This is why we abandoned XUL."?

[therube]

(

before Firefox was called Firefox

That's called, SeaMonkey. And before that there was something simply called, mozilla. And before that...

used as a reference by Mozilla as "See?! This is why we abandoned XUL."?

That is quite a low reference bar to pass. Mozilla long ago lost its' way. And yes, webextensions (cough) have turned out to be a panacea for all the worlds ills (eck!). Oh, & FF has gotten even worse, if you can imagine, just over the past few days.
)

[RealityRipple]

Sorry, but... complaining that extensions are too powerful is like complaining that users have total control over their own computers. It's pure lowest-common-denominator bullshit.

Additionally, XUL and the chrome-level JS API have practically nothing to do with HTML and content-level JS. They do occasionally have some minor overlap, but I don't remember the last time JS made any kind of breaking change with any existing functions or types.

[moonbat]

Pale Moon, on the other hand, suffers a lot of crashes, like what happens from the infamous NoScript add-on, DeCDN crashed the browser on an Image-heavy page, and many more undocumented crashes by some add-on on Pale Moon.

One extension here has long since been abandoned by its original developer yet continues to be used by morons who will blame PM for not supporting it, the other one is a special case that locally caches CDN resources; how do you extrapolate problems with these to all XUL extensions in general? Meanwhile it's Firefox and Chrome that have problems with malicious web extensions, so much for that being a more secure technology

[billmcct]

Sorry, but... complaining that extensions are too powerful is like complaining that users have total control over their own computers. It's pure lowest-common-denominator bullshit.

Additionally, XUL and the chrome-level JS API have practically nothing to do with HTML and content-level JS. They do occasionally have some minor overlap, but I don't remember the last time JS made any kind of breaking change with any existing functions or types.

Off-topic:
@RealityRipple, every time I start PM lately I'm presented with an error:

Pale Moon forum - Pale Moon.png

GeoIP Database URL Options.png

Anyway to fix this?

[RealityRipple]

Sorry, but... complaining that extensions are too powerful is like complaining that users have total control over their own computers. It's pure lowest-common-denominator bullshit.

Additionally, XUL and the chrome-level JS API have practically nothing to do with HTML and content-level JS. They do occasionally have some minor overlap, but I don't remember the last time JS made any kind of breaking change with any existing functions or types.

Off-topic:
@RealityRipple, every time I start PM lately I'm presented with an error:

Pale Moon forum - Pale Moon.png

GeoIP Database URL Options.png

Anyway to fix this?

Are you able to connect to my site? I've had two users of another project recently who've been getting weird SSL errors and such for a couple days, but then it cleared up for one of them as mysteriously as it occurred, so... idk. Shared hosting, man.

[billmcct]

I tried to post a comment on your site several times to only get a 403 error.

[RealityRipple]

I tried to post a comment on your site several times to only get a 403 error.

Odd. A 403 should only happen if it detects a blocked term, and then it would say "attack detected" or "spam detected" or something.

Anyway, try updating by hand:
- Download https://realityripple.com/Software/XUL/GeoFlag/ipv4.db and https://realityripple.com/Software/XUL/GeoFlag/ipv6.db
- Rename them "geo_ipv4.db" and "geo_ipv6.db" respectively.
- Move them to the "geoflag" subfolder of your Pale Moon profile, overwriting the old ones.
- Open about:config and search for "geoflag.db".
- Set these two values:

Code: Select all

extensions.geoflag.db.v4.meta = {"date":1740971730,"etag":"\"1b3663-62f00b24e371f\"","length":3053320}
extensions.geoflag.db.v6.meta = {"date":1740971730,"etag":"\"180d23-62f00c3d1d66d\"","length":8554910}

That should be up-to-date as of 3 days ago. Hopefully whatever the issue is will clear up before next month.

[billmcct]

Sorry, but trying to access both links returns an:
Error code: SSL_ERROR_RX_RECORD_TOO_LONG

Trying to access "https://realityripple.com" and
"https://realityripple.com/Software/XUL/GeoFlag/" returns the same.

EDIT:
I have also tried the links in FF and r3dfox latest releases with the same results.

[RealityRipple]

Sorry, but trying to access both links returns an:
Error code: SSL_ERROR_RX_RECORD_TOO_LONG

Trying to access "https://realityripple.com" and
"https://realityripple.com/Software/XUL/GeoFlag/" returns the same.

EDIT:
I have also tried the links in FF and r3dfox latest releases with the same results.

So you ARE getting the weird SSL error problem. That's 3 confirmed cases, one of whom said it cleared up on its own...

[billmcct]

So you ARE getting the weird SSL error problem. That's 3 confirmed cases, one of whom said it cleared up on its own...

I would reinstall but I don't have a GeoFlag v33 here though I know it wouldn't help.
Shared hosting? Just malconfigured servers?
I have wondered why, since I returned to the US, all Utube video redirects to "https://realityripple.com".

EDIT:
OK it is server related since your website wont open in any of my 7 up to date browsers.
Including Waterfox and the latest Chrome.
Using a VPN doesn't help.

[RealityRipple]

So you ARE getting the weird SSL error problem. That's 3 confirmed cases, one of whom said it cleared up on its own...

I would reinstall but I don't have a GeoFlag v33 here though I know it wouldn't help.
Shared hosting? Just malconfigured servers?
I have wondered why, since I returned to the US, all Utube video redirects to "https://realityripple.com".

Reinstalling's not gonna change anything. And while it is shared hosting, I don't think there's any config issue, as it's fine for the bulk of my users, and every SSL test I run online comes back fine. I'm concerned it might have to do with ISPs. I sent you a private message asking for some additional details.

[Moonchild]

Just so you're aware, the "RECORD_TOO_LONG" error can happen if the SSL port is serving unencrypted http instead of providing an SSL handshake...

[RealityRipple]

Just so you're aware, the "RECORD_TOO_LONG" error can happen if the SSL port is serving unencrypted http instead of providing an SSL handshake...

Just determined that all three people that have thus far reported HTTPS access problems to my site are on Xfinity. They might be mangling the certificate...

[frostknight]

I trust firefox............................................................................................. if you compare it to chromium web browsers... otherwise I use firefox forks. Librewolf being the one I usually choose for my non-Hyperbola OS.

I use palemoon for all the others though.


WebExtensions has fingerprinting issues anyhow.

I don't know how Tor Browser works for privacy at all being based on mozilla's webextension technology. Smh...

[Gemmaugr]

I don't know how Tor Browser works for privacy at all being based on mozilla's webextension technology. Smh...

There are two "schools" of thought in regards to "privacy".

Anonymity means they might know what you do, but not who you are. Privacy means they might know who you are, but not what you do.

The "Anonymity" approach is trying to make you look as "default" as possible. Like everyone else. Just one in the crowd. Hiding in plain sight.
Which means you shouldn't use any WebExtensions because they can fingerprint those, and because the majority don't use WebExtensions. If you're not on Win10/11 and 1024x768.. No 1920x1080..wait, It might be 2560x1440 today.. Anyway, that should be spoofed. Same as useragent (to chrome). This is disregarding that "default" is an ever-changing and moving target, and that spoofing can be circumvented. You also shouldn't make any customization or change configurations to the browser.

The "privacy" approach is trying to make you look like a new person at each corner.
Randomizing/poisoning extensions and addons, canvas and such. Blocking and disabling telemetry vectors. This allows people to configure and customize their browser however they want, and use whichever addons they want as well.

Except for Pale Moon (and Brave with regards to randomizing canvas), the rest of the "privacy" browsers use the "Anonymity" approach sadly.

[frostknight]

Except for Pale Moon (and Brave with regards to randomizing canvas), the rest of the "privacy" browsers use the "Anonymity" approach sadly.

Thing is, Anonymity is impossible. That approach fails because of all the darn tracking online. I assume you are pointing out the futility of Anonymity, right?

[billmcct]

Just determined that all three people that have thus far reported HTTPS access problems to my site are on Xfinity. They might be mangling the certificate...

Now Xfinity is blocking Utube redirects to "https://utube.realityripple.com/".

[Gemmaugr]

Except for Pale Moon (and Brave with regards to randomizing canvas), the rest of the "privacy" browsers use the "Anonymity" approach sadly.

Thing is, Anonymity is impossible. That approach fails because of all the darn tracking online. I assume you are pointing out the futility of Anonymity, right?

Indeed I am. It not only fails because they're vulnerable to tracking (which takes many forms), but also the ever moving target of "default".

[frostknight]

Now Xfinity is blocking Utube redirects to "https://utube.realityripple.com/".

Note to self then, stay away from comcast... if possible.