Pale Moon and Firefox - The Honeymoon Period is Over

[Innuendo]

Pale Moon is one of the most popular alternative browsers available. Having access to Firefox extensions, Firefox compatibility, and a pre-Australis interface without telemetry being transmitted in the background are just some of the reasons why people have chosen to use Pale Moon. However, what a lot of people don't know is everything is about to change. A lot.

Pale Moon has been enjoying a golden age of development having been based on the Firefox 24 ESR release. Maintaining Firefox compatibility & having the benefit of leading security experts examining the Firefox source code for vulnerabilities has given the Pale Moon team a leg up in staying current with features, security, and performance.

However, Mozilla has ended support for the 24 ESR branch of the Firefox code and it has been deprecated. There will be no more work done on it by the Firefox team nor will independent security experts be examining its code. It has been left to wither in the field. All further development and security evaluations will fall solely upon the small Pale Moon team.

To further the divide between the Firefox and Pale Moon browsers, the Pale Moon team has decided to abandon the Gecko engine and develop their own, code-named Goanna. This holds numerous advantages for them moving forward. However, this is more code that they will solely be responsible for to ensure that no vulnerabilities crop up in the code.

Last, but certainly not least, is a change that may very well be a devastating blow for the browser. Mozilla has declared that extensions will no longer be supported by Firefox in the future and the browser will be moving to a model that exclusively supports Chrome add-ons.

This begs the question of what's the point of using a Firefox clone that is no longer a Firefox clone? Furthermore, what good is a Firefox clone that doesn't have active development of extensions to increase its functionality?

Also, in a similar vein, why use Firefox over Chrome?

[wraith808]

Also, in a similar vein, why use Firefox over Chrome?

I agreed with you up until this point.  There is a very real reason to use Firefox over Chrome.  Though I don't out of laziness since my company has standardized on Chrome and IE as of right now (and the NPAPI thing hasn't helped that use of two browsers), Firefox, even using Chrome extensions, is a different codebase, uncontrolled by Google.  That's a very real draw to some people.  Sharing extensions consolidates the core of developers and the development effort, and benefits both browsers.

[TaoPhoenix]

Hi Inuendo.

I was raising similar concerns a few days back, but nice research into "whatever" the 24 ESR release branch means into Stuff.

I think I'm slightly meta-concerned that Google, well, became "a verb" to replace "web search engine", but then they decided to make Android and are scaring Apple, then they decided "hey, let's do browsers" and A, made Chrome that lots of people like as is, then made *Mozilla* turn add-ons into Chrome Compatible things.

So now that Pale Moon is going to decide to make their own engine, did someone "super-trap" them into that?! "No security experts" (but you know some will), "will be looking at their code..." - I'm getting lost in the Meta-Game again.

I really emphasize the split between User UI and Backbone. And Mouser just (medium) changed the User UI look to fix a decade of creaking backbone. But so - if people can't just do old school "let's do FF forks", are we getting meta-played into something? So Mozilla is Doing Things, Pale Moon has been a serious leading contender spin, I'm using a 3rd tier one by Comodo called Ice Dragon, Vivaldi is trying to re-undo Opera-ish-things, and sky only knows what MS's Edge means into all of this!

I just want non-sleek old style menus where all 70 features are there, and people don't go "yay simple, so we can trick you into us hiding behind gear icons into cutting huge swaths of features!"

But Opera V1 and possibly Vivaldi are getting stuck into "invent your own rendering engine" and the Pale Moon guys might be good, until someone meta-sinks them with "oh look, your new engine just died to a security failure so go away now."

[Innuendo]

I agreed with you up until this point.

Well, that wasn't a point. It was a question. An open-ended, non-biased question to spur discussion. I have yet to form an opinion on Firefox's actions yet and just threw that in there to get the opinions of the DC hive mind.

[Innuendo]

I was raising similar concerns a few days back, but nice research into "whatever" the 24 ESR release branch means into Stuff.

Almost replied to your post along with Wraith's but I think you asked enough questions to keep things separated. So....what's ESR? Simple answer is ESR stands for Extended Support Release. Huge companies hate change, but software developers love it when huge companies use their software and ESR releases make a compromise that makes software more palatable to those huge companies.

When a version of a particular program becomes ESR, it's usually an older, established version (such as Firefox v24) that Mozilla has made a firm commitment that they will not add any new features to that version (thereby not introducing any new bugs), but will commit to back-code any bug or vulnerability fixes for a set amount of time (say, 18 months) while the regular software version moves forward to bigger and better things.

Now, how does this affect Pale Moon? Pale Moon was based on Firefox 24, an ESR release, so they were able to make all their coding changes and feature additions safe in the knowledge that if anyone on the Firefox side of things found/fixed a bug or vulnerability, that code would be shared with them. Since ESR releases are used by huge companies, there's a lot of scrutiny by non-Firefox & non-Pale Moon developers/employees meaning more eyes being more likely to find any problems that may exist.

Now, the extended support commitment for Firefox 24 has ended. Firefox's new ESR release is Firefox 31 and it will get the extended support and be used by the huge companies going forward, leaving Firefox 24 behind to be deprecated and forgotten. One may argue that Pale Moon has digressed enough from the original Firefox code by now that this doesn't matter & to a certain extent that is true, but the fact remains is that the Firefox 24 code-base is firmly, with certainty, and forever out of the spotlight being declared obsolete by its creators.

Going forward the Pale Moon team is on their own (which to my knowledge is only two or three people).

I think I'm slightly meta-concerned that Google, well, became "a verb" to replace "web search engine", but then they decided to make Android and are scaring Apple, then they decided "hey, let's do browsers" and A, made Chrome that lots of people like as is, then made *Mozilla* turn add-ons into Chrome Compatible things.

I'm not sure what to make of Google these days and this is coming from someone who has an Android phone & tablet sitting on his desk right now and wouldn't have it any other. Just yesterday my friend were reminiscing about the days when Google's mission statement was Do No Evil. When was the last time we heard anyone at Google utter those words?

So now that Pale Moon is going to decide to make their own engine, did someone "super-trap" them into that?!

No, no one was trapped, scammed, or anything like that, but for a while now Mozilla has tied the browser engine version to the browser version and that's really started to become limiting to Pale Moon. Something needed to be done so the Pale Moon browser could move forward on its own and that's what needed to happen: a browser engine of their own.

But so - if people can't just do old school "let's do FF forks", are we getting meta-played into something? So Mozilla is Doing Things, Pale Moon has been a serious leading contender spin, I'm using a 3rd tier one by Comodo called Ice Dragon, Vivaldi is trying to re-undo Opera-ish-things, and sky only knows what MS's Edge means into all of this!

Life is full of paths and those paths intersect and branch off in different directions. Spend all your time at an intersection straining your eyes to see what's down the end of all those paths & you'll end up going nowhere. I can see real benefits into moving to Chrome add-ons where there's a unified extension scene & not having to upgrade your extensions every time you upgrade your browser. However, I'm a little worried about all the telemetry and "suggested sites" that are just veiled advertising that's being added to Firefox. Fortunately, if you dig deep enough you can turn it all off, but it's a little troublesome the way things are heading.

I just want non-sleek old style menus where all 70 features are there, and people don't go "yay simple, so we can trick you into us hiding behind gear icons into cutting huge swaths of features!"

If you want your old Firefox UI back then check out the Classic Theme Restorer extension. It goes a long way to making things look sane again.

The Opera and Vivaldi developers just don't get it & I don't think they'll ever be more than niche products.

[wraith808]

then made *Mozilla* turn add-ons into Chrome Compatible things.

Where is it that they *made* them do anything?  I thought that the Mozilla foundation *decided* to do it and were not pressured into it by someone else?

[mwb1100]

Furthermore, what good is a Firefox clone that doesn't have active development of extensions to increase its functionality?

As long as Greasemonkey works, I'm good. And if they do something to break Greasemonkey, I'll just stick with the last version that does work until... maybe forever.

[tomos]

The Opera and Vivaldi developers just don't get it ...

you say this at the end of a long post - so I'm not really sure what you're referring to with 'it' (?)
TIA

[Innuendo]

you say this at the end of a long post - so I'm not really sure what you're referring to with 'it' (?)

I didn't want to dilute the discussion of the Pale Moon/Firefox transition with talk of other browsers, but Opera (the original Opera) did not work successfully as a browser. It was based on their proprietary browser engine, Presto, and when users clamored for extensions to functionality, they were shot down. And down also went their popularity and, some would say, their usefulness.

So, there was much grumbling among the Opera devs regarding their browser was dying. The radical decision was made to move Opera to the WebKit browsing engine. Oh, yay. Another Chrome-like browsing experience...except without the Chrome-like extensions. Let's make a browser like Chrome & take everything that users love about Chrome...and not use those parts.

Vivaldi is written by the Opera devs who did not agree with moving to the WebKit browsing engine. However, they must have all flunked History class, because they are ignoring the age-old wisdom that those who ignore the past are doomed to repeat it. Take the paragraph above I wrote about Opera and Presto, but substitute Vivaldi for Opera and Blink for Presto, and boom! You're accurately predicting the future even better than Nostradamus did.

Yes, there's a huge demographic of people who browse the internet who do not care if their browser doesn't offer any extensions or do not want their browser to use extensions. They are called IE users.

[NigelH]

I'll "dilute" the thread somewhat further.
Innuendo speak for yourself and a couple of million others (not that quantity counts for much - a number of fast food chains are evidence of that). As far as I'm concerned, its the very same demographic that you alluded to.

Opera 12.17 is still my main browser and I know there are still many other users - even of earlier versions like 12.14.
Its performance (Javascript aside) and fantastic usability (ESPECIALLY) make me cringe big time when I use other browsers.
I switch out of it only when I run into the occasional Presto rendering problem.
Yeah, problems happen but I have rendering (or other) problems with current releases of both Chrome and Firefox browser
implementations so nothing new there.

The team who developed Opera where IMO a little more talented than most of the devs who now work on the crud known as Chrome and Firefox (especially of late wrt Firefox).

Palemoon and Slimjet remains my other alternatives - but only when I have no alternative.

So, can the devs at Vivaldi pull it off?
I hope so, otherwise for me all hope is lost - especially with Palemoons somewhat uncertain future.
Opera failed, not in and of itself, but because of senior management failure.

[xtabber]

I didn't want to dilute the discussion of the Pale Moon/Firefox transition with talk of other browsers, but Opera (the original Opera) did not work successfully as a browser. It was based on their proprietary browser engine, Presto, and when users clamored for extensions to functionality, they were shot down. And down also went their popularity and, some would say, their usefulness.

So, there was much grumbling among the Opera devs regarding their browser was dying. The radical decision was made to move Opera to the WebKit browsing engine. Oh, yay. Another Chrome-like browsing experience...except without the Chrome-like extensions. Let's make a browser like Chrome & take everything that users love about Chrome...and not use those parts.

This is very confused and mostly wrong.

Opera was always at the forefront of browser innovation and a lot of their features were copied by the big guys.  The problem they faced is that it required simply too many resources for a relatively small company to compete with the big guys (Microsoft, Google, Mozilla, Apple) and they did not have the clout to get their cross-platform Presto engine considered in the adoption of standards.

What they did was to stop development of Presto (which remains licensed to other software companies and apparently still maintained on various platforms) and start building a new browser based on the Chromium Blink rendering engine that powers the Chrome browser and is developed and maintained by Google.  This allows Opera to spend their own resources on browser UI while keeping up-to-date on security and standards, courtesy of Google's vastly greater resources.

I've used Opera since 2000 and loved many features that have yet to be added to the Chromium version, but there is no doubt that the company made the right decision to survive.  I've been using the Chromium Opera for about a year now and even though it still has some rough edges, it has become my favorite browser for Web surfing, although Firefox is still my default for many purposes, particularly if they involve printing or page capture.

I'd guess that the Mozilla Foundation is also taking a hard look at the future and that their announced plans, while upsetting to many of us who depend on current Firefox extensions, are part of a strategy they hope will keep them around for the next decade. Given the power wielded by Microsoft, Google and Apple, that's probably the only way to go for most independents.

[Innuendo]

This is very confused and mostly wrong.

Opera was always at the forefront of browser innovation and a lot of their features were copied by the big guys.  The problem they faced is that it required simply too many resources for a relatively small company to compete with the big guys (Microsoft, Google, Mozilla, Apple) and they did not have the clout to get their cross-platform Presto engine considered in the adoption of standards.

You (along with NigelH) had very different experiences with Opera than I did. I tried Opera numerous times over the years & every time I did the web sites I visited never rendered properly. I loved what they were trying to do on some fronts, but their refusal to open up to extensions/add-ons and the inability to render the web sites I visited rendered it not a viable alternative for me...or my friends. One friend held on to the dream of Opera longer than most of us, but he was often having to switch to another browser to accomplish what he was trying to do on a lot of web sites he frequented.

The original Opera's market share was abysmal even at its heights. As talented as their programmers may have been, the general public at large did not share their vision. I'm sure there were a lot of people who shared the experience of their web sites not rendering correctly in Opera as well.

And if Opera's biggest failing was the mismanagement of senior management, what chance does Vivaldi stand when it was founded by Opera's CEO, the most senior management member? I'm going to try out Vivaldi once it hits 1.0...I don't want any failings of the technical previews to possibly color any opinions I might form about it.

But to swing this back on-topic, not having the clout is what I'm worried about for Pale Moon, but the second beta of their Goanna engine works remarkably well for being as early in the development process that it is. It's going to be interesting to see how a Firefox fork can exist when (eventually) the extensions dry up.

As for Vivaldi, it's got a lot of work ahead of it if it is going to become the "advanced browser built with power users in mind" that it's advertising itself as. Although, I now see that Vivaldi supports Chrome add-ons as well.

Maybe that's what Pale Moon will need to do in order to move forward as well? Regardless, I guess it may be time to start seeing if my favorite Firefox extensions have Chrome equivalents.

[JavaJones]

I haven't looked into this *at all*, so pardon my ignorance. But why can't the Pale Moon (and other branch) developers fork from a newer dev branch and re-make whatever changes are needed to make Pale Moon what it is? Maybe that's no easier than maintaining their own rendering engine... but given the challenges other bigger companies doing their own browser engines have run into, I doubt it's easier to go that route than to simply do a new fork. After all Pale Moon is basically about removing all the social connectivity and updated UI BS, right? How hard can it be to do that stuff to newer Firefox?

Once again I apologize if this is an idiotic question.

- Oshyan

[f0dder]

To further the divide between the Firefox and Pale Moon browsers, the Pale Moon team has decided to abandon the Gecko engine and develop their own, code-named Goanna. This holds numerous advantages for them moving forward. However, this is more code that they will solely be responsible for to ensure that no vulnerabilities crop up in the code.

What could possibly go wrong? It's not like as if a browser engine is one of the most complicated pieces of general software...

Last, but certainly not least, is a change that may very well be a devastating blow for the browser. Mozilla has declared that extensions will no longer be supported by Firefox in the future and the browser will be moving to a model that exclusively supports Chrome add-ons.

I assume this only relates to extensions and not Add-ons, since I hadn't heard about it - and if that's the case, it's a good move. The NPAPI should have been dragged out back and buried many years ago. It's pretty darn unsecure, and has mostly been used as a malware infection vector for the last many years. Good riddance!

If they're getting rid of FireFox specific Add-ons, though, it's time for pitchforks and torches.

[Innuendo]

Once again I apologize if this is an idiotic question.

Definitely not an idiotic question! What you suggest is a way to go for developers of forked versions, although it would reset the code base to zero & they'd have to re-integrate all of their tweaks and changes. Another thing using the ESR source code would do is reset the clock on deprecation of the code to zero...but the clock would still be there. In 18 months' time the current ESR code base will be deprecated and we'll be right back to where we are now...except by then the main Firefox line of development will be on Chrome add-ons only.

Opera, as a browser, never worked well for me, but for a lot of people it did & it must have upset quite a few people to be forced to leave something behind that worked the way they worked because running an out-dated browser is running an insecure browser.

[Innuendo]

I assume this only relates to extensions and not Add-ons, since I hadn't heard about it - and if that's the case, it's a good move.

I'm hoping you're right, but you most certainly can't tell by reading any of Mozilla's announcements or blogs on the subject. Apparently extensions are extensions and add-ons are add-ons, but extensions are add-ons, too & they use the words extensions/add-ons interchangeably.

I'm hoping your line of thinking is correct, but even then, Mozilla has something coming called "Electrolysis" that's going to turn proper add-ons on their ear in the future.

[JavaJones]

What you suggest is a way to go for developers of forked versions, although it would reset the code base to zero & they'd have to re-integrate all of their tweaks and changes.

Yes, that's what I figured. The question is whether doing that is more work than, er, developing and maintaining their own rendering engine. I suspect it is *less* work, probably by a fair margin. But I am not involved in the project, I don't know what they've done code-wise, so I can't say with any authority. It seems to me though that their fundamental development model needs to be evaluated in light of this ESR expiration issue. The option they provide is useful and appealing for a number of people, so it's clearly worth them continuing to make it available for the long-term if possible. They need a sustainable way to do that, not just for the next 6 months or year or 18 months but for the next 5+ years if possible.

- Oshyan

[TaoPhoenix]

...Slimjet

I just looked at Slimjet and *immediately* un-installed it!

I went looking at "settings" and it had "history" of the last fifteen days of my local machine activity!

Browsers are not supposed to know what your local machine is doing!


So to me that's almost a cousin to a Trojan Horse! Because if it knows all that, then I would quite easily believe it could be sent somewhere! It could be close to RansomWare if you're not careful!

[TaoPhoenix]

I'm hoping your line of thinking is correct, but even then, Mozilla has something coming called "Electrolysis" that's going to turn proper add-ons on their ear in the future.

Can you say more about this means?

[TaoPhoenix]

What you suggest is a way to go for developers of forked versions, although it would reset the code base to zero & they'd have to re-integrate all of their tweaks and changes.

Yes, that's what I figured. The question is whether doing that is more work than, er, developing and maintaining their own rendering engine. I suspect it is *less* work, probably by a fair margin. But I am not involved in the project, I don't know what they've done code-wise, so I can't say with any authority. It seems to me though that their fundamental development model needs to be evaluated in light of this ESR expiration issue. The option they provide is useful and appealing for a number of people, so it's clearly worth them continuing to make it available for the long-term if possible. They need a sustainable way to do that, not just for the next 6 months or year or 18 months but for the next 5+ years if possible.

- Oshyan

Take a look at this Release Notes because I just got the latest update from PaleMoon.
http://www.palemoon.org/releasenotes.shtml

They seem/say to try to do a lot more than "just remove the tracking" - they've tried to tighten Firefox's original (bloated?) code to become a better browser. So if that page is only *six months* of fixes, FF24 is what, like three years ago? And goodness knows what *new* junk FF has been adding they will want to go fix and take out.

So I'd say the whole Browserland is getting murky!


(Memo - you'd think software devs would know the differences between Extensions and Add-Ons, so if their blogs are that ambiguous, what does that mean in the whole scheme of things? And what does the intersection of this "Electrolysis vs moving stuff to Chome-like mean?)

[wraith808]

...Slimjet

I just looked at Slimjet and *immediately* un-installed it!

I went looking at "settings" and it had "history" of the last fifteen days of my local machine activity!

Browsers are not supposed to know what your local machine is doing!


So to me that's almost a cousin to a Trojan Horse! Because if it knows all that, then I would quite easily believe it could be sent somewhere! It could be close to RansomWare if you're not careful!

If it immediately had it, then it retrieved it from your local machine, not what it was personally collecting, no?  So the information is there, and it just accessed it.  So even after you uninstalled, it's still there.

Just food for thought.

[TaoPhoenix]

If it immediately had it, then it retrieved it from your local machine, not what it was personally collecting, no?  So the information is there, and it just accessed it.  So even after you uninstalled, it's still there.

Just food for thought.

I was a bit unclear, I meant it didn't delete anything, but now it has a list of stuff which roughly looked to be recently added files. So I have to assume that list of files is floating around out there. Nothing the end of the world, but I can see if it was allowed to stay it would get more and more. So I presume for example it doesn't have today's info. But boring web browsers shouldn't be doing that.

But I can see if someone had a juicy file name, that can drift into bait for ransomware, which we just saw recently in a couple of articles.

[JavaJones]

If the Pale Moon changes are things that the Mozilla org doesn't want contributed back to trunk, then fair enough. That's a shame though as if their changes really are "improving the code", they really should be contributed back. But if not, at that point they're really just maintaining their own browser and should no longer rely on Mozilla security fixes. They can watch Firefox latest changes/fixes and do eval of their own code for whether it applies, so the FF fix log still gives them a leg-up on potential improvements to their own code, especially if the FF team fixes a legacy issue. But bottom line the choice they made in how they dev this thing is making their workload what it is. I can't imagine them successfully adding the development and maintenance of their own rendering engine on top of that.

- Oshyan

[wraith808]

If it immediately had it, then it retrieved it from your local machine, not what it was personally collecting, no?  So the information is there, and it just accessed it.  So even after you uninstalled, it's still there.

Just food for thought.

I was a bit unclear, I meant it didn't delete anything, but now it has a list of stuff which roughly looked to be recently added files. So I have to assume that list of files is floating around out there. Nothing the end of the world, but I can see if it was allowed to stay it would get more and more. So I presume for example it doesn't have today's info. But boring web browsers shouldn't be doing that.

But I can see if someone had a juicy file name, that can drift into bait for ransomware, which we just saw recently in a couple of articles.

I wasn't talking about deleting anything. I was talking about the fact that if you installed it, and it immediately had this list, it just culled it from your OS.  It didn't cultivate this list itself.  It was just revealing what was there.

[Innuendo]

Can you say more about this means?

Tao, you can read a Mozilla blog entry here that talks about WebExtensions, Electrolysis, and the road ahead. They have huge aspirations and say it will make for a better browser. Time will either prove them right or wrong. Not everyone at this point shares their opinion.