Worth noting that at this point, it's still somewhat trivial to find exploitable remote code execution bugs in Ladybird using AI tools.[0]
The userbase of Ladybug users is so small that it's probably not worth the attackers' time, but keep in mind that it's an enormous step down in security from the mainstream browsers who are actively searching for bugs using the latest tools and paying bug bounties on external reports.
This post reminded me of gaming emulator updates that I also love to read. "Fixed X bug to make Y behave correctly, which means game Z works now." (One of the things they fixed was CSS Doom, so I guess there is some legitimate overlap to gaming at any rate.)
Good call! I’ve heard Andreas say multiple times building a browser is like building an emulator. Each website uses different features in different ways, and he likens websites to roms.
There is a difference tho between being'pretty usable' and actually being usable with your passwords, data and just being reliable enough for everyday.
I think the gap between having nothing to having a prototype is way smaller than between having something 'pretty usable' and something that is usable.
If you want to use no-Javascript browser as well, this browser prototype [0] is getting pretty good too. It's developed by Dioxus, a GUI framework in Rust, as part of its native renderer which seeks to create their own alternative to Skia, similar to Flutter, but it'll work on the web as well with HTML and CSS standards unlike Flutter web which is just a canvas.
It's also a from scratch implementation, sort of, using existing Rust crates like stylo (which servo also uses) and taffy, but it doesn't rely on any code from existing browsers such as Chromium, Gecko or WebKit.
This is great. I'm building a site that has JavaScript but is fully functional without it, this would be fun to see how it renders it. I use htmx, AlpineJS and Vanilla JS just for additional help for users with forms and search but works fine without it. Thanks for sharing this.
I will recompile ladybird too. Last time it had made great progress but was no where near read for regular use.
The hardest part for browser development has always been "artificial" web compatibility, as you know a lot of websites are forcefully blocking specific browser from loading, only allow Chromium to load their websites, that is the reality check for Ladybird, and seriously what stopping new web browsers from being able to compete, same with DRM Widevine, it's REALLY hard to acquire (unobtainiumware) for new browser, even big browser like Zen Browser with 10M users failed to acquire it
They can mock the User Agent for the purposes of compatibility testing. When you control the browser itself, nothing's impossible. (aside from DRM specific issues)
How common is this that they would even care about it anyways? I've run Firefox exclusively for the last 2 decades and have never once run into a site that told me I needed to switch to Chromium for compatibility.
And honestly, I've only ever once encountered a website that required Widevine. And that site was a media site. So if you don't watch DRMed movies in your browser then you don't need Widevine in my experience.
I've found widewine a blessing because news sites that autoplay trash seem to be the only group that uses it (other than paid media platforms like Netflix and Spotify).
The blessing is I can just reject it and it blocks all their videos from playing/downloading.
Common enough that Mozilla has full-time engineers working on triaging compatibility issues, so they can either be fixed in Firefox or reported to webmasters. Here are the reports they get: https://webcompat.com/issues
I've never had one tell me; they just don't work, or they get stuck in a loop until they consume all my RAM and the gecko engine crashes. That is, assuming they even show me the page, instead of telling me to go away because they they think I'm a bot.
A few years ago I was maintaining the website for a major brand whose products you probably use. To my horror the website did not support Firefox. I gave them a very minimal estimate on what it would cost to support Firefox along with the estimated percentage of Firefox users in their target market. They were not interested.
I actually ran into such issues, in particular with commercial websits. Some browsers I use do not work for my online transactions for instance - annoyingly the local bank I use for logging into my account as well. It is basically the bank hijacking my money and forcing me into using a specific browser (or, at the least, very few; they improved compatibility a bit in the last years, but there were more issues in the past here). It is just a reality of the situation that some websites don't work well on certain browsers.
I switched bank in 2021 and it was hard. No bank advertises "we do compliant chip tan" and no bank advertises "we do not buy an app framework that scans for customs roms".
Switching banks is hard, because all of them suck, are underdocumented and a moving target.
I suppose today it is more difficult. At the time I only had to get a guarantee from the bank that they support Firefox in addition to IE. Getting that guarantee did take them a week, and only happened because I found a sympathetic bank manager who was willing to pressure them on my behalf.
In the past Vivaldi used their own user agent string and they ran into a bunch of issues. And they are a chrome derivative! They had to default to the chrome user agent. Here are the examples they cite in their announcement of the decision:
"On Google.com if you present a Vivaldi user agent and arrive via a redirect, the search text box will be misaligned
On Google Docs if you present a Vivaldi user agent you will receive a warning
On Facebook’s WhatsApp web interface if you present a Vivaldi user agent, you cannot enter the site and are advised to switch to one of our competitors
On Microsoft Teams (chat and collaboration website), presenting a Vivaldi user agent will stop you from being able to use the website
On Netflix, presenting a Vivaldi user agent results in a suggestion to install Silverlight to play videos… yes… really… Silverlight!"
When these mega-companies block new competitors it really ought to be seen as collusion. Google, Facebook, and Microsoft certainly have the resources to test and approve the occasional new browser.
They don’t even have the resources to test the most common browsers on every scenario of every page of every application, let alone fix every issue such testing would find.
Your experience may be different, but every time I hit the Cloudflare "checking if your connection is secure" turnstyle, it goes into an infinite loop on Firefox. It's the only reason I still have Chrome on any personal device. It may be tracker and privacy settings rather than just Firefox on its own, but I'm not going to run combinatorial experiments to figure out exactly what Cloudflare is looking for, especially since it's probably a moving target.
Not for every YouTube Premium subscriber in populated areas of California with decent internet connections watching popular videos, even with a userscript automatically selecting highest quality. Always instant, zero wait, very few exceptions.
It’s non-Google sites where Firefox may not be as well supported as Chrome, IME.
How so? I use Firefox for all leisure activities, including extensive YouTube usage, and have never noticed any issue. I’m running uBlock Origin and Sponsor Block. I’m logged into a dedicated Google account I made solely for browsing YouTube (so I can keep the viewing history without linking it too obviously to my main Google account).
Page load takes twice as long as Chrome, videos buffer more slowly, and memory usage grows much faster. After a dozen tabs it starts visibly lagging when you press play/pause, the exact same session works flawlessly in Chrome.
It doesn't seem to affect everyone equally. Pretending to be Chrome sometimes helps - not too long ago someone found a piece of code that introduced seconds of busy delay for any non-Chrome user agent.
A lot of systems seem to silently fail on Firefox - my broadband supplier's website failed at the last step of the onboarding process. I managed to get charged for installation (connection by the network operator, UK) twice, have onboarding emails sent, but not have the appointment in my account.
Used Edge, went through completely.
Can't guarantee it was Firefox/browser issues. But this is not that uncommon an occurrence.
To get to the point where these artificial gates substantially matter for interop, you've already cleared 99% of the hurdles, and you can get away with just spoofing the User Agent string most of the time.
Widevine is legitimately a “gate”, but realistically it only stops 4K playback on Netflix, Disney and a few other streaming sites. And it's not super relevant considering that Zen has gathered 10M users without it.
easy choice. also, thats just BS, remember how SOMEHOW the same was said for playback of music on computers, yet somehow a certain now-dead CEO was able to say "fuck you" and it happened anyway?
That was part of the deal with Apple the record company because otherwise Apple the computer company would infringe on their trademark. The Steves could have renamed their company or taken the deal. They took the deal.
Unfortunately a whole new generation failed to learn the IE lesson, and are the first to complain when others don't follow the Chrome OS Platform wishes.
Hmm, I haven’t used a single website in a long time that forces a Chromium-based browser to operate. The only exception I know of is DocuSign requiring a Chrome extension. And, of course, plenty of websites are laggy on Safari.
Ladybird, at least initially, will be niche enough that I think this won't be a problem. It'll be tech enthusiasts who use multiple browsers. If it can get a foothold, then I think there will be many more bars to clear.
Ladybird is coming along so well. I am a long-term Firefox user and I'll definitely be an early adopter of Ladybird when it enters very early alpha and precompiled builds start being released.
BTW if you want to kick the tires at the current stage, building it locally is easy, just a couple of commands to install dependencies and run the build script:
Maybe it uses some that battery API as a heuristic for a lower-power version of the site? Or maybe they have a web-only version in developing markets? Low battery means it should query for your location less often to save battery?
Totally spitballing here. Strava being a website that requests battery does not seem wildly outlandish to me, albeit it is a bit suspicious in general.
> it uses some that battery API as a heuristic for a lower-power version of the site?
As a naive user I would expect websites to not be able to receive information about my battery state. With that information they can track my mobile phone usage pattern, and with some cross-referencing gain even more specific private information.
Strava's a route tracker. Assuming you can use it through the website, it probably controls how often it polls location, trading off accuracy for power consumption.
I thinkk it's about time Ladybird got some official prebuilt binaries - I'd love to try it, but I'm not going to install its whole dev environment and build it from source.
I managed to build this the other day. Looking good!
As noted by other authors, there does seem to be a wide surface area for attacks so, security remediation does seem to be a top-of-queue thing to be handled.
They block all ads in current builds. Probably mostly more performance and to create more consistency when testing a website (not having to worry about errors from lots of low quality JavaScript in the ads).
To whoever had the evangelion r/unixporn as a way to test out ladybird reddit. I respect you so much as I really liked reading about evangelion (I haven't watched it as much BUT I have watched countless documentaries explaining it and had evangelion as my wallpaper for sometime)
Now coming to the point, the fact that reddit is working in ladybird sounds crazy good, I am not sure if youtube is working or not but I hope that youtube works too and Ladybird sounds to really work.
Also, thanks to https://jakubsteplow.ski/ for donating the money to ladybird. I mean I would like to actively promote people who donate to open source projects as a better way than what google ads or others too and jakub I wish you nothing but the best and I hope other people donate to projects like ladybird too (Independent donors/donations), also thanks to human rights foundation https://hrf.org/program/ai-for-individual-rights/
It's amazing how browsers had an almost mono/(duo or trio?)-poly yet it took a single guy to do all of this. Its really inspiring.
I love EVA, but I’ll cautiously recommend it. I feel like there are two sides to it: the mecha/alien/monster sci-fi side which has an amazing aesthetic, and the personal drama focusing on self loathing and loneliness. I think the first side is the most attractive to most people, but what really sticks with me to this day is the latter.
If you do end up watching I have to warn about the watch order. There are two timelines, the original TV series plus the movie “End of Evangelion”, and then the “Rebuild of Eva” movie series which started as a complete reboot but somehow ended as the ultimate Reboot/Remake/Sequel to the original stuff.
I understand, I had started watching these evangelion summaries thinking oh cool robots but then, I have been aware of the loneliness and other things within the series which were thought-provoking but also not really at the same time. I
I don't watch much anime (shocking within my generation which seems to be anime-driven?) but ironically I have also watched berserk's golden age arc also because of an edit that I had watched before all the horrificness is revealed but that's the reason why I haven't really read more about berserk other than the golden age.
Yu-Yu-Hakusho, death note, AOT and bersek/(evangelion? Only watched documentaries explaining it) are the only series that I have watched/listened about a lot in this sense I suppose.
With berserk and evangelion, perhaps there is something about the style of both of these, both lure you in with a particular sense of art but both have some aspects of darkness hidden beneath the pages.
There is something about first discovering it even knowing through comments that things would turn south but I still decided to watch berserk because it so captured my attention. I wished for it to be a bland piece where things turn happy ever happily but I think that berserk's decision to not do is somewhat fascinating too. maybe the lure to watch these increases knowing the fact that these aren't just single dimensional things but rather multi dimensional with deeper topics.
Evangelion with concepts like loneliness and I would associate berserk with pain and hope (hope to still fight even after so much pain)
Edit: should probably mention Its late night and I should probably sleep and I didn't really intend to send this message, I sometimes write somethings and don't send them (but save them for myself to read in documents)* because I find that I think deeper about something during this and I accidentally pressed enter, thanks for reading this but I am sure that I might not be able to give my viewpoint away but I am grateful that you read till the end. Looks like the world wanted me to send the message so I did :-D
Both are great shows made by GAINAX, but I highly watching suggest their prototypes as well: Gunbuster and Diebuster. All four are great Mecha shows made by the same studio and it's fun spotting the similarities across all of them.
What I consider to be a spiritual successor to these GAINAX mecha shows was the most recent Gundam series "Gquuuuuux" which shared many staff members from them and has plenty of homages that were fun to spot! Also had the same mechanical designer as the Evangelions so I got a kick out of that.
It's subtle but they aren't the same. The list makers are now to the right of the text entries as they should. But it's hard to see because it's somewhat hidden by the glaring issues the rest of the page still has.
Too bad LadyBird is being translated to LLM generated Rust.
It's nice that Rust is so beginner friendly but it would be nicer to have a pure C++ browser for the more experienced developers, to use as a basis for their projects like Chromium is used.
I’d rather have a good browser which took its time to get things right than a speed run one.
Too much software is written like that, and the result is that most things are shit. What are we in such a hurry for? To get more time to work more? Fucking chill. Do things slowly and right.
As a side thought, speed running seems like the wrong analogy for software. Speed runners in games are people who spend a ton of time doing the exact same steps over and over to find tiny optimisations and develop muscle memory to do something repeatable. They take the time to do it well. Being a good speed runner means embracing slow progress. It’s the antithesis of software, where rushing to get it out also means you barely look at it. You do it fast but seldom right.
Your argument is so removed from the point, it’s an entirely different conversation.
I already contribute time and code to open source projects, and I promise you’ll have heard of some of the things I contributed a lot to. That’s beside the point.
This is like saying “I’d prefer if doctors took their time with patients to understand their cases and provide meaningful accurate resolutions to ailments instead of rushing” and you replying with ”oh yeah, are you willing to contribute with medicine and triage?”.
I think there's a balance to be struck between code quality and delivery speed.
GNU Hurd is a well known example where they spent a so much time on getting the code right that the project became irrelevant. And of course you made the case for erring on the "too much code too quickly" side
The comment I responded to talked of “speedrun” and “full speed ahead”. That’s the antithesis of balance.
The point you’re making is valid but has no bearing on the current conversation. GNU Hurd is also an extreme case, the overwhelming majority of software suffers more from being rushed than from being so slow it becomes irrelevant.
Blink is derived from WebKit, so is in the same family like the other Blink/WebKit derived browsers. Fireox/Gecko is a different browser implementation.
In my opinion, Chromium has already filled that market.
I actually think Ladybird should lean into Rust more so it can compete on speed but still stay safe and friendly to contributors (as hopefully the compiler will prevent most bugs).
My hope is this will help them compete with tenets of "safe, fast, contributor-friendly and NOT owned by a corporation"
> Human Rights Foundation ... “AI for Individual Rights” program
That sounds quite dodgy. Ladybird doesn't have AI, why would such a program support its development?
But even before that: "Human Rights Foundation" sounds like "The Human League" which George makes up in Seinfeld as a fake charity. And promoting AI as a "human right" is quite suspicious. If I had to, I might be that this is something backed by one of the corporations burning through Billions of dollars and Gigawatt-hours on LLMs.
Looking at their annual report summaries and their huge staff, my guess slants a bit towards either bodies like the CIA or some ideologically-motivated billionaires (e.g. talk about the "dictator Maduro", focus on Iran etc.)
What, do you sincerely believe Palantir is pulling the strings behind Ladybird? What is the accusation here? Everybody can be "connected" in some way or another, but it's meaningless.
I think it's more a concern about the company one keeps; Ladybird's Andreas Kling has certainly ruffled feathers over the past couple of years by doubling down on anti-inclusionary language takes ("I'm not against gender neutral language, I'm just not going to allow it in my project") and supporting DHH's most douchebaggiest takes.
I understand that not everybody cares about this sort of thing, believing that politics of developers should be irrelevant; I'm personally not going to go around ringing the shame bell at people who use Ladybird (or Rails. But Kling loudly shouting "I support the free speech rights of fascists but get away from me with that DEI shit" doesn't give me warm fuzzies about using Ladybird, either. It's a lot easier to let politics of developers be irrelevant if the developers aren't out there energetically sharing them.
It's very naive to believe the "no influence" part. I will never give to Ladybird given their closeness with fascists. Is that the kind of influence they expect?
To be clear, that source is happy to lie about their own identity and run away from basic questions. I'd treat this as another ill-baked cancel campaign unless someone actually credible speaks up
I've never understood that stance because surely the mere threat (even implied) of a sponsor removing thousands in funding would be enough to exert influence on the project.
The sponsor money is used to pay developers to work on Ladybird so a major sponsor pulling out could mean laying off core developers, which the project would obviously be motivated to prevent.
Interesting, I've checked the LinkedIn link of Jakub Stęplowski, a software developer proudly presenting himself as "from Poland" - 10 years of working outside of Poland in Italy and Switzerland. Yep, that checks out. I was wondering where he could have gotten $1,000 to generously burn on this project as a sponsor, with Polish salaries.
Nothing bad about it, of course. It's just it's long time overdue to move to Switzerland as well, I see.
There was a developer who I worked with at a mortgage company who had moved to the UK from Czech Republic. He would sit at his desk playing games on his phone all day and had outsourced his entire job to his friend back home for 25% of his UK salary.
So basically, it will be useless. How many use epiphany please? That thing has been so extremely ineffective. It's like 1999 (not that everything was bad in 1999).
> follows GNOME’s design guidelines: no menubar, a hamburger menu
Oh. my. god.
So Ladybird worships uselessness now. Also, GTK progressively gets worse and with GTK5 they will (try to) kill of xorg-server too. Some people disagree with that - https://github.com/X11Libre/xserver and https://git.devuan.org/Daemonratte/gtk2-ng; I get it that there are not that many folks using that, but the point is that the GNOME corporate mindset has a tiny bit of competition. Perhaps that seed of competition grows over time until the corporate gnomeys have to change course (won't happen, as they are paid to abolish what is "old", but more competition is good, if only to try to "reason" with mr. ebassi and other hardcore gnomeys; sadly KDE also goes that way with wayland-only, thanks to anti Robin Hood Nate and his donation-pester daemon. Oldschool KDE devs didn't waylay people for money, now it is "pay or get nagged", thanks to Natey Nate).
We kind of need competition in the browser landscape, so in some ways having Ladybird is good. I don't really have much hope that ladybird will be able to challenge the evil Google empire though. But perhaps more people realise that Google controlling so much of the www-ecosystem (again, just look at how they nerfed google search in the last years) is a huge problem.
I like the approach of ladybird to provides as many native chrome as possible it gives peoples choice and let the browser feel native in whatever DE they choose to use :)
Is pdf.js the renderer that VSCode uses? You know, the one where everything becomes extremely blurry when you zoom in for absolutely no reason at all except (I would imagine) developer incompetence?
I don't want to dampen the positive vibes around this project in any way, in fact I'm very glad such projects exists. But it just struck me that my immediate associations with the "non-profit" label - which in this project's context is clearly being positioned against Mozilla's for-profit subsidiary, the Mozilla Corporation - don't quite match reality. Even though it is indeed a non-profit, the website features a not exactly short listing of sponsors, including platinum-tier sponsor Cloudflare.
Platinum, per Ladybird's own sponsorship page, means $100,000+ per year. Money that, per the site, comes from "just people and companies who believe in an open web." Cloudflare, then.
Sure and Mozilla is arguably the cautionary tale here. They also started as a non-profit taking donations. AOL seeded them with $2M, Red Hat and Sun pitched in too. Within a year they had the Google search deal. By 2006, ~92% of revenue came from Google.
Worth noting that at this point, it's still somewhat trivial to find exploitable remote code execution bugs in Ladybird using AI tools.[0]
The userbase of Ladybug users is so small that it's probably not worth the attackers' time, but keep in mind that it's an enormous step down in security from the mainstream browsers who are actively searching for bugs using the latest tools and paying bug bounties on external reports.
[0] https://blog.calif.io/p/mad-bugs-rce-in-ladybird
It looks like this is getting pretty usable!
This post reminded me of gaming emulator updates that I also love to read. "Fixed X bug to make Y behave correctly, which means game Z works now." (One of the things they fixed was CSS Doom, so I guess there is some legitimate overlap to gaming at any rate.)
Good call! I’ve heard Andreas say multiple times building a browser is like building an emulator. Each website uses different features in different ways, and he likens websites to roms.
There is a difference tho between being'pretty usable' and actually being usable with your passwords, data and just being reliable enough for everyday.
I think the gap between having nothing to having a prototype is way smaller than between having something 'pretty usable' and something that is usable.
If you want to use no-Javascript browser as well, this browser prototype [0] is getting pretty good too. It's developed by Dioxus, a GUI framework in Rust, as part of its native renderer which seeks to create their own alternative to Skia, similar to Flutter, but it'll work on the web as well with HTML and CSS standards unlike Flutter web which is just a canvas.
It's also a from scratch implementation, sort of, using existing Rust crates like stylo (which servo also uses) and taffy, but it doesn't rely on any code from existing browsers such as Chromium, Gecko or WebKit.
[0] https://github.com/DioxusLabs/blitz (in /apps/browser)
This is great. I'm building a site that has JavaScript but is fully functional without it, this would be fun to see how it renders it. I use htmx, AlpineJS and Vanilla JS just for additional help for users with forms and search but works fine without it. Thanks for sharing this.
I will recompile ladybird too. Last time it had made great progress but was no where near read for regular use.
The hardest part for browser development has always been "artificial" web compatibility, as you know a lot of websites are forcefully blocking specific browser from loading, only allow Chromium to load their websites, that is the reality check for Ladybird, and seriously what stopping new web browsers from being able to compete, same with DRM Widevine, it's REALLY hard to acquire (unobtainiumware) for new browser, even big browser like Zen Browser with 10M users failed to acquire it
They can mock the User Agent for the purposes of compatibility testing. When you control the browser itself, nothing's impossible. (aside from DRM specific issues)
How common is this that they would even care about it anyways? I've run Firefox exclusively for the last 2 decades and have never once run into a site that told me I needed to switch to Chromium for compatibility.
And honestly, I've only ever once encountered a website that required Widevine. And that site was a media site. So if you don't watch DRMed movies in your browser then you don't need Widevine in my experience.
I've found widewine a blessing because news sites that autoplay trash seem to be the only group that uses it (other than paid media platforms like Netflix and Spotify).
The blessing is I can just reject it and it blocks all their videos from playing/downloading.
Common enough that Mozilla has full-time engineers working on triaging compatibility issues, so they can either be fixed in Firefox or reported to webmasters. Here are the reports they get: https://webcompat.com/issues
I've never had one tell me; they just don't work, or they get stuck in a loop until they consume all my RAM and the gecko engine crashes. That is, assuming they even show me the page, instead of telling me to go away because they they think I'm a bot.
A few years ago I was maintaining the website for a major brand whose products you probably use. To my horror the website did not support Firefox. I gave them a very minimal estimate on what it would cost to support Firefox along with the estimated percentage of Firefox users in their target market. They were not interested.
Best to avoid talking percentages, talk the specific cost to fix the bugs vs the specific amount of lost profit.
I actually ran into such issues, in particular with commercial websits. Some browsers I use do not work for my online transactions for instance - annoyingly the local bank I use for logging into my account as well. It is basically the bank hijacking my money and forcing me into using a specific browser (or, at the least, very few; they improved compatibility a bit in the last years, but there were more issues in the past here). It is just a reality of the situation that some websites don't work well on certain browsers.
Why don't you consider switching banks? In 2008 I had to switch bank for exactly this reason.
I switched bank in 2021 and it was hard. No bank advertises "we do compliant chip tan" and no bank advertises "we do not buy an app framework that scans for customs roms".
Switching banks is hard, because all of them suck, are underdocumented and a moving target.
I suppose today it is more difficult. At the time I only had to get a guarantee from the bank that they support Firefox in addition to IE. Getting that guarantee did take them a week, and only happened because I found a sympathetic bank manager who was willing to pressure them on my behalf.
In the past Vivaldi used their own user agent string and they ran into a bunch of issues. And they are a chrome derivative! They had to default to the chrome user agent. Here are the examples they cite in their announcement of the decision:
"On Google.com if you present a Vivaldi user agent and arrive via a redirect, the search text box will be misaligned
On Google Docs if you present a Vivaldi user agent you will receive a warning
On Facebook’s WhatsApp web interface if you present a Vivaldi user agent, you cannot enter the site and are advised to switch to one of our competitors
On Microsoft Teams (chat and collaboration website), presenting a Vivaldi user agent will stop you from being able to use the website
On Netflix, presenting a Vivaldi user agent results in a suggestion to install Silverlight to play videos… yes… really… Silverlight!"
(https://vivaldi.com/blog/user-agent-changes/)
When these mega-companies block new competitors it really ought to be seen as collusion. Google, Facebook, and Microsoft certainly have the resources to test and approve the occasional new browser.
They don’t even have the resources to test the most common browsers on every scenario of every page of every application, let alone fix every issue such testing would find.
Big if true
Your experience may be different, but every time I hit the Cloudflare "checking if your connection is secure" turnstyle, it goes into an infinite loop on Firefox. It's the only reason I still have Chrome on any personal device. It may be tracker and privacy settings rather than just Firefox on its own, but I'm not going to run combinatorial experiments to figure out exactly what Cloudflare is looking for, especially since it's probably a moving target.
YouTube is crippled in Firefox, has been for years. It doesn’t force you to use Chrome, just a little nudge
In what way is it crippled?
Takes forever to load anything
Not for every YouTube Premium subscriber in populated areas of California with decent internet connections watching popular videos, even with a userscript automatically selecting highest quality. Always instant, zero wait, very few exceptions.
It’s non-Google sites where Firefox may not be as well supported as Chrome, IME.
I use YouTube on Firefox (with uBlock Origin) almost exclusively and this has not been my experience.
How so? I use Firefox for all leisure activities, including extensive YouTube usage, and have never noticed any issue. I’m running uBlock Origin and Sponsor Block. I’m logged into a dedicated Google account I made solely for browsing YouTube (so I can keep the viewing history without linking it too obviously to my main Google account).
Page load takes twice as long as Chrome, videos buffer more slowly, and memory usage grows much faster. After a dozen tabs it starts visibly lagging when you press play/pause, the exact same session works flawlessly in Chrome.
It doesn't seem to affect everyone equally. Pretending to be Chrome sometimes helps - not too long ago someone found a piece of code that introduced seconds of busy delay for any non-Chrome user agent.
A lot of systems seem to silently fail on Firefox - my broadband supplier's website failed at the last step of the onboarding process. I managed to get charged for installation (connection by the network operator, UK) twice, have onboarding emails sent, but not have the appointment in my account.
Used Edge, went through completely.
Can't guarantee it was Firefox/browser issues. But this is not that uncommon an occurrence.
I suspect it is the bank who are at fault.
Just today Ryanair wouldnt let me in on Firefox. 403 with a cloudflare error.
But on chrome it went through without a hitch.
I’ve been using Firefox for 20 years, and Ryanair for 10, I’ve never had to switch browser for it. My last flight was 2 weeks ago
Its the magic of multi-metric based DDOS/exploit/whatever protection.
For my full profile the login attempt with Firefox as a user agent apparently pushed it over the edge.
Do you have adblock by any chance?
To get to the point where these artificial gates substantially matter for interop, you've already cleared 99% of the hurdles, and you can get away with just spoofing the User Agent string most of the time.
Widevine is legitimately a “gate”, but realistically it only stops 4K playback on Netflix, Disney and a few other streaming sites. And it's not super relevant considering that Zen has gathered 10M users without it.
> DRM Widevine,
we have to thank tim berners lee for allowing this kind of bs in the first place
?
https://www.defectivebydesign.org/blog/tim_bernerslee_approv...
It was either permit DRM, or cut off the web for all sorts of media.
It was a bad position for him to take.
easy choice. also, thats just BS, remember how SOMEHOW the same was said for playback of music on computers, yet somehow a certain now-dead CEO was able to say "fuck you" and it happened anyway?
Not sure if Spotify got that same memo.
That was part of the deal with Apple the record company because otherwise Apple the computer company would infringe on their trademark. The Steves could have renamed their company or taken the deal. They took the deal.
There would still be piracy sites. So their choice would be between everyone watching it for free or offering their service without drm.
the web was famously cut off for all sorts of media before DRM was permitted
Quite recently, Ladybird started reporting itself as Chrome for exactly this reason.
Unfortunately a whole new generation failed to learn the IE lesson, and are the first to complain when others don't follow the Chrome OS Platform wishes.
Hmm, I haven’t used a single website in a long time that forces a Chromium-based browser to operate. The only exception I know of is DocuSign requiring a Chrome extension. And, of course, plenty of websites are laggy on Safari.
Ladybird, at least initially, will be niche enough that I think this won't be a problem. It'll be tech enthusiasts who use multiple browsers. If it can get a foothold, then I think there will be many more bars to clear.
Ladybird is coming along so well. I am a long-term Firefox user and I'll definitely be an early adopter of Ladybird when it enters very early alpha and precompiled builds start being released.
Mozilla needs a kick in the pants to say the least.
They're a lost cause. It's been at least a decade since they've made a decision that wasn't the worst possible.
It's pretty easy to compile yourself, especially if you ask Claude code to do it for you.
Are you illiterate? There are step by step instructions, it's accessible too.
I deposit for those who would rather ask a robot than do something simple themselves.
BTW if you want to kick the tires at the current stage, building it locally is easy, just a couple of commands to install dependencies and run the build script:
https://github.com/LadybirdBrowser/ladybird/blob/master/Docu...
> strava.com : Login works now that Navigator.getBattery throws the spec-mandated error type instead of one of our own (#8770).
what’s Strava want with my battery level?
Maybe it uses some that battery API as a heuristic for a lower-power version of the site? Or maybe they have a web-only version in developing markets? Low battery means it should query for your location less often to save battery?
Totally spitballing here. Strava being a website that requests battery does not seem wildly outlandish to me, albeit it is a bit suspicious in general.
> it uses some that battery API as a heuristic for a lower-power version of the site?
As a naive user I would expect websites to not be able to receive information about my battery state. With that information they can track my mobile phone usage pattern, and with some cross-referencing gain even more specific private information.
I think it is great that the API exists, but it is not great, that no permission from the user is needed to access it.
Bots trying to brute force accounts may not have the API implemented like a real device may.
Sure, and my desktop computer just reports 100% battery level? Which can't be easily replicated by a static header in the bot?
This would be a silly thing to use to identify bots.
It's not silly if it works.
Most likely for generating unique fingerprint for tracking
Strava's a route tracker. Assuming you can use it through the website, it probably controls how often it polls location, trading off accuracy for power consumption.
> GTK4 / libadwaita frontend
Nice! Looks good. I prefer GTK UI/UX over Qt. Looking forward to seeing the development progress on that.
I thinkk it's about time Ladybird got some official prebuilt binaries - I'd love to try it, but I'm not going to install its whole dev environment and build it from source.
They planned an alpha build in june :) so, just a bit longer!
If you are interested in new browsers / web runtimes, Servo publishes binaries monthly: https://servo.org/download/
I managed to build this the other day. Looking good!
As noted by other authors, there does seem to be a wide surface area for attacks so, security remediation does seem to be a top-of-queue thing to be handled.
All in all, keep up the good work!
Independence is great, but I'm curious about features. Will Ladybird have any built-in ad blocking like Brave? Useful tab management? Dark mode?
I think plugins is the better solution, then you can't pay the browser to get your ads through.
They block all ads in current builds. Probably mostly more performance and to create more consistency when testing a website (not having to worry about errors from lots of low quality JavaScript in the ads).
I think they have dark mode already.
Earlier: https://news.ycombinator.com/item?id=47985497
I really like what SerenityOS is going for, and hope they can maintain that focus in the Ladybird browser.
AFAIK Ladybird is separated from SerenityOS completely now (https://hackaday.com/2024/07/02/fork-ladybird-browser-and-se...) so the Ladybird contributors can fully focus on it
I love SerenityOS too but it has totally lost momentum since Andreas left.
And ladybird does not even support SerenityOS anymore.
https://ladybird.org/assets/img/newsletter-apr-2026-reddit-g...
To whoever had the evangelion r/unixporn as a way to test out ladybird reddit. I respect you so much as I really liked reading about evangelion (I haven't watched it as much BUT I have watched countless documentaries explaining it and had evangelion as my wallpaper for sometime)
Now coming to the point, the fact that reddit is working in ladybird sounds crazy good, I am not sure if youtube is working or not but I hope that youtube works too and Ladybird sounds to really work.
Also, thanks to https://jakubsteplow.ski/ for donating the money to ladybird. I mean I would like to actively promote people who donate to open source projects as a better way than what google ads or others too and jakub I wish you nothing but the best and I hope other people donate to projects like ladybird too (Independent donors/donations), also thanks to human rights foundation https://hrf.org/program/ai-for-individual-rights/
It's amazing how browsers had an almost mono/(duo or trio?)-poly yet it took a single guy to do all of this. Its really inspiring.
https://ladybird.org/#about
> How many people are working on the browser today?
> We currently have 8 paid full-time engineers working on Ladybird. There is also a large community of volunteer contributors.
I love EVA, but I’ll cautiously recommend it. I feel like there are two sides to it: the mecha/alien/monster sci-fi side which has an amazing aesthetic, and the personal drama focusing on self loathing and loneliness. I think the first side is the most attractive to most people, but what really sticks with me to this day is the latter.
If you do end up watching I have to warn about the watch order. There are two timelines, the original TV series plus the movie “End of Evangelion”, and then the “Rebuild of Eva” movie series which started as a complete reboot but somehow ended as the ultimate Reboot/Remake/Sequel to the original stuff.
I understand, I had started watching these evangelion summaries thinking oh cool robots but then, I have been aware of the loneliness and other things within the series which were thought-provoking but also not really at the same time. I
I don't watch much anime (shocking within my generation which seems to be anime-driven?) but ironically I have also watched berserk's golden age arc also because of an edit that I had watched before all the horrificness is revealed but that's the reason why I haven't really read more about berserk other than the golden age.
Yu-Yu-Hakusho, death note, AOT and bersek/(evangelion? Only watched documentaries explaining it) are the only series that I have watched/listened about a lot in this sense I suppose.
With berserk and evangelion, perhaps there is something about the style of both of these, both lure you in with a particular sense of art but both have some aspects of darkness hidden beneath the pages.
I have listened to and slept listening to this song more times than I can count: https://www.youtube.com/watch?v=nSEkh4mgYqc
There is something about first discovering it even knowing through comments that things would turn south but I still decided to watch berserk because it so captured my attention. I wished for it to be a bland piece where things turn happy ever happily but I think that berserk's decision to not do is somewhat fascinating too. maybe the lure to watch these increases knowing the fact that these aren't just single dimensional things but rather multi dimensional with deeper topics.
Evangelion with concepts like loneliness and I would associate berserk with pain and hope (hope to still fight even after so much pain)
Edit: should probably mention Its late night and I should probably sleep and I didn't really intend to send this message, I sometimes write somethings and don't send them (but save them for myself to read in documents)* because I find that I think deeper about something during this and I accidentally pressed enter, thanks for reading this but I am sure that I might not be able to give my viewpoint away but I am grateful that you read till the end. Looks like the world wanted me to send the message so I did :-D
Skip Eva watch Tengen Toppa Gurren Lagan.
Both are great shows made by GAINAX, but I highly watching suggest their prototypes as well: Gunbuster and Diebuster. All four are great Mecha shows made by the same studio and it's fun spotting the similarities across all of them.
What I consider to be a spiritual successor to these GAINAX mecha shows was the most recent Gundam series "Gquuuuuux" which shared many staff members from them and has plenty of homages that were fun to spot! Also had the same mechanical designer as the Evangelions so I got a kick out of that.
YouTube works in Ladybird. Most things do. Biggest problem other than speed is that a lot of the “verify you are a human” checks do not work with it.
Congratulations!
However, the screenshots for "List markers in RTL text" are the same it seems. The list markers are on the left in both cases.
In this after picture: https://ladybird.org/assets/img/newsletter-apr-2026-rtl-afte..., the bullet points in the lower left panel are to the right of the text, whereas in this before picture: https://ladybird.org/assets/img/newsletter-apr-2026-rtl-befo... they are not only to the left of the text, but they are so far to the left of the text they are nearly exiting the panel itself.
It's subtle but they aren't the same. The list makers are now to the right of the text entries as they should. But it's hard to see because it's somewhat hidden by the glaring issues the rest of the page still has.
Can’t ship it soon enough.
Too bad LadyBird is being translated to LLM generated Rust.
It's nice that Rust is so beginner friendly but it would be nicer to have a pure C++ browser for the more experienced developers, to use as a basis for their projects like Chromium is used.
If LLMs allow them to speedrun to an alternative mainstream browser, then full speed ahead.
A third runner in this space would make the browser market a lot healthier than the current chrome/webkit and Firefox duopoly.
I’d rather have a good browser which took its time to get things right than a speed run one.
Too much software is written like that, and the result is that most things are shit. What are we in such a hurry for? To get more time to work more? Fucking chill. Do things slowly and right.
As a side thought, speed running seems like the wrong analogy for software. Speed runners in games are people who spend a ton of time doing the exact same steps over and over to find tiny optimisations and develop muscle memory to do something repeatable. They take the time to do it well. Being a good speed runner means embracing slow progress. It’s the antithesis of software, where rushing to get it out also means you barely look at it. You do it fast but seldom right.
What are your thoughts on the current code quality? Have you had a chance to review it?
I have, but that’s irrelevant. I’m commenting on the general sentiment, not any specific project.
are you willing to contribute time, money and code?
Your argument is so removed from the point, it’s an entirely different conversation.
I already contribute time and code to open source projects, and I promise you’ll have heard of some of the things I contributed a lot to. That’s beside the point.
This is like saying “I’d prefer if doctors took their time with patients to understand their cases and provide meaningful accurate resolutions to ailments instead of rushing” and you replying with ”oh yeah, are you willing to contribute with medicine and triage?”.
I think there's a balance to be struck between code quality and delivery speed.
GNU Hurd is a well known example where they spent a so much time on getting the code right that the project became irrelevant. And of course you made the case for erring on the "too much code too quickly" side
The comment I responded to talked of “speedrun” and “full speed ahead”. That’s the antithesis of balance.
The point you’re making is valid but has no bearing on the current conversation. GNU Hurd is also an extreme case, the overwhelming majority of software suffers more from being rushed than from being so slow it becomes irrelevant.
>chrome/webkit and Firefox duopoly
Blink (Chrome) is not WebKit. If anything, the duopoly is Blink and WebKit at places 1 and 2 respectively.
Firefox is at around 3% market share. There’s no “-poly” to Gecko at all.
Blink is derived from WebKit, so is in the same family like the other Blink/WebKit derived browsers. Fireox/Gecko is a different browser implementation.
I don't really care for the language. But why is it following the GTK UI language ffs. Every gtk only gets worse.
> Ladybird has a new Linux frontend built on GTK4 and libadwaita, sitting alongside the existing Qt frontend
This is in addition to the already existing Qt frontend.
Ah that's nice. Cool then.
Why would yet another C++ browser be better than one written in a different language (this time Rust, but Zig would be cool too)?
are you saying c++ can be used as a basis for other projects whereas rust cannot? ...why?
There are lots of C++ browsers, including Chromium.
Happy to see Ladybird using the best tools.
The RegEx and JavaScript interpreters are great places to use Rust for security reasons.
In my opinion, Chromium has already filled that market.
I actually think Ladybird should lean into Rust more so it can compete on speed but still stay safe and friendly to contributors (as hopefully the compiler will prevent most bugs).
My hope is this will help them compete with tenets of "safe, fast, contributor-friendly and NOT owned by a corporation"
I don't know, it's the third language they mention to introduce, first there was Swift, for whatever reason.
I think they should be first focusing on getting to a first stable version before re-writing parts of the browser.
> Human Rights Foundation ... “AI for Individual Rights” program
That sounds quite dodgy. Ladybird doesn't have AI, why would such a program support its development?
But even before that: "Human Rights Foundation" sounds like "The Human League" which George makes up in Seinfeld as a fake charity. And promoting AI as a "human right" is quite suspicious. If I had to, I might be that this is something backed by one of the corporations burning through Billions of dollars and Gigawatt-hours on LLMs.
Looking at their annual report summaries and their huge staff, my guess slants a bit towards either bodies like the CIA or some ideologically-motivated billionaires (e.g. talk about the "dictator Maduro", focus on Iran etc.)
> "The Human League" which George makes up in Seinfeld as a fake charity
It was actually The Human Fund. The Human League is an English pop band, most successful in the 1980s with their hit single "Don't You Want Me".
There's quite a big difference between "AI for individual rights" and "AI as a human right".
Ha I immediately thought of the Human Fund from Seinfeld. Their fake slogan “money for humans”
If you're interested in the program, you can find more details here: https://hrf.org/program/ai-for-individual-rights/ai-for-indi...
They offer grants for "Using AI tools and platforms to more efficiently build movements and resist oppression" in addition to many other things.
Ladybird has a close relationship with FUTO which is a pretty oddly behaved private for-profit company ran by a bored multi-millionaire.
https://drewdevault.com/blog/Whats-up-with-FUTO/
Didn't realize FUTO was connected to Eron Wolf, which connects to Curtis Yarvin, which connects to Palantir.
Great...
What, do you sincerely believe Palantir is pulling the strings behind Ladybird? What is the accusation here? Everybody can be "connected" in some way or another, but it's meaningless.
https://en.wikipedia.org/wiki/Six_degrees_of_separation
4 steps is not so bad
I think it's more a concern about the company one keeps; Ladybird's Andreas Kling has certainly ruffled feathers over the past couple of years by doubling down on anti-inclusionary language takes ("I'm not against gender neutral language, I'm just not going to allow it in my project") and supporting DHH's most douchebaggiest takes.
I understand that not everybody cares about this sort of thing, believing that politics of developers should be irrelevant; I'm personally not going to go around ringing the shame bell at people who use Ladybird (or Rails. But Kling loudly shouting "I support the free speech rights of fascists but get away from me with that DEI shit" doesn't give me warm fuzzies about using Ladybird, either. It's a lot easier to let politics of developers be irrelevant if the developers aren't out there energetically sharing them.
I don't think Palantir is behind Ladybird, I just wish FUTO wasn't connected to Eron Wolf.
They even did a video with Curtis Yarvin on their official channel...
I thought it was more related to Louis Rossmann that's where I learnend from
Louis Rossmann Is directly related to FUTO and has passionately advocated for them.
Ladybird has taken sponsorship money from FUTO and claims publicly that sponsorship provides no influence.
Yeah but in the comments they're naming other people I never heard of
By “close relationship”, I assume you mean that FUTO is a financial sponsor.
Ladybird has been pretty clear that they will accept money from pretty much anybody but that funding will not provide influence.
I mean, they mostly make sure sponsors websites look good in Ladybird but even that seems like a low priority if you watch them.
It's very naive to believe the "no influence" part. I will never give to Ladybird given their closeness with fascists. Is that the kind of influence they expect?
I guess you'll have no influence over Ladybird, then.
Andreas is involved with FUTO's conferences, and given a keynote presentation at one. It's more than just financial.
And Drew Devault, your source, has brazenly deceived HN before https://news.ycombinator.com/item?id=41838124
To be clear, that source is happy to lie about their own identity and run away from basic questions. I'd treat this as another ill-baked cancel campaign unless someone actually credible speaks up
I've never understood that stance because surely the mere threat (even implied) of a sponsor removing thousands in funding would be enough to exert influence on the project.
The sponsor money is used to pay developers to work on Ladybird so a major sponsor pulling out could mean laying off core developers, which the project would obviously be motivated to prevent.
From the FAQ in the ladybird front page.
>All sponsorships are in the form of unrestricted donations. Board seats and other forms of influence are not for sale.
i.e. donations explicitly do not buy any say in the project.
It is. Ex-FIRE guy's idea. Avoiding Ladybird like the plague, personally.
>But even before that: "Human Rights Foundation" sounds like
a household name (the HRF), to me
Here’s the CIA billionaire running it (I kid!) but ya HRF’s president: https://en.wikipedia.org/wiki/Thor_Halvorssen_(human_rights_...
Unlikely to be USA govt if they’ve defocused soft power activities eh?
Interesting, I've checked the LinkedIn link of Jakub Stęplowski, a software developer proudly presenting himself as "from Poland" - 10 years of working outside of Poland in Italy and Switzerland. Yep, that checks out. I was wondering where he could have gotten $1,000 to generously burn on this project as a sponsor, with Polish salaries.
Nothing bad about it, of course. It's just it's long time overdue to move to Switzerland as well, I see.
There was a developer who I worked with at a mortgage company who had moved to the UK from Czech Republic. He would sit at his desk playing games on his phone all day and had outsourced his entire job to his friend back home for 25% of his UK salary.
> It’s inspired by GNOME Web (Epiphany)
So basically, it will be useless. How many use epiphany please? That thing has been so extremely ineffective. It's like 1999 (not that everything was bad in 1999).
> follows GNOME’s design guidelines: no menubar, a hamburger menu
Oh. my. god.
So Ladybird worships uselessness now. Also, GTK progressively gets worse and with GTK5 they will (try to) kill of xorg-server too. Some people disagree with that - https://github.com/X11Libre/xserver and https://git.devuan.org/Daemonratte/gtk2-ng; I get it that there are not that many folks using that, but the point is that the GNOME corporate mindset has a tiny bit of competition. Perhaps that seed of competition grows over time until the corporate gnomeys have to change course (won't happen, as they are paid to abolish what is "old", but more competition is good, if only to try to "reason" with mr. ebassi and other hardcore gnomeys; sadly KDE also goes that way with wayland-only, thanks to anti Robin Hood Nate and his donation-pester daemon. Oldschool KDE devs didn't waylay people for money, now it is "pay or get nagged", thanks to Natey Nate).
We kind of need competition in the browser landscape, so in some ways having Ladybird is good. I don't really have much hope that ladybird will be able to challenge the evil Google empire though. But perhaps more people realise that Google controlling so much of the www-ecosystem (again, just look at how they nerfed google search in the last years) is a huge problem.
I like the approach of ladybird to provides as many native chrome as possible it gives peoples choice and let the browser feel native in whatever DE they choose to use :)
I'm pretty happy with GNOME. Feel free to use software from conspiracy lunatics (XLibre) though
Is pdf.js the renderer that VSCode uses? You know, the one where everything becomes extremely blurry when you zoom in for absolutely no reason at all except (I would imagine) developer incompetence?
Its the one firefox uses and it works well.
I don't want to dampen the positive vibes around this project in any way, in fact I'm very glad such projects exists. But it just struck me that my immediate associations with the "non-profit" label - which in this project's context is clearly being positioned against Mozilla's for-profit subsidiary, the Mozilla Corporation - don't quite match reality. Even though it is indeed a non-profit, the website features a not exactly short listing of sponsors, including platinum-tier sponsor Cloudflare.
Platinum, per Ladybird's own sponsorship page, means $100,000+ per year. Money that, per the site, comes from "just people and companies who believe in an open web." Cloudflare, then.
Uhh, yes? Non-profits take donations to keep doing their work.
Sure and Mozilla is arguably the cautionary tale here. They also started as a non-profit taking donations. AOL seeded them with $2M, Red Hat and Sun pitched in too. Within a year they had the Google search deal. By 2006, ~92% of revenue came from Google.
"non-profit" does not mean it has to run off unicorn farts