Browsers and lack of choice

Related to the families of texts on choice (note [1] and follow-ups) resp. computer annoyances of various kinds, there is an interesting (and extremely depressing) drift towards forced use of inferior browsers.

This drift results from a two-pronged attack* of declining browser quality and a need to remain with up-to-date browsers and a limited range of preferred-by-websites browsers.

*Without implications of a deliberate action.

First, declining browsers: Firefox is a splendid example, which has over the last ten-or-so years grown incrementally worse, dropped features that once made it great, added lesser features, worsened the interface, whatnot. (Cf. [2] and what by now must be more than half a dozen other texts.) In particular, Firefox has gone ever more in the direction of eliminating user choice and forcing users to live with the preferences of the makers—while it once was quite good in this area.* Chromium** and, by implication, Chrome are horrors in usability and interface—so absurd that I feel like snapping after even a five-minute experiment. Other browsers that I have tried have either fallen into similar traps, are using too old standards, are not available on Linux,*** or are otherwise unsuitable for generic purposes.****

*But by no means perfect. Age-old problems include a poor handling of config files, the idiocy of about:config, and the lack of a good key-mapping mechanism—something many other tools had mastered in the 1980s.

**An (at least approximately) FOSS version of Chrome, which should be almost equivalent in functionality, but with less privacy intrusions and other problems.

***Use another OS? That would worsen the problem discussed in this text, as I am no longer just forced to use certain browsers but also certain OSes.

****This includes e.g. W3m, a text-based browser that runs well in a text terminal and can handle many websites excellently, but which falls flat on its face with sites heavy on graphics, JavaScript, DHTML, and whatnot. (Also cf. the second prong.)

Secondly, the need to remain up-to-date (etc.):

HTML and related languages and technologies are nominally well-defined, and any standards-conformant graphical browser should display any web page correctly, including that any and all “active contents” and control elements work as intended. Nevertheless, this is not the case, as various websites* use non-standard features or deliberately and artificially show error messages with “too old” browsers or browsers outside a very limited selection (e.g. Chrome**/Firefox/Edge)—even when they actually would have worked without this artificial error message. Notably, these non-standard features are almost invariably pointless, either because the same thing can be done with standard features, or because the purposes achieved bring no value to the user. For instance, my first steps with online banking might have taken place some twenty years ago—and it worked well with the technology of twenty years ago. Today’s online banking has no true value added, in some ways works worse, and still requires very new versions of these few browsers…

*Immediate personal problems for me stem from the websites for the “German IRS”-tool Elster, my online banking, and W-rdpr-ss, which have all forced me to perform unwanted updates. Elster is particularly perfidious as the German government dictates the use of this tool for tasks like filing taxes—a certain tool use is ensured by the force of law.

**Usually, without mention of Chromium, despite Chromium being the lesser evil for a sane user.

The result? Poorly programmed websites force users to constantly upgrade browsers (and limit them to that small selection), while the sinking quality of browsers makes every upgrade painful. Browser-wise, the world is worse off than ten years ago. Ditto, in terms of websites.

To some degree, this problem can be lessened by having several browser installations and using an older version or a browser outside the selected few for more sensible websites. However, there is a continual lessening of the websites that work well and chances are that the solution is temporary. A particular risk is that the “selected few” are eventually reduced to a single browser (likely, Chrome), bringing us back to the millennium hell of “Optimized for [browser A] in resolution [X times Y]—and don’t you dare visit with anything else!”.

Excursion on security:
But is it not better to use the newest versions for security reasons? Dubious, considering the track record of browser makers and how low security is prioritized. Chances are that the last version of an “extended support release” from five years ago will be more secure than the fresh-off-the-press version from yesterday.* More importantly, browser security issues stem largely from various active contents, notably JavaScript, and browsing with JavaScript off should be the default for any sensible user.** However, in as far as the answer is “yes”, this creates yet another problem—the user now has the choice between using a less secure browser and a worse browser.

*Indeed, it used to be a recommendation among experienced users to not install the latest version of anything until some sufficient bug-stability had been reached: leave the 4.0.0 to the beginners and wait for 4.0.5! However, with the mixture of automatic and forced updates, perverted version schemes, and (often) lack of true major and minor versions, this has grown near impossible—everyone is an alpha tester.

**Which, again, grows harder and harder as evermore incompetent websites use JavaScript to implement functionality that either brings no additional value or could be done as well without JavaScript. Indeed, I strongly suspect that many of them use such features as a mere excuse to force an enabling of JavaScript in order to abuse it to the disadvantage of the users, e.g. by unethical profiling.

Excursion on more general problems:
Unfortunately, issues like software growing worse over time are quite common, and unfortunately have long spread to the world of Unix-like systems too, including through software that is stuck on the desktop paradigm, software that no longer includes sensible command-line arguments, software that is written specifically for e.g. KDE or Gnome, software that relies (often for no practically worthwhile purpose) on D-Bus, and, above all, software written on the premise that the user is an idiot who should be prevented from doing what he wants with the software.

Forced use of certain softwares and OSes is by no means unheard of either. For instance, it is still common that a business has to own MS-Office licenses, because it receives, or is forced to send, MS-Office documents from/to other parties. For instance, there is a non-web version of the aforementioned Elster, but it runs* only on MS Windows, which would force any user to have a licence for that, have a computer running it, etc.

*Or, at least, ran, some years ago. I have not checked for changes, but I am understandably not optimistic.

Again, the world of software was, by and large, better ten years ago than it is today. And, again, there were things that the likes of Vim did right in the 1980s that virtually all newer software fails at in 2022—including something as basic as easily configurable key-mappings.

Advertisement

Tor Browser missing the point

I have written before of browser makers having the wrong attitude (recently, Pale Moon; Firefox repeatedly, e.g. [1]) and of people missing the point to such a degree that what they do borders on the pointless.

Unfortunately, the Tor Browser is another case, brought to my mind by a recent “user agent”* issue (cf. below).

*Strictly speaking, “user-agent header”. For simplicity, I will use just “user agent” below.

The Tor Browser is a modified Firefox browser that allows surfing through the anonymisation/privacy/whatnot network Tor, while attempting to remove weaknesses in Firefox that could defeat the use of Tor. On some levels, the developers take a very strict approach, e.g. in that they advice against using Tor with another browser. On others they are paradoxically negligent.

Consider the following claim from the current version of the Tor FAQ:

Why is NoScript configured to allow JavaScript by default in Tor Browser? Isn’t that unsafe?

We configure NoScript to allow JavaScript by default in Tor Browser because many websites will not work with JavaScript disabled. Most users would give up on Tor entirely if a website they want to use requires JavaScript, because they would not know how to allow a website to use JavaScript (or that enabling JavaScript might make a website work).

This, however, makes both the use of Tor with the Tor Browser and the many alterations of the Tor Browser pointless… Allowing JavaScript is not just “unsafe”—it is a complete and utter disaster, defeating the purpose of Tor entirely! Indeed, I am very, very careful about allowing JavaScript even when not using Tor, because JavaScript does not only allow a circumvention of anonymity protection (which is not a concern in a more “vanilla” situation)—it also very severely increases the risk malware infections and whatnots. (To which can be added complications like more intrusive advertising, redundant and annoying animations of other kinds, and similar.) It would be better to use Firefox (over Tor) with JavaScript off than to use the Tor Browser with JavaScript on!

The we-do-not-want-to-scare-away-beginners argument normally carries some* weight; however, here it does not, because the damage done is so massive. This is like a word-processing program that does not allow the user to enter text… I would also argue that because someone is a beginner, it is more important to give him safe defaults—I know the dangers of JavaScript; most beginners do not. These beginners might then surf away as they like, in a false sense of security, and potentially find themselves in jail after insulting the local dictator…

*But only some: To a large part, it is a fallacy, because it so often involves insisting on behavior that benefits the beginners for two days and either harms the more experienced users for years or forces them to invest considerable time in searching for settings/plugins/whatnot to make the behavior more sane. Indeed, in many cases, the result is a background behavior of which most users will not even be aware, despite being harmed by it. (Consider e.g. “accessibility services” that run up processor time, increase the attack surface for hostile entities, make the OS sluggish, …, without ever being used by the vast majority of users.)

A much better solution would be to keep JavaScript off by default and give beginners sufficient information that they can judge why things might not work and when it might or might not be a good idea to activate JavaScript.* Indeed, the nature of anonymity on the Internet is such that Tor is of little benefit unless the user has received some education on the traps and problems.

*In most cases, the answer is “never”: The security loss will always potentially be there, even a trusted website can be abused by third-parties, and most sites that require JavaScript to function properly, at some point, require a de-anonymizing log-in or registration, e.g. to complete a purchase. With the rare exceptions, I would recommend using an entirely different Tor Browser instance.

The text continues:

There’s a tradeoff here. On the one hand, we should leave JavaScript enabled by default so websites work the way users expect. On the other hand, we should disable JavaScript by default to better protect against browser vulnerabilities ( not just a theoretical concern!). But there’s a third issue: websites can easily determine whether you have allowed JavaScript for them, and if you disable JavaScript by default but then allow a few websites to run scripts (the way most people use NoScript), then your choice of whitelisted websites acts as a sort of cookie that makes you recognizable (and distinguishable), thus harming your anonymity.

Apart from understating the risks of JavaScript, this argument hinges on an easily avoidable use of NoScript. (Cf. footnote above.) This use is the normal case when using a vanilla Firefox, but it is only a convenience, it is not a good idea with the Tor Browser, and it is not acceptable to let the uninformed dictate behavior for the informed. Better then to inform them! In a pinch, it would be better to not include NoScript at all,* point to the possibility of using several browser instances (with or without JavaScript on), and let those who really, really want NoScript install it manually.

*With some reservations for secondary functionalities of NoScript, which is not just a fine-grained JavaScript on/off tool. Then again, these secondary functionalities could in some cases also help with de-anonymization through making the browser behave a little differently from others and thereby allowing some degree of finger-printing.

The same type of flawed thinking is demonstrated in a recent change to the user agent: Historically, this identifier of the browser, OS, and whatnot has had the same default for all Tor Browsers (with occasional updates as the version changed), in order to make it harder to de-anonymize and profile individual users. With the recent release of version 8.0*, this had** changed and at least the OS was leaked. The implication was that e.g. a Linux users could be pinpointed as such—and because of their smaller proportion of the overall users, their anonymity was turned into a fraction*** of what it was before.

*Based on Firefox 60.x, incorporating the extreme overhaul of Firefox hitherto kept back. I am not enthusiastic about the changes.

**The developers have recanted in face of protests—a welcome difference to the way the Firefox developers behave.

***In some sense: Consider a game of “twenty questions”, where the “questioneer” is told in advance that a mineral is searched for… Not only does such information prematurely cut the average search space in three (mineral, plant, animal resp. Linux, MacOS, Windows), but due to the smaller size of the mineral kingdom resp. set of Linux users, the specific current search space is made far smaller.

The justification for this appears to be a fear that websites would (as per the old default) hand out Windows content to Linux users, causing sites to not work. While this is not as bad as the JavaScript issue, it is bad enough, especially since this change was not clearly communicated to the users.

Again, the reasoning behind the change is also faulty: Firstly, the influence of the OS is fairly small and any site that relies on OS information is flawed. Secondly, the opposite problem is quite likely, that a website sees “Linux” and decides “I have nothing tailor-made for Linux. What if the display is not pixel perfect?!? Better to just show an error message!”, even though the site would have worked, had the Windows version been delivered. Combined, these two factors imply that the change likely did more harm than good even for functionality…

A specific argument in favor of the change was that it made little sense to spoof the user agent, because this information could still be deduced by other means. However, almost all these other means require JavaScript to be active—and no reasonable user of the Tor Browser should have JavaScript active (cf. above)! For those who, sensibly, have deactivated JavaScript, the user agent is now an entirely unnecessary leak. To boot, there are situations, notably automatic logging of HTTP-requests, that have access to the user agent, but not to other values (or only with undue additional effort). Looking at such a log, an after-the-fact evaluation can show that a Linux (and Tor Browser) user from IP X visited a certain North-Korean site at 23:02 on a certain day, while the JavaScript based evaluation has to take place in real-time or not at all. Possibly, the logs of another North-Korean site shows that a Linux user from the same IP visited that site at 23:05. It need not be the same user, but compared to a (real or spoofed) Windows user in the same constellation, the chance is much, much larger.*

*Among many other scenarios. Consider e.g. a certain page on a site which is visited by a Linux user somewhere between 23:00 and 23:30 everyday—had he been a Windows users, no one might even have noticed a pattern. Or consider a user visiting one page of a site with one IP at 23:02 and another page with another IP at 23:03—now the risk that the user is recognized as the same is that much larger. Such scenarios obviously become the more serious when other information is added from the “regular” twenty questions. (And while they might seem trivial when applied to e.g. me or the typical reader, they can be very far from trivial in more sensitive situations, e.g. that of a North-Korean fighting for democracy or of someone like Assange.)

Excursion on user agent, etc.:
The situation is the more idiotic, seeing that there are* very, very few cases where e.g. the browser or the OS of the user is of legitimate interest to the website. Apart from statistics** and similar, the main use is to deliver different contents, which is just a sign that the web developers are incompetent—with very, very few exceptions, this should never be needed. If in doubt, it is virtually always better to make a specific capability check*** than to check for e.g. specific browser. Writing websites that look good/function in all the major browsers, on all the major platforms, and even simultaneously in “desktop” and “mobile” versions****using the same contents is not that hard—and doing so ensures that the website is highly likely to do quite well in more obscure cases too.

*Today: In the past, this was not always so, with comparatively weak and highly non-standardized browser capabilities. I think back on my experiences with JavaScript and CSS in the late 1990s with horror.

**And what legitimate reasons do websites have to gather statistics on user agents? The answer is almost always “none”. The main reason that is even semi-justifiable is to optimize the website based on (mostly) the browser, and (cf. above) this is almost always a sign of a fundamentally flawed approach—and the solution is to write more generic pages, not to gather statistics. (In contrast, statistics like how many users visit at what hour or from what country can be of very legitimate interest. A partial exception to the above are major technological upheavals like the switch to HTML 5, but these are likely better handled by more central and generic statistics—or, again, specific capability checks.)

***For a trivial example, if a site needs JavaScript to function, it should check for JavaScript with or in combination with the “noscript” tag (not related to the NoScript plugin)—not whether a browser from a short list of known JavaScript capable browsers is used. The latter will give false positives when JavaScript is turned off and false negatives when a rarer-but-JavaScript-capable browser is used.

****If different versions are needed at all (dubious), this should be an explicit choice by the user. I note that I have very often preferred to use the mobile versions of various sites when on a desktop, because these typically are less over-wrought, are “cleaner”, have a lesser reliance on (unnecessary) JavaScript, come with less advertising, …

Unfortunately, a fad/gimmick/sham of the last few years has been adaptive web design. Attempts to apply this virtually entirely unnecessary and detrimental concept is the cause of much of the wish for e.g. knowing the browser, OS, screen size*, device type, … (other reasons relate to e.g. de-anonymization, profiling, and targeted advertising), to the point that some have wanted to detect the charge level of a mobile’s battery in order to adapt the page… The last is horrendous in several aspects, including an enormous patronization, the demonstration of a highly incompetent design (no page should ever, not even when the battery is full, draw so much power that this is a valid concern), great additional risks with profiling, and a general user hostility—if this was a legitimate issue, give the user an explicit choice: He might prefer to run everything at full speed when low on charge, because he knows that he will be home in ten minutes; he might prefer to run everything at minimum speed even with a full battery, because he is gone for the weekend and has forgotten his charger.

*Screen size might seem highly relevant to the uninitiated, but normally is not—a sufficiently generic design can be made for most types of content. With the rare exceptions, leave the choice to the user.

Pale Moon as a replacement for Tor Browser (or Firefox)

With the continued deterioration of Firefox and the major recent or (for Tor Browser* users) up-coming changes, I have strongly considered moving away from the Tor Browser*. Specifically, I have had my eyes on Pale Moon, a complete fork of an older Firefox version, for a long time, but have held back because it was not available from the Debian repositories**.

*The Tor Browser is a derivative of Firefox, based on the “extended support releases” rather than the latest release. This implies that changes of various kinds are released later or considerably later than for Firefox it self.

**Implying that there would be more hassle to get it running, no way to get automatic security updates through the standard Debian mechanisms, etc.

I read up more in detail some weeks ago*, with the urgency rising, considering going for a switch anyway:

*The below contents are from my open browser tabs. There might have been edits, new posts, whatnot since then.

At first, it seemed to be a sufficiently strong candidate that I could see myself dropping the hardening provided by the Tor Browser in return for having a “better Firefox”. In particular, it promised not to duplicate Firefox’ absurd attitude towards the users (cf. e.g. [1], [2]). For instance, the FAQ claims:

Firefox is created with one-size-fits-all in mind; Pale Moon is created with efficiency and user choice in mind. These two approaches are mutually exclusive, […] Pale Moon also has a different set of goals as to what should be included in the browser and intended audience.

Pale Moon has a number of differences in the user interface and feature set to provide an as intuitive, predictable, logical and usable user interface as possible for the best user experience. […]

Note that Pale Moon will never adopt the Australis (Firefox 29 and later) interface and aims to remain a fully XUL-driven browser with full user interface customizability.

Also please note that Pale Moon has not run rampant with its releases […]

However, the official forums showed that Pale Moon might talk the talk—but it does not walk the walk. (I have particular concerns about the lead developer, “Moonchild”, but make reservations for the risk of misattributation.) Consider the following forum discussions (by no means a complete list):

1. https://forum.palemoon.org/viewtopic.php?f=46&t=17619:

   The developers more-or-less force the users to give up the very, very valuable NoScript plug-in*, using the motivation that too many web-sites would break when it is turned on and that Pale Moon would be blamed by uninformed users—a truly Firefoxian move!

   *The use of “plug-in” and “add-on” in this text might be inconsistent. (Starting with my never quite having found out whether there is a difference in Firefox terminology and, if so, exactly what that difference is.)

   Since this is implemented through blacklisting of the plug-in, it appears that the only way to get the plug-in to work again is to turn off the blacklist entirely, which means a considerable unnecessary security risk… The flaws of this implementation, be it of the block, per se, or the blacklist, seem to be beyond the developers’ comprehension.

   The repeatedly displayed lack of insight to the criticism raised in the thread led to comments like

   This makes the whole idea of switching from Firefox a farce– it is replacing the arrogance of one party with the arrogance of another.

   You are the one who needs perspective, and people are going to be giving it to you. You will certainly not gain it though.

   (More complaints about this decision can be found in e.g. https://forum.palemoon.org/viewtopic.php?f=46&t=19119. This might at some point include the above, seeing that the moderators want to merge threads.)

2. https://forum.palemoon.org/viewtopic.php?f=13&t=5647:

   Here a number of rules are given for those who want to suggest new features. While some of them are somewhat sensible, not all are, and the overall impression is not positive:

   Is the suggested feature specific to your workflow? If so, you have to think about how it would affect people who do things differently, and how many people are likely to use the same workflow you do. Evaluate your own browsing behavior before suggesting this kind of feature.

   This is not only very hard to check, but the attitude displayed here goes a long way in the direction of “if the majority does not use it, it should not be a feature”, which is a major problem with modern software—including the Firefox of the last years. (There is much positive to say about avoiding feature bloat, including easier maintenance; however, older Unix software has shown that it is possible to achieve tremendous functionality and flexibility without writing undue features, simply through the correct thinking. In contrast, most modern software falls on its face as soon as the user tries to do something other than the designers explicitly intended—which is often pitifully little and highly limiting.)

   Is the suggested feature culturally neutral? Keep in mind that Pale Moon users come from all walks of life everywhere in the world. Core features should apply to everyone and not be regionally or culturally bound where possible.

   This sounds like the worst type of Politically Correct crap: Either a feature makes sense or it does not. “Cultural neutrality” is not a valid criterion. (Note that e.g. a Bible-study helper or a find-the-way-to-Mecca helper would be, even without this guideline, too specific to make a useful feature, a prime example of something to put in a plug-in, and/or something that could be generalized to something more useful and culture neutral.)

   How “advanced use” is the suggested feature? While I wholly welcome power users and gurus to use Pale Moon, any added feature should still be easy to understand for most anyone.

   Again a fundamentally flawed approach from a software-development perspective: This ties the hands of the development and could cause a number of beneficial features not to be implemented. It would, for instance, have prevented the development of the features needed for plug-ins… To boot, the limit for “too advanced” is usually set far too low, as e.g. with Firefox and images on/off or, indeed, with Pale Moon and NoScript above…

   Are there multiple existing solutions to what the suggestion addresses? You can call this “technical neutrality”. If there are clear choices a user can make from e.g. existing add-ons to get the feature implemented in different ways, with different levels of granularity or catering to different situations, then the feature is likely less suitable for inclusion in the browser core. User choice is an important driver for Pale Moon.

   While I agree with the question, I find the explanation incomprehensible. For one thing, I am not certain that I understand what is meant; for another, the argumentation is contrary to expectations: If there are multiple existing add-ons to solve a problem, then that could very well be a sign that the functionality should be given a blessing as a core feature (or that some core feature should be made available to cover commonalities of the add-ons). The more solutions there are, the more popular the feature is likely to be, and the more duplication is caused by not having it as a core feature… Indeed, the question would be better as “Is there at least one existing solution to what the suggestion addresses?”, seeing that this is where the question gains its legitimacy.

   Does the suggestion improve overall quality of the browser? A suggestion for a core feature should improve overall quality or convenience for the user in the broadest sense of the word and applicable to a majority of the Pale Moon users.

   Again, a question that makes sense followed by an explanation that does not: This again commits the sin of ruling out features based on some version of “majority use” and rules many things out that would fulfill the question.

   Does the suggestion hinder the download and display of any content? Pale Moon should enable and promote the download of web content, not prevent it. This applies to any content, including commercial content that might be considered “superfluous” or “undesired”. As such, the Pale Moon browser core will not be a good place to put any “blocking” features (ad blockers, script blockers, etc.)

   Spurious reasoning: A good browser should serve to display content the way the user likes it. This includes having some ability to block content as a matter of course, including a minimum of e.g. images on/off*, JavaScript on/off, Cookies on/off, animated content on/off, movies on/off, sound on/off, and preferably e.g. a possibility to black-list based on a pattern. Indeed, many of these can be hard or impossible to implement without supporting core features… However, more advanced solutions, e.g. that provided by the NoScript plug-in are preferably to put in an add-on to avoid bloat. (But then the NoScript plugin is not available anymore…)

   *In some examples, there can be a question of whether the actual download or only the display should be prevented. However, one of the main reasons to block some types of contents is to reduce the number and size of downloads—especially for those who use Tor and see correspondingly slower downloads.

3. https://forum.palemoon.org/viewtopic.php?f=13&t=19187:

   A post titled “The developers’ attitude” starts this thread thus:

   OK, you have to be the biggest asshole developers I’ve seen in a while. With this attitude you don’t deserve any attention or recognition whatsoever.

   The stupidity that stems from this is so immense that after I read it, its force was so strong a wind gushed from my monitor and pushed me back.

   I don’t care if you delete this thread or ban me, the important thing is that a moderator and maybe some users will read it before its deletion and you will get called out for the arrogant asshats you are.

   You need to stop with this attitude or even the few people that use your outdated, laughable FireFox forks will stop using it knowing you’re a bunch of douchebags.

   Unfortunately, there is no reason given for this opinion, but it is certainly not a good sign, especially when combined with the other threads mentioned.

   (The rest of the thread is, predictably, a flame war.)

4. https://forum.palemoon.org/viewtopic.php?f=3&t=19696:

   Here a user has problems with a missing option to continue with a page display after a warning concerning certificates—a standard feature in modern browsers. The responses are not cooperative and the OP says:

   But in this case it was safe, as seen by the fact the page loaded if I followed a link to get to it. So, why does Pale Moon get to make the decision instead of me? Shouldn’t a manual override always be an option? Shouldn’t I have control over how I use the program?

   (An opinion that I support whole-heartedly: He should be in control, Pale Moon claims to want to put users in control, and not actually doing so is both user-hostile and hypocritical. Software should enable—not disable.)

   Most of the thread consists of a back and forth between users, who believe that they should be in charge, and developers, who believe that they know better…

5. https://forum.palemoon.org/viewtopic.php?f=17&t=11659:

   Here the developers explain “why we prefer to not allow TOR relayed users to use our services”—using entirely specious reasoning: Because Pale Moon would not in any way be “personally or ideologically sensitive”, anonymity is not needed and the only conceivable use of Tor would be for illicit purposes like “abuse, spam and trolling”.

   This shows a fundamental lack of understanding for how anonymity on the Internet works and the problems relating to e.g. profile building and government surveillance—not to mention the potential extra effort to e.g. run multiple browsers. To boot, if all sites reasoned in this manner, only a fraction of sites would be usable with Tor, and Tor correspondingly be reduced to a tool for criminals/terrorists and vulnerable politicals, instead of the general anonymity tool it is supposed to be.

   Some other thread that I did not keep open also showed a complete misunderstanding of the advantages and disadvantages of Tor.

   For someone considering a switch from Tor Browser (or even Tor it self), this is not a good sign, especially since this type of naivete is likely to also manifest it self in the internal workings of Pale Moon, e.g. concerning what data is volunteered to various sites.

At least at this point of time, I would not touch Pale Moon with a ten-foot pole. For others, it might or might not be better than the original Firefox, but that is not a ringing endorsement… Tor Browser users should certainly stay with Tor Browser, even at the price of losing a few plug-ins. Sadly, the reason for my rejection is that Pale Moon manifestly does have the same user-despising philosophy as Firefox—quite contrary to the official claims.

Follow-up: On Firefox and its decline

Since my post on the decline of Firefox, the developers have released another “great” feature, supposed to solve the speed problem compared to Chrome and other competitors: Electrolysis* (aka. e10s).

*I have no idea how they came up with this misleading name. Possibly, they picked a word at random in a dictionary?

This feature adds considerable multi-threading capability and detaches the GUI from the back-end of the browser, thereby on paper making the browser faster and/or hiding the lags that do occur from the user.

In reality? In one browser installation* (shortly after the feature being activated) I had to disable this feature, because it caused random and unpredictable tab failures several times a day, forcing me to “restart” (I believe the chosen word was) the tab in order to view it again. Even the tabs that did not need to be restarted only displayed again with a lag every time another tab had failed. The net effect was not only to make the browser more error prone, but also to make it slower (on average).

*I have several Firefox (more specifically Tor Browser) installations for different user accounts and with different user settings, including e.g. separate installations for business purposes, private surfing, and my WordPress account. This to reduce both the risk of a security breach and the effects of a breach, should one still occur. As for why the other installations were not affected, this is likely due to the roll-out manner used by Firefox of just activating a feature in existing installations, based on an installation dependent schedule, instead of waiting for the next upgrade. Presumably, all the other installations had received upgrades before being hit by the roll-out. (This approach is both ethically dubious and a poor software practice, because it removes control from the users, even to the point of risking his ability to continue working. What if something goes so wrong that a down-grade or re-install is needed—with no working browser installed? This is very bad for the private user; in a business setting, it could spell disaster.)

Today, I had to deactivate it in another installation: After opening and closing a greater number of tabs, Firefox grew more and more sluggish, often only displaying a page several seconds after I had entered the tab, or showing half a page and then waiting for possibly 5–10 seconds before displaying the rest. This for the third time in possibly a week after my latest upgrade. (I would speculate on some type of memory leak or other problem with poor resource clean up.)

I note that I have never really had a performance problem with Firefox (be it with pure Firefox or the Tor Browser*) before this supposed performance enhancer, possibly because I use few plug-ins and have various forms of active content (including Flash and JavaScript) deactivated per default—as anyone with common sense should. This makes the feature the more dubious, because it has (for natural reasons) taken a very large bite out of the available developer resources—resources that could have been used for something more valuable, e.g. making it possible for plugins like “Classic Theme Restorer” to survive the upcoming XUL removal.

*Not counting the delays that are incurred through the use of Tor. I note that Tor is a component external to the Tor Browser, and that these delays are unrelated to the browser used.

Unfortunately, the supposedly helpful page “about:performance”, which was claimed to show information on tabs and what might be slowing the tabs down, proved entirely useless: The only two tabs for which information was ever displayed were “about:config” and “about:performance” it self…

Oh, and apparently Electrolysis is another plugin killer: The plugin makers have to put in an otherwise unnecessary effort in order to make their plugins compatible, or the plugins will grow useless. Not everyone is keen on doing this, and I wish to recall (from my research around the time of the first round of problems) that some plugins face sufficiently large obstacles that they will be discontinued… (Even the whole XUL thing aside.)

Now, it might well be that Electrolysis will prove to have a net benefit in the long term; however, we are obviously not there yet and it is obvious that the release(s) to a non-alpha/-beta tester setting has been premature.

On Firefox and its decline

I recently encountered a blog post by a former Firefox insider discussing its declining market share.

When it comes to the important question “why?”, he offers that “Google is aggressively using its monopoly position in Internet services such as Google Mail, Google Calendar and YouTube to advertise Chrome.”—which cannot be more than a part of the truth.

If it were the entire truth, this would mostly show in new or inexperienced users going to Chrome instead of Firefox, those that have not yet grown accustomed to a particular browser.

Then why is there a drop among the long-term users? Those who have used Firefox for years? Those who (like me) first used the Firefox grandfather Mosaic well over twenty years ago and then graduated to its father, Netscape?

Things like that happen either because the competition grows better (or better faster) or because the own product grows worse. Indeed, this is what I have repeatedly experienced as a user: After Netscape, I switched to Opera for a number of years, because Opera actually was a better browser, especially with its tabs. Year for year, Opera failed to add new useful features and tried to force-feed the users poorly thought-through ideas that some manager or developer out of touch with his users saw as revolutionary. Eventually, I gave up and moved over to Firefox, which at the time did a reasonable job and had over-taken Opera—not because of its own qualities, but because Opera declined.

Unfortunately, Firefox has gone down the same destructive path as Opera followed, has grown worse and worse, and the only reason that I am still with Firefox is that I use the “Tor Browser Bundle”, which is based on Firefox and recommended as the safest way to use Tor by the Tor developers.

To list all that is wrong with Firefox and its course would take far too long—and would require digging through many years* of memories of “for fuck’s sake”–memories.

*I am uncertain how long I have been using Firefox by now. In a rough guesstimate, the Opera-to-Firefox switch might have occurred some ten years ago.

However, to list some of the most important (often over-lapping) issues:

1. The removal of preferences that should be standard, e.g. the ability to turn images and JavaScript on and off. If these remain at all, they are pushed into the infamous, poorly documented, and unreliable “about:config”—the use of which is strongly discouraged by Firefox.

   When such preferences are removed (respectively moved to “about:config”) the handling can be utterly absurd. Notably, when the setting for showing/not showing images in web pages was removed, the Firefox developers chose to defy the stated will of the user by resetting the internal setting in about:config to the default value…

   To boot, config switches that are in “about:config” often stop working after some time, merely being kept to prevent scripts from breaking, but no longer having any practical function. Among the side-effects is that someone finds a solution for a problem on the Internet, alters the configuration accordingly—and has to spend half-an-hour researching why things still do not work as intended. (The reason being that the solution was presented for an earlier version of Firefox and Firefox failed to make clear that this solution was no longer supported.)

2. Forcing users to download add-ons to handle tasks that a good browser should have in its core functionality, while adding nice-to-haves appropriate for an add-on to the official interface… (The “sync” bullshit is a good example.) Worse: Not all add-ons are compatible with each other (or with every Firefox) version, making this road unnecessary problematic, with results including even browser crashes. To boot, any additional add-on increases the risk of a hackable vulnerability, data being leaked to a hostile third-party, or similar.
3. Failing to add functionality that would be helpful, e.g. a possibility to disable the design atrocity that is “position:fixed” or a user-friendly mechanism for mapping keys.
4. One truly great (and expectedly oldish) feature of Firefox is the ability to save tabs and windows when exiting or the browser crashes and have them restored on the next start. This especially since Firefox crashes more than most other applications.

   Unfortunately, the configuration of this feature is a bitch (and probably disabled by default). There are at least two (likely more; it has been a while since I dealt with this the last time) flags that have to have the right value for this to work—one of which should rightly be entirely independent*. The names of these settings in about:config and the description in the GUI are non-obvious, more-or-less forcing a user to search the web for information—if he is aware that the feature exists in the first place. And: In several releases this feature has been so bug ridden that no combination of settings has worked…

   *The one appears to control the feature; the other controls whether a warning is issued when a user tries to close more than one tab at a time. When the latter is disabled, which is very reasonable even for someone who uses the former, the former is ignored…

   Worse, without this functionality a simple “CTRL-q” just quits the browser—no confirmation, no tabs saved. For a power surfer who regularly has dozens of tabs open at the same time, this is a major issue. This is the worse since someone heavy on tabs is almost certainly a frequent user of “CTRL-w”* and there is no good native way to change key bindings—amateurish!

   *I.e. “close the current tab”. Note that “w” is next to “q” on a standard QWERTY-keyboard, making the likelihood of occasional accidents quite high.

5. The config management is lousy.

   For instance, Firefox started with the Windows style concept of “one user; one configuration” and never added provisions to e.g. specify config files on the command line. Among the negative side-effects is the later need to invent the redundant and poorly implemented concept of a “profile”—confusing, user-unfriendly, and bloating the code.

   For instance, “about:config” provides many, many options of the type normally found in a config file, that could have been edited with a text-editor much more comfortably than over the about:config interface. However, this opportunity was not taken and the users are stuck with about:config. Actually, there are some type of files, but these are absurd in comparison with those used by most Linux applications—and it is very, very clear that users are supposed not to edit them. (Statements like “Do not edit this file.” feature prominently.) For example, Firefox uses user_pref(“ui.caretBlinkTime”, 0); where any reasonable tool would use ui.caretBlinkTime=0.

   For instance, there is so much secrecy about and inconsistency in the configuration that the standard way to change an apparently simple setting is to install an add-on… (Also cf. above.) Where a user of a more sensible application might be told “add x=y to your config file”, the Firefox user is told to “install add-on abc”…

   For instance, copying the configuration from one user to another fails miserably (barring subsequent improvements), because it contains hard-coded paths referring to the original user.

   For instance, it used to be the case that a Firefox crash deleted the configuration, forcing the user to start over… (This was actually something that kept me with Opera for a year or so after I was already thoroughly feed up with it.)

6. The support for multi-user installations, the standard for Linux and many corporate Windows installations, is weak and/or poorly documented. The results include e.g. that all users who wants to use popular add-ons have to install them individually—and keep them up-to-date individually.

   (Disclaimer: I looked into this on several occasions years ago. The situation might have been improved.)

7. There are a number of phone-home and phone-third-party mechanisms that bring very little value, but often pose a danger, e.g. through reducing anonymity. This includes sending data to Google, which I would consider outright negligent in light of Google’s position and how it has developed over the years.
8. The recent, utterly idiotic decision to drop Alsa support in favour of Pulse on Linux. This decision is so idiotic that I actually started to write a post on that topic alone when I heard of it. Most of what I did write is included as an excursion below. (Beware that result is not a full analysis.)
9. The address bar started of very promisingly, e.g. with the addition of search keywords*. Unfortunately, it has so many problems by now that it does a worse job than most other browsers—and it grows worse over time. The preferred Firefox terminology “awesomebar” borders on an insult.

   *For instance, I have defined a keyword so that when I enter “w [something]”, a Wikipedia search for “[something]” is started. “ws [something]” does the same for the Swedish version of Wikipedia; “wd [something]” for the German. (I have a number of other keywords.)

   Among the problems: If a page is loading slowly and I re-focus the address bar and hit return again, the obvious action to take is to make a new attempt to load this page—it does not: It reloads the previous page! The history suggestions arbitrarily excludes all “about:” entries and all keyword searches—if I search with “w [something]” and want to switch to “g [something]”*, I have to retype everything. Per default, for some time, the history functionality is weakened through not listing the potential matches directly, but preceding them with annoying and useless suggestions to “visit” or “search” that only delay the navigation and confuse the users. Moreover, while there used to be working config flags to disable this idiocy, there are now just config flags (that do not work)…

   *Used to mean “search with Google” a long, long time ago; hence the “g”. Currently, I use duckduckgo.

10. The layout/design and GUI (including menu handling) have been drastically worsened on several occasions.
11. Many of the problems with Firefox can be remedied with “Classic Theme Restorer” (an absolute life-saver) or similar “user empowering” add-ons. Unfortunately, these all use the “XUL-framework”*, which Firefox has decided to discontinue. There is a new framework for add-ons, but it does not support this type of functionality (whether “yet” or “ever” is not yet clear). Many of the most popular add-ons, including “Classic Theme Restorer”, will therefore not be able to provide the full scope of functionality and at least some of them, again including “Classic Theme Restorer”, will be discontinued by their developers when XUL is turned off.

    *In a twist, XUL was once considered a major selling point for Firefox.

    My poor experiences with Firefox and the absurd attitudes of the Firefox developers might have made me paranoid—but I cannot suppress the suspicion that this is deliberate, that the add-ons that allow users to alter the default behaviors are viewed as problems, as heretics to burn at the stake.

To this should be added that since the switch from a “normal” versioning scheme to the idiocy of making allegedly major releases every few months*, the feature cramming has increased, with a (very predictable) increase in the number of run time problems. The Firefox makers were convinced that this would turn Firefox from a browser into a super-browser. In reality, this only resulted in hastening its demise—in much the same way that a TV series fighting for its survival ruins the good points it had left and drives away the remaining faithful**. If in doubt, most people who try to jump the shark are eaten…

*I.e. making version jumps of 44 to 45 to 46, instead of 4.4 to 4.5 to 4.6 or even 4.4.0 to 4.4.1 to 4.4.2.

**A topic I have been considering recently and intend to write a blog post on in the close future.

Sadly, the delusional author of the discussed article actually makes claims like “Firefox is losing despite being a great browser, and getting better all the time.”—turning the world on its head.

Excursion on the competition:

Unfortunately, Firefox could still be the lesser evil compared to the competitors. Chrome/Chromium, e.g., has many strengths, but configurability and adaptabtility to the user’s needs are not among them; on the contrary, it follows the deplorable school of achieving ease of use through reducing the controllable feature set—the equivalent of Apple’s infamous one-buttoned mouse. Chrome is entirely out of the question for anyone concerned with privacy; while its open-source sibling chromium (in my possibly incorrect opinion) trails Chrome in other regards. I have not tried Opera for years; but combining the old downwards trend (cf. above) with the highly criticized platform shift that almost killed it, I am not optimistic. Internet Explorer and Edge are not worthy of discussion—and are Windows only to begin with. Safari, I admit, I have never used and have no opinion on; however, it is Mac only and my expectations would be low, seeing that Apple has pioneered many of the negative trends in usability that plague today’s software. Looking at smaller players, I have tried possibly a dozen over the years. Those that have been both mature and user-friendly have been text-based and simply not worked very well with many modern web sites/designs, heavy in images and JavaScript; most others have either been too minimalistic or too immature. A very interesting concept is provided by uzbl, which could, on paper, give even the most hard-core user the control he needs—but this would require a very considerable own effort, which could turn out be useless if the limited resources of uzbl dry up.

Excursion on the decline of open source:

It used to be that open-source software was written by the users, for the users; that the developers were steeped in the Unix tradition of software development; that they were (on average) unusually bright and knowledgeable; … Today, many open-source projects (e.g. Firefox, Libre-/OpenOffice, many Linux Desktop environments) approach software development just like the commercial firms do, with an attitude that the user should be disenfranchised and grateful for whatever features the projects decided that he should like; quality is continually sacrificed in favour of feature bloat (while central features are often still missing…); many of the developers have grown up on Windows or Mac and never seen anything better; … Going by the reasoning used by many Firefox developers in their bug tracking tool, Firefox appears to have found more than its share of people who should not be involved in software development at all, having poor judgment and worse attitudes towards users.

Excursion on Pulse:

(Disclaimer: 1. The below is an incomplete version of an intended longer analysis. 2. At the time the below was written, I had a few browser tabs open with references or the opinions of others that I had intended to include. Unfortunately, these went missing in a Firefox crash…)

The reasoning is highly suspect: Yes, supporting two different sound systems can be an additional strain on resources, but this decision is just screwed up. Firstly, they picked the wrong candidate: Pulse is extremely problematic and malfunctioning so often that I would make the blanket recommendation to de-install it and use Alsa on almost any Linux system. Moreover, Pulse is not a from-scratch-system: It is an add-on on Alsa and any system using Pulse must also have Alsa installed—but any system can use Alsa without having Pulse. Not only will more users have access (or potential access) to Alsa, but good software design tries to stick with the smallest common denominator to the degree possible. Secondly, at least one abstraction already exist that is able to abstract multiple sound systems on Linux (SDL; in addition, I am semi-certain that both Alsa and Pulse provides backwards compatibility for the older OSS, which could have been used as a workaround). Thirdly, if none had existed, the proper Open Source way would have been to create one. Fourthly, a browser maker who tries to dictate what sound system a user should use have his priorities wrong in an almost comically absurd manner. (What is next? KDE only? Kaspersky only? Asus only?) Notably, there are very many Linux users who have made a very deliberate decision not to burden their systems with Pulse—and have done so for very good reasons*.

*Including how error prone it is, a too-high latency for many advanced sound users, the wish for a less bloated system, or Pulse’s straying too far from the classical principles behind Unix and Open Source software. Do an Internet search for more details on its controversy.

A particular annoyance is that the decision is partly justified by the claim that statistics gathered by Firefox’s phone-home functionality would indicate that hardly anyone used Alsa—which is extremely flawed, because many Linux distributions and individual educated users disable this phone-home functionality as a matter of course. Since the users who have a system with phone-home enabled are disproportionally likely to be unlucky/careless/stupid enough to also use Pulse, the evidence value is extremely limited.

Abandoning Opera

For at least eight years, I have been an Opera user—and for much of that time, I have considered it the best browser around and strongly recommended it to others.

Today, I throw Opera at the metaphorical garbage heap, to focus instead on Firefox. This following a transitional period of roughly six months, where I have been using Opera and Firefox in parallel.

Why so?

Well:

1. Firefox has improved over the years. Most importantly: It no longer deletes (!) the config files when it crashes—an inexcusable programming error, which was present for at least several years (and which has been a strong influence in my repeatedly interrupting experimental Firefox use in the past).

2. Firefox has a great number of plugins. While most of these are of no value, some are extremely useful, notably Vimperator^w and NoScript^w. Opera has very little “external” functionality, which makes it crippled in comparison (a plug-in framework of some sort was recently announced, but the success is too uncertain and the time frame too long to sway me).

3. On that line: Firefox has Vimperator…

4. Opera has a number of annoying behaviours, e.g. concerning the address bar (which tends to grab focus when it should not and keep focus after it has been told to let go).

   Specifically, the last straw that now makes me abandon Opera: Today, I loaded about a dozen tabs from an unusually slow website. I moved onto the first tab, with a half-loaded page, pressed the space bar to jump over a contentless introduction—but instead of jumping downwards, the address was overwritten with a space. (Incorrect initial focus.) I then clicked on the page, switching the focus to where it belonged, and pressed space again—only to see yet another space added to the address bar. (Counter-intuitively, two clicks are required to “unfocus” the “activated” address bar.) Within a few minutes, this repeated on most of the remaining tabs—and since this was the umpteenth time this happened, the last straw was in place.

   (Should I not have known better and adapted? Possibly, but using a computer is a largely automatic procedure with me: If I wish to scroll down, my fingers do the right thing without thought, just like my legs do the job of turning a corner without thought. If someone or something screws with standardized behaviour, I am thrown off. Consider trying to turn a corner when the legs go in the opposite direction of what they do on a normal day…)

5. Opera has a user-despising attitude to features of “we know best”, “the more, the merrier”, and “let us shove the features down the users throat”. (A common problem in world of software, see also my writings on software development.) Notably, these problems have become worse from release to release, and (in some ways) Opera is actually deteriorating.

   The worst example is possibly “fast forward”—a function that when activated tries to jump to the next page (according to some heuristic). This is not a bad thing in itself (at least, were it more accurate…); however, this function has been mapped to a number of keys in a non-standard way—including the space bar. Now, the space bar, in a text-reading context, means “scroll one page down in the current document”, in a tradition going back to at least the 80s and used in all browsers I have ever made more than casual use of. In Opera, the meaning has been altered using fast forward to “scroll down or skip to what I incorrectly believe to be the next document”. Not only does this break standard in-document navigation, but it is also extremely confusing, because the user is never told about this non-standard behaviour.

   (Generally, Opera has many odd and unexpected key mappings.)

   A more subtle, and largely unknown, example is “fraud protection”: Unless explicitly de-activated, this feature “dials home” concerning every site visited (!) to check the credibility of the site. This is done with good intentions, but causes unnecessary time delays, opens a very wide gate for abuse, and brings little benefit in practice: Before I found out and turned it off, I cannot recall it giving me as much as one single warning…

6. Two strong arguments for Opera in the early days, speed and tabbed browsing, are moot today: Tabbed browsing is standard, and any speed advantage Opera has is rarely detectable in practice—and Chrome is alleged to be even faster. (Do no use Chrome, however: There are too many potential security problems.)

7. Opera is a commercial tool, while Firefox is Open Source. Now, I am not ideologically bound to the use of Open Source software, let alone Free software; however, my experiences have shown great advantages with Open Source, including faster bug fixes, higher quality, and a greater consideration for power users. Further, while I have seen no signs of malicious abuse using Opera (e.g. spying on users), it can never be ruled out—and is a very real possibility for the future. Firefox, in contrast, would be exceedingly unlikely to even try something like that—and would be unable to do so for long without being exposed.

8. If I have not made the point: Firefox has Vimperator.

The two things still speaking for Opera: Firstly, it has a few very handy functions (e.g. “fit to width”), which Firefox still lacks or only gives an inferior emulation of, with our without plugins. However, these are things that can be sufficiently worked-around to avoid a knock-out victory’s over-coming the heavy point deficit in the twelfth round. The one severe weakness that Firefox has is the lack of a decent tool to match keys to functions—but Vimperator solves parts of that problem. Secondly, Opera does run better out of the box (after some time has been spent on de-activating various features) and has an easier configuration. However, this short-term advantage does not carry-over to the long-term.