- Dillo-dev - lists.mailman3.com

Re: [Dillo-dev] How to get dillo up to speed; was: LinuxBIOS with X Server Inside

by Alan Carvalho de Assis

Hi, 2007/3/20, Justus Winter <4winter(a)informatik.uni-hamburg.de>: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Hey folks :) > > I completely agree with Marc on this topic. I have been following this > list for some time now and I have heard all kinds of people proposing > interesting uses for dillo and I like to add one more to this list. > > I have done some research in web security, mostly session riding based > attacks. Dillo, with its missing javascript interpreter and css engine > being a feature this time, is not vulnerable against most session riding > attacks. > > Though most session riding attacks require javascript, it has been > shown, that port scanning and web server fingerprinting is possible > using only html and css. > > So why not use dillo on workstations in your internal network to protect > your intranet web applications against malicious javascript and css? > > Also with its small codebase (compared to geckos), some kind of auditing > might be possible. > > But on the other hand, more and more web sites and web applications > require css (which is definitively a good thing) and javascript (which > may not be a good thing). The web is a moving target, and everyone > developing a web browser is playing catch up with the standards and with > the ever growing demands of users and developers. > > And I for one think, that no one of the big four is doing very well... > > Dillo development has stagnated. So with every day that passes, dillos > practicability, the number of users and the number of developers > interested in doing some work for dillo decreases. > > I can understand Jorges bitterness, but this wont get dillo anywhere. If > its more work for a company (-> money and time) to get dillo up to speed > to meet their needs than to strip down gecko or khtml until it fits into > their devices (or whatever they want to do with it), they wont choose dillo. > > With every single day, the value of the dillo codebase decreases. And on > some day it wont matter if it is ever released or not, because it is > completely useless for the applications and sites out there. Maybe this > day has already passed without any one noticing. > > By the way, I keep referring to "the code". Yes I know that the GTK > branch is out there. Yes, I have taken a look at it and yes, I began to > develop an plugin, but I realized that the plugin interface was lacking > some important things (registering uri handlers comes to mind - it is > hardly an plugin if you need to touch and recompile parts of dillo). > > So I stopped before I began any serious work. Dillo felt dead. No one is > going to invest time in an project which was somewhat abandoned by its > main developer. No offense, but this is how it feels. > > Most free software developers are working on these kind of projects in > their leisure time, they want to have fun. If dillo wants to attract > developers, developing dillo needs to be fun. There are lots and lots of > free software projects that discussed how to make developing their > software fun. Things like giving write access to repositories to > developers interested in development, creating branches or creating a > wiki could help. > > It is somewhat true, that one or two developers working on dillo full > time would be nice, but as long as no one pays for this, I don't see how > this is possible. But this all or nothing attitude will kill dillo in > the long term. > > Jorge, consider releasing this patch of yours. You have got very little > to loose (or am I missing something?) but this might spark some interest > in dillo development again. > > Just my thoughts... > Sure, I agree with you! As can be seen at: http://www.dellideastorm.com LinuxBIOS is the 10 most voted idea to Dell implement. If you get Dillo running inside the LinuxBIOS the interest in this web-browser will increase newly, then now it the time to Dillo show its worth. Jorge, consider this. > > Cheers, > Justus Cheers, Alan

March 21, 2007

How to get dillo up to speed; was: LinuxBIOS with X Server Inside

by Justus Winter

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hey folks :) I completely agree with Marc on this topic. I have been following this list for some time now and I have heard all kinds of people proposing interesting uses for dillo and I like to add one more to this list. I have done some research in web security, mostly session riding based attacks. Dillo, with its missing javascript interpreter and css engine being a feature this time, is not vulnerable against most session riding attacks. Though most session riding attacks require javascript, it has been shown, that port scanning and web server fingerprinting is possible using only html and css. So why not use dillo on workstations in your internal network to protect your intranet web applications against malicious javascript and css? Also with its small codebase (compared to geckos), some kind of auditing might be possible. But on the other hand, more and more web sites and web applications require css (which is definitively a good thing) and javascript (which may not be a good thing). The web is a moving target, and everyone developing a web browser is playing catch up with the standards and with the ever growing demands of users and developers. And I for one think, that no one of the big four is doing very well... Dillo development has stagnated. So with every day that passes, dillos practicability, the number of users and the number of developers interested in doing some work for dillo decreases. I can understand Jorges bitterness, but this wont get dillo anywhere. If its more work for a company (-> money and time) to get dillo up to speed to meet their needs than to strip down gecko or khtml until it fits into their devices (or whatever they want to do with it), they wont choose dillo. With every single day, the value of the dillo codebase decreases. And on some day it wont matter if it is ever released or not, because it is completely useless for the applications and sites out there. Maybe this day has already passed without any one noticing. By the way, I keep referring to "the code". Yes I know that the GTK branch is out there. Yes, I have taken a look at it and yes, I began to develop an plugin, but I realized that the plugin interface was lacking some important things (registering uri handlers comes to mind - it is hardly an plugin if you need to touch and recompile parts of dillo). So I stopped before I began any serious work. Dillo felt dead. No one is going to invest time in an project which was somewhat abandoned by its main developer. No offense, but this is how it feels. Most free software developers are working on these kind of projects in their leisure time, they want to have fun. If dillo wants to attract developers, developing dillo needs to be fun. There are lots and lots of free software projects that discussed how to make developing their software fun. Things like giving write access to repositories to developers interested in development, creating branches or creating a wiki could help. It is somewhat true, that one or two developers working on dillo full time would be nice, but as long as no one pays for this, I don't see how this is possible. But this all or nothing attitude will kill dillo in the long term. Jorge, consider releasing this patch of yours. You have got very little to loose (or am I missing something?) but this might spark some interest in dillo development again. Just my thoughts... Cheers, Justus -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.3 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFGAHnvoPmwNWhsaZYRAoNLAJsHj2vSgz7cNRlhtm5B3YOMHMJV+ACfRt5b lJWqSxIQSwnDeilDYX4AcA8= =mCxX -----END PGP SIGNATURE-----

March 21, 2007

Re: [Dillo-dev] LinuxBIOS with X Server Inside

by Alan Carvalho de Assis

Hi, first sorry about pre-posting. You are right, but Jorge can keep it closed if he want. We need to convince he it is not the best way. He will not be successful keeping it closed or keeping tight control over dillo resource inclusion. People needs i18n, ssl, javascript, flash, etc... Maybe a best approach can be keep resource configurable, then you can compile dillo for a deep embedded system with minimal resources or compile it for a small linux distro with full resources. God save Dillo, Alan 2007/3/20, Mark South <marksouth2000(a)yahoo.co.uk>: > Hi. > > I should introduce myself, because I've never posted, although > I've been lurking on this list for a long time. I'm more a > distro hacker than a browser hacker. But enough about that. > > I still remember how I was delighted when I discovered dillo, and > how small it was, and its amazing power-to-weight ratio. > > There is clearly a need for a browser like dillo. Firefox, > Seamonkey, Opera, all use a lot of memory and run slowly on all > but modern machines. There are numerous Linux distros consisting > entirely of software that will run happily on a 64 MB PII, except > for the huge lump of a browser. DSL has Firefox and Puppy has > Seamonkey, for example. (They both have dillo but don't consider > it sufficient on its own.) This is something like putting armour > plate on a formula one car. > > If dillo had tabs (without prescribing the window manager), > multiple languages, and solid enough cookie and SSL supprt that > one could read webmail from it easily, it would be the browser > that fit most perfectly with the small Linux distros. And yet > they are all talking about dropping it because it's no longer > much use on the modern web. > > And yet every day I wish that I had in my hands a dillo that was > just that tiny bit more capable than 0.8.5 is, and was known to > be under active development and maintenance. Something more > general than lynx/links/elinks and a lot lighter on resources > than Gecko-based browsers and that ilk. > > Like many others, I have gradually become pessimistic about dillo > ever being revived. I have watched it being dropped from distro > after distro, and even pleaded with the port maintainer > (unsuccessfully) for it to be kept in OpenBSD. > > Clearly there is a problem here, and it's not to do with FLTK not > releasing (they do) or lack of interest in a light-to-mid-weight > browser, because loads of people want exactly that. > > --- Jorge Arellano Cid <jcid(a)dillo.org> wrote: > > On Mon, Mar 19, 2007 at 08:45:38AM -0300, Alan Carvalho de > > Assis wrote: > > > > > > I don't understand why nice projects as Dillo, Linux-Tiny and > > > other don't attract developers. > > Sourceforge has like 100,000+ projects listed. There is no > shortage of willing developers out there. So why doesn't dillo > get developers? > > One reason for projects to lose their attractiveness is when > project ownership narrows too far. This is happening right now > with at least 2 Linux distros that I could name, but won't. > People in the community are becoming reluctant to contribute to a > project that is held under the narrow control of a small cadre. > > On the other hand, projects that have wide ownership are thriving > and multiplying. > > > Actually, Dillo attracts developers, it is the high > > time dedication and specific expertise it demands what > > stops most of them. > > Are you sure about that? I ask because I'm not convinced it's a > shortage of smart people in the world. > > I worry that it's the relentless focus on getting funding before > development starts again, or the indecision caused by being > unable to decide whether to proceed with forking off a new > project from 0.8.5, the last version that would build on multiple > platforms, or to wait for Jorge to release the FLTK code that he > has and let people work on it. > > If Jorge were to declare that he will never release the FLTK > port, there are people out there who would probably continue > development starting from the 0.8.5 codebase. > > If Jorge were to declare that he will make the existing FLTK code > available for others to develop, I'd be surprised if several > people didn't step forward to help. > > So, from where I'm sitting, it looks like the real problem is > uncertainty about which way to go, and perhaps if Jorge were to > let go of either his hopes of making a living from dillo or of > total control of the dillo code, there might be a way forward for > further development. > > I would further suggest that if Jorge doesn't have the time for > development work on dillo, he would nevertheless be the first > choice for the overall architect of the ongoing development. > Being architect of a successful project that releases useful code > may be a better result, career-wise, than being commercial owner > of a project that failed to release a complete unit version and > faded away. But that would be for Jorge to decide. I hope that > he will decide, one way or the other, and decide soon, and make > that decision public soon as well. > > Now, I expect that I'll get a few hasty flames in response to > this mail, but I don't mean to attack anyone personally. That > said, there is a *very* small number of people who could make a > huge difference to the dillo project by their actions, and I hope > that they will read this message as constructive. > > I would still hope, and would definitely like to be able, to draw > on dillo as a working solution in the future, as would many > others. > > Sincere best wishes to *all* recipients on the dillo-dev- list, > Mark > > PS Apologies for the length of this message. I guess it shows > that I kept quiet for too long. > > > > ___________________________________________________________ > Now you can scan emails quickly with a reading pane. Get the new Yahoo! Mail. http://uk.docs.yahoo.com/nowyoucan.html > > _______________________________________________ > Dillo-dev mailing list > Dillo-dev(a)dillo.org > http://lists.auriga.wearlab.de/cgi-bin/mailman/listinfo/dillo-dev > -- ------------------------------------------------------------ | Alan Carvalho de Assis | ------------------------------------------------------------ -- Não importa o que os outros irão pensar, A cura para a infelicidade é a felicidade

March 20, 2007

Re: [Dillo-dev] LinuxBIOS with X Server Inside

by Mark South

Hi. I should introduce myself, because I've never posted, although I've been lurking on this list for a long time. I'm more a distro hacker than a browser hacker. But enough about that. I still remember how I was delighted when I discovered dillo, and how small it was, and its amazing power-to-weight ratio. There is clearly a need for a browser like dillo. Firefox, Seamonkey, Opera, all use a lot of memory and run slowly on all but modern machines. There are numerous Linux distros consisting entirely of software that will run happily on a 64 MB PII, except for the huge lump of a browser. DSL has Firefox and Puppy has Seamonkey, for example. (They both have dillo but don't consider it sufficient on its own.) This is something like putting armour plate on a formula one car. If dillo had tabs (without prescribing the window manager), multiple languages, and solid enough cookie and SSL supprt that one could read webmail from it easily, it would be the browser that fit most perfectly with the small Linux distros. And yet they are all talking about dropping it because it's no longer much use on the modern web. And yet every day I wish that I had in my hands a dillo that was just that tiny bit more capable than 0.8.5 is, and was known to be under active development and maintenance. Something more general than lynx/links/elinks and a lot lighter on resources than Gecko-based browsers and that ilk. Like many others, I have gradually become pessimistic about dillo ever being revived. I have watched it being dropped from distro after distro, and even pleaded with the port maintainer (unsuccessfully) for it to be kept in OpenBSD. Clearly there is a problem here, and it's not to do with FLTK not releasing (they do) or lack of interest in a light-to-mid-weight browser, because loads of people want exactly that. --- Jorge Arellano Cid <jcid(a)dillo.org> wrote: > On Mon, Mar 19, 2007 at 08:45:38AM -0300, Alan Carvalho de > Assis wrote: > > > > I don't understand why nice projects as Dillo, Linux-Tiny and > > other don't attract developers. Sourceforge has like 100,000+ projects listed. There is no shortage of willing developers out there. So why doesn't dillo get developers? One reason for projects to lose their attractiveness is when project ownership narrows too far. This is happening right now with at least 2 Linux distros that I could name, but won't. People in the community are becoming reluctant to contribute to a project that is held under the narrow control of a small cadre. On the other hand, projects that have wide ownership are thriving and multiplying. > Actually, Dillo attracts developers, it is the high > time dedication and specific expertise it demands what > stops most of them. Are you sure about that? I ask because I'm not convinced it's a shortage of smart people in the world. I worry that it's the relentless focus on getting funding before development starts again, or the indecision caused by being unable to decide whether to proceed with forking off a new project from 0.8.5, the last version that would build on multiple platforms, or to wait for Jorge to release the FLTK code that he has and let people work on it. If Jorge were to declare that he will never release the FLTK port, there are people out there who would probably continue development starting from the 0.8.5 codebase. If Jorge were to declare that he will make the existing FLTK code available for others to develop, I'd be surprised if several people didn't step forward to help. So, from where I'm sitting, it looks like the real problem is uncertainty about which way to go, and perhaps if Jorge were to let go of either his hopes of making a living from dillo or of total control of the dillo code, there might be a way forward for further development. I would further suggest that if Jorge doesn't have the time for development work on dillo, he would nevertheless be the first choice for the overall architect of the ongoing development. Being architect of a successful project that releases useful code may be a better result, career-wise, than being commercial owner of a project that failed to release a complete unit version and faded away. But that would be for Jorge to decide. I hope that he will decide, one way or the other, and decide soon, and make that decision public soon as well. Now, I expect that I'll get a few hasty flames in response to this mail, but I don't mean to attack anyone personally. That said, there is a *very* small number of people who could make a huge difference to the dillo project by their actions, and I hope that they will read this message as constructive. I would still hope, and would definitely like to be able, to draw on dillo as a working solution in the future, as would many others. Sincere best wishes to *all* recipients on the dillo-dev- list, Mark PS Apologies for the length of this message. I guess it shows that I kept quiet for too long. ___________________________________________________________ Now you can scan emails quickly with a reading pane. Get the new Yahoo! Mail. http://uk.docs.yahoo.com/nowyoucan.html

March 20, 2007

Re: [Dillo-dev] LinuxBIOS with X Server Inside

by Jorge Arellano Cid

Hi Alan, On Mon, Mar 19, 2007 at 08:45:38AM -0300, Alan Carvalho de Assis wrote: > Hi Jorge, > > 2007/3/12, Jorge Arellano Cid <jcid(a)dillo.org>: > > Hi Alan. > > > > Unfortunately there's no much point in doing it without developers... > > > > (except for the hope of attracting developers :-) > > > > I don't understand why nice projects as Dillo, Linux-Tiny and other > don't attract developers. Actually, Dillo attracts developers, it is the high time dedication and specific expertise it demands what stops most of them. > > > I'll watch the video tis week! And I did. Congratulations, a very interesting demo! > I think will be hard to integrate Dillo inside it, the BIOS flash > (2MB) don't left space, but maybe using LZMA I will get 500KB. jcid@infinity:~/C/Dillo/proto/dillo-f15/src$ ls -l dillo-fltk.gz -rwxr-xr-x 1 jcid users 373895 Mar 20 08:14 dillo-fltk.gz* > Did you tested to compile Dillo FLTK with uClibc? Not personally but other guys have succeeded in doing it. -- Cheers Jorge.-

March 20, 2007

Re: [Dillo-dev] LinuxBIOS with X Server Inside

by Alan Carvalho de Assis

Hi Jorge, 2007/3/12, Jorge Arellano Cid <jcid(a)dillo.org>: > Hi Alan. > > Unfortunately there's no much point in doing it without developers... > > (except for the hope of attracting developers :-) > I don't understand why nice projects as Dillo, Linux-Tiny and other don't attract developers. > I'll watch the video tis week! > I think will be hard to integrate Dillo inside it, the BIOS flash (2MB) don't left space, but maybe using LZMA I will get 500KB. Did you tested to compile Dillo FLTK with uClibc? > -- > Cheers > Jorge.- > Cheers, Alan

March 19, 2007

Re: [Dillo-dev] LinuxBIOS with X Server Inside

by Jorge Arellano Cid

On Fri, Mar 09, 2007 at 09:44:30AM -0300, Alan Carvalho de Assis wrote: > Hi guys, Hi Alan. > as I said before I am developing a minimal graphic distro Linux. Now I > extended the idea and place everything inside BIOS. > > There is the video: > > http://www.youtube.com/watch?v=nuzRsXKm_NQ > > I hope Dillo FLTK become free soon, Me too! Unfortunately there's no much point in doing it without developers... (except for the hope of attracting developers :-) > then we can integrate it inside BIOS > too. > > I am developing the tutorial at > http://www.linuxabordo.com.br/wiki/index.php?title=LinuxBIOS_Graphical > > I hope you enjoy! I'll watch the video tis week! -- Cheers Jorge.-

March 12, 2007

LinuxBIOS with X Server Inside

by Alan Carvalho de Assis

Hi guys, as I said before I am developing a minimal graphic distro Linux. Now I extended the idea and place everything inside BIOS. There is the video: http://www.youtube.com/watch?v=nuzRsXKm_NQ I hope Dillo FLTK become free soon, then we can integrate it inside BIOS too. I am developing the tutorial at http://www.linuxabordo.com.br/wiki/index.php?title=LinuxBIOS_Graphical I hope you enjoy! Cheers, Alan

March 9, 2007

Re: [Dillo-dev] PledgeBank ?

by Jorge Arellano Cid

Hi Vincent, On Fri, Feb 09, 2007 at 04:30:39PM +0100, Vincent Thomasset wrote: > Le Thu, 1 Feb 2007 08:56:47 -0300, > Jorge Arellano Cid <jcid(a)dillo.org> a écrit : > > > Hi Vincent, > > > > Raising some funds, and to create awareness of what the current > > status of the Dillo project is, looks like a good idea. It would > > be important to let the readers know that we seek funds to be > > able to quit our jobs and to dedicate full time to work on Dillo > > for at least a year (when hopefully we could have secured some > > enterprise funding to continue). > > > > This is simply a too fast a moving target for two developers > > to chase working after hours. > > I understand all of this, but i doubt the pledge could pay for this > all by itself. BTW, how much money do you think we should be aiming > for ? I thought about going with 10$ pledges but i'm not sure how many > between 1000, 2500 or 5000, 1000 probably being the reasonable choice. 20$ to reach 5000. At least that could give hope to being able to work again on it. The cost of life is not very high in Chile and donations may help. -- Cheers Jorge.-

Feb. 25, 2007

Web page update

by Jorge Arellano Cid

Hi there, As said sometime ago in this mailing list, I went to update the front page of Dillo's site to let our users know what the current status of the project is, and what we're doing/expecting. It is just a small section under the "Project Objectives". Please give it a read and send your feedback here if any. I know the "funding" link would benefit from an update, but sometime ago it was quite current and as it yielded no results, I'm not sure it to be worth the effort anymore ;-). Perhaps an alternative way could work better. -- Cheers Jorge.-

Feb. 25, 2007