Nordstjernen web browser

[moonbat]

Nordstjernen — strengths vs Pale Moon

This is like comparing a Formula 1 car to a regular sedan and claiming superiority based on top speed.

[andreasr]

Nordstrand has no JIT, therefore it's more secure. A JIT in a browser is a security risk.


https://repo.palemoon.org/MoonchildProd ... .0_Release

The IonCompiler Information Leak (Fixed in Pale Moon 27.1.0)
While not given a standalone CVE specifically pinned to Pale Moon, an explicit JIT vulnerability was patched in Pale Moon 27.1.0.

The Issue: The release notes explicitly document a patch for a leak of window details through the Ion compiler.

[Gemmaugr]

I hope people's opposition to AI here is in just letting the AI write all the code without much review or oversight by an expert... and not the fact that it contains AI generated code at all.

I don't mind the hands being AI, but it definitely for sure needs a lot of eyes and minds to verify the code properly. AI isn't actually AI yet (more like artificial sentience, not artificial sapience) as it isn't self-logical. It can say one thing prompted one way, and a completely opposite and contrary thing prompted another way, about the same exact thing.

[Moonchild]

The IonCompiler Information Leak (Fixed in Pale Moon 27.1.0)
The release notes explicitly document a patch for a leak of window details through the Ion compiler.

Basically, you're trying to make the point that neutered dogs have 0% chance of getting testicular cancer, and then calling all non-neutered dogs unhealthy.

Also, you had to reach back 10 years for that one. Wow! I looked up my audit logs just out of curiosity and it was bug #1325938 (i.e. an inherited issue from Mozilla as you'd expect that close to our fork point). Bug has long since been disclosed, of course, so feel free to examine.

I think I'd go sit on my Nordstrand and sip a coffee before worrying about that.

[andreasr]

https://nvd.nist.gov/vuln/detail/CVE-2019-11707

The JIT is a security risk. So it is more secure without a JIT. Compiling JavaScript from the Internet, into native assembly code is a very bad idea.

Hence the need for Nordstjerna.

[athenian200]

Nordstrand has no JIT, therefore it's more secure. A JIT in a browser is a security risk.

I could be misunderstanding, but this almost feels like you're making fun of us a little for being opposed to e10s rather than making a serious argument...

It comes off like you're trying to do the software-writing equivalent of this:

"Pale Moon is more secure because it avoids e10s, which improves performance at the cost of security in a way we found unacceptable."

"Oh yeah? Hold my beer, I'm going to write an even more limited browser that doesn't have a JIT. That makes it even better than Pale Moon, right? Because JIT can cause security issues."

"Uhh... no, having no JIT is terrible, JavaScript would execute very slowly. What are you talking about?

"I rest my case, see, this is how you look to everyone else."

*argument ensues where nuance about how e10s is different from JIT is ignored and the other person acts like they won*

[andreasr]

A Mere Mortal's Introduction to JIT Vulnerabilities in JavaScript Engines - TrustFoundry:
https://trustfoundry.net/2025/01/14/a-mere-mortals-introduction-to-jit-vulnerabilities-in-javascript-engines/

Security implications of jit compilation:
https://wingolog.org/archives/2011/06/21/security-implications-of-jit-compilation

https://dev.to/azterix101/jit-picking-exploiting-the-logic-gap-in-modern-javascript-engines-o9k

[andreasr]

The most recent JIT compiler caused vulnerability was in May 2026:

Just-In-Time (JIT) compilation continues to be one of the most targeted attack surfaces in modern web browsers. Because JIT engines dynamically write and execute native machine code to speed up JavaScript, logic flaws in their optimization pipelines frequently lead to critical memory corruption bugs.

Notable Recent CVEs:

• CVE-2026-1862 (Google Chrome / V8): A high-severity Type Confusion vulnerability patched in May 2026. A flaw in V8's aggressive optimization pipeline allowed malicious JavaScript to trick the compiler into treating altered memory objects as their original type, leading to heap corruption and potential Remote Code Execution (RCE) within the browser sandbox.
  Affected: Chromium versions prior to 144.0.7559.132.
• CVE-2026-4702 (Mozilla Firefox / SpiderMonkey): A major JIT Miscompilation flaw resolved in March 2026. The SpiderMonkey engine incorrectly optimized specific script pathways, resulting in logic gaps where security checks were bypassed during execution.
  Fixed in: Firefox 149 / Firefox ESR 140.9.

[Basilisk-Dev]

There is:
1. Pale Moon
...
11. Nordstjärnan

There is also NetSurf

I could be misunderstanding, but this almost feels like you're making fun of us a little for being opposed to e10s rather than making a serious argument...

It comes off like you're trying to do the software-writing equivalent of this:
...
"I rest my case, see, this is how you look to everyone else."

I had the same thought.

[Moonchild]

Notable Recent CVEs:
...
CVE-2026-4702 (Mozilla Firefox / SpiderMonkey)

Since I have access to the sec bug in question, I don't think it's at all notable.
Ranked sec-moderate, because it requires debugger hooks/debugger to be enabled (i.e. not applicable on normal browser use) and on top required specific behaviour in the debugger for it to trigger in that case. Personally I would even have ranked it sec-low because of the very specific steps that need to be taken before it triggers.

Also,

Just-In-Time (JIT) compilation continues to be one of the most targeted attack surfaces in modern web browsers. Because JIT engines dynamically write and execute native machine code to speed up JavaScript, logic flaws in their optimization pipelines frequently lead to critical memory corruption bugs.

This sounds extremely AI-generated of a sentence. Did you ask ChatGPT/Claude to make your argument for you?

[andreasr]

JIT (Just-in-time) compilers for JavaScript are highly prone to security vulnerabilities, this is the core argument and a raison d'être for Nordstjernen. This core argument has not been refuted here. CVE cases cased by JIT vulnerabilities will continue forever until we begin making websites in HTML and CSS again, and only modest JavaScript use.

[gabrgv]

There is also NetSurf

Wouldn't that be the "3. Hubbub engine"?

[Moonchild]

Good luck with your project. I'm sure some people in our community will be happy to occasionally look at it, but without any sort of JIT compiler, your efforts will likely be wasted because heavy JavaScript use is simply a fact we all have to live with for at least some time to come. Without a just-in-time compiler for JS, I don't think this application has reasonable chances of being accepted as a usable alternative. But, you're free to try and make it more usable regardless. It's an interesting experiment if nothing else!

Also, I did notice multiple tabs are an option, despite you advertising it being single-document-per-window. Change of heart there?

By the way, if you're that worried about compiled scripting inside a browser, you can enjoy the same "hardened security" in Pale Moon by setting the following preferences:

1. Set javascript.options.ion to false
2. Set javascript.options.baselinejit to false
3. Set javascript.options.wasm to false
4. Set javascript.options.asmjs to false

Then restart the browser and enjoy a completely JIT-less JS engine. No Nordstjernen/Nordstrand/Nordstjerna needed. You can do that entirely on UXP, without looking for a new "raison d'être" (that means "reason for existing" for those not fluent enough in French).

Other than that, I side with Athenian in terms of how this discussion has quickly derailed (and you're just repeating the same now...). I welcome alternative browsers but be realistic about what you're doing and who you're talking to, please.

[andreasr]

Hej, Thank you for all the feedback about Nordstjernen in this forum. Since I've only started this project circa two weeks ago, I will take your feedback and improve the project direction. I still hope to have some form of collaboration with the people here since we are all interested in browser development.

So based on the discussions here, I have decided to shift the focus more towards these areas:
- Focus towards full compatibility with the HTML specification: https://html.spec.whatwg.org/. So HTML compatibility is one of the most important goals.
- Minimalist C implementation. I think it's at circa 70k LOC C code now.
- I am considering a GPL licensed version also.

Here are some screenshots from today:

ns3.jpg

ns1.jpg

ns2.jpg

I hope to please let this browser discussion continue, so that I can learn more about how to make this cool browser project a reality. Thank you.

[moonbat]

Have you posted it on Hacker News? Might be interesting to see the feedback from that crowd of 'modern' developers raised to use nothing but Chrome

[Massacre]

Nordstjernen — strengths vs Pale Moon

• No JIT — QuickJS is a pure bytecode interpreter. Pale Moon keeps SpiderMonkey's JIT, the single biggest source of browser RCE (type-confusion, codegen bugs). Nordstjernen eliminates that bug class entirely.

No speed. Although, Pale Moon's JS offer no speed too, many sites require Chromium-specific JS support actually.

[*]Tiny, auditable codebase — ~30 .c files, clean-room, readable by one person. Pale Moon carries a large Gecko-derived tree no single person can fully audit.

Vibe-coding tech = many hidden bugs. Good luck with that.

[*]Zero phone-home — no telemetry AND no automatic update/blocklist/start-page pings. Pale Moon avoids telemetry but still makes default outbound connections (update checks, add-on blocklist, OCSP, hosted start page).

Everything could be disabled. Especially, OCSP and start page.

[*]OS-level sandbox by default — Linux Landlock + seccomp privilege drop (src/security.c). Pale Moon's sandboxing is weaker/older than modern Gecko's and not a project focus.

How about Windows?

[*]Lower resource footprint — no multi-process GPU/compositor stack; runs in environments where a Gecko fork would struggle.

Pale Moon is single process. Still does not helps with memory usage on specific heavy JS using sites, though. Or streaming media.

Honest counterweight: Pale Moon still wins decisively on raw compatibility — mature Gecko layout, far broader CSS/DOM/JS coverage, an extension ecosystem, and better real-world site support. Nordstjernen's edge is security, leanness, and privacy, not feature breadth.

It can't be a browser until it could render most of modern websites correctly. Including streaming media.

Also, with no plugins / add-ons, who will adblock? Current web is practically unusable without it.

[andyprough]

Thank you so much for testing the browser, I hope we can cooperate well as the rebel Norden browsers! What do you think is the most high priority tasks? By the way, I recommend to please run the latest main branch when testing, because this browser is constantly changing and becoming better. I will do some testing on https://www.skatteverket.se/ and https://www.aftonbladet.se/ - cool!

Just so you know, a new user with a screen name similar to your screen name has been trying to post links to an alleged "1.0.1 release" binary of Nordstjernen browser today, three different times. Due to concerns about apparently duplicate screen names and duplicate posting attempts, their posts were disapproved. If you are legitimately trying to get out the word about a 1.0.1 release today then please let us know, you can post here or PM me. We do not, however, want to be having someone else come here and post links to unknown binaries.

[Moonchild]

If people do want to test unknown binaries of what is effectively completely unaudited code, always, ALWAYS do so in a sandbox. Windows has a built-in one available (you may have to manually install it) or you can use something like virtualbox or vmware.
This also goes for things andreasr posted in this thread. Just be safe, people.

[Mæstro]

When had this native sandbox been implemented? I liked poking about in Windows 7, but never noticed any such thing. (I was using Home Premium back then, so features like the native XP mode and BitLocker evaded me also.)

[Moonchild]

When had this native sandbox been implemented? I liked poking about in Windows 7, but never noticed any such thing.

I think it's a Windows 10 or later thing.

And yeah, Home might not include it? I don't know.

EDIT: Yes, it's Windows 10+

Ensure that your machine is using Windows 11 or Windows 10, version 1903 or later.

https://learn.microsoft.com/en-us/windo ... ox-install