blog

www-client are broken.xhtml (3635B)

<article xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" class="h-entry">
<h1 class="p-name"><a class="u-url" href="/articles/www-client%20are%20broken">www-client are broken</a></h1>
<p>So after saying that <a rel="prev" href="/articles/Mozilla%20is%20Broken">Mozilla is Broken</a> (it still is). Chrom* became broken too :</p><ul>
	<li>Doesn’t compile without black magic (also it takes at least 5+ hours)</li>
	<li>Now depends on Node.JS/NPM, which I can’t use as it depends on OpenSSL (I use LibreSSL, note that google got BoringSSL) and that I don’t want. (I prefer to avoid any javascript)</li>
	<li>The provided source tarballs includes third-party code and doesn’t compile with removing it (yeah, the broken "let’s put every dependency in the tarball" is also a thing at Google)</li>
</ul>
<p>Basically I have no web browser anymore… or well no. I have even more web browser installed than when I was doing/learning web development, because I have several whatever around engines.</p>
<p>Anyway let’s put what I need in a web browser:</p>
<ul>
	<li>Unicode by default (or at least follow my <code>LANG</code> environment variable or make it configurable)</li>
	<li>Full Libre software</li>
	<li>Compiles and works without systemd and pulseaudio, works with LibreSSL, bonus if no dbus hard-dependency.</li>
	<li>Privacy/Security:<ul>
		<li>No calling home without prior free consent(i.e. health report, search suggestions)</li>
		<li>No proxying/DNS over Whatever/Auto-VPN/… without configurability</li>
		<li>Does <b>not</b> implements their own crypto and supports current best practices/algorithms</li>
		<li>per-domain blocking of requests by their type(cookies,css,images,media,xhr,scripts,…) and domain (as seen in uMatrix)</li>
		<li>blocking of request by their URL (as seen in uBlock)</li>
		<li>Bonus: Certificate fingerprint(like (TOFU of SSH(know-hosts)) and Certificate Patrol)</li>
		<li>Bonus: Hook(able) to <a href="http://password-store.org/">pass</a></li>
	</ul></li>
	<li>Deep(ciphers, headers, …) &amp; understandable configuration (Mozilla Firefox being the worst, Opera-like browser being the best, another good example is linux menuconfig)</li>
	<li>Supports: HTML 5, CSS 3, Images(PNG, JPEG, SVG), Bonus: javascript(So I don’t need another browser)</li>
	<li>Uses dependencies/libraries but doesn’t eat them (I don’t like having to do: <code>rm -fr third-party; ./configure --enable-system… --with-system…</code>)</li>
	<li>Does not eat up all the RAM/CPU for nothing or freezes/crashes for whatever reason (but I think multiprocess à la chrom* is great when there is JS support and the overhead is ok)</li>
</ul>
<p>As my findings of 2017-07-06, the web browsers (Gui;engine;style/inspiration) that are almost compliant to my needs are, without much sorting/ordering:</p>
<ul>
	<li><a href="http://fifth-browser.sourceforge.net">Fifth</a> (FLTK;FLTKWebkit;Unix+opera)</li>
	<li><a href="http://otter-browser.org/">Otter-Browser</a> (QT+;QtWebkit+QtWebEngine;opera)</li>
	<li>GNU IceCat (GTK;Mozilla)</li>
	<li>Seamonkey (GTK;Mozilla;netscape-opera)</li>
	<li>Palemoon (GTK;?Mozilla) (Haven’t managed to build it after about a week…)</li>
	<li>qupzilla (Xlib+Qt;QtWebkit; scriptable TUI-like)</li>
	<li>uzbl / dwb (Xlib+GTK;WebkitGTK;scriptable TUI-like)</li>
	<li>Netsurf (GTK2+/Framebuffer/…;own+duktape;original?)</li>
</ul>
<h2>Changes</h2>
<ul>
	<li>2018-08-24T22:10:58Z: Add "No proxying/DNS over Whatever/Auto-VPN/… without configurability"</li>
</ul>
<p>published on 2017-07-09T02:01:46Z, last updated on 2020-08-13T21:27:00Z</p>
</article>