InformAction Forums

Those who are keeping a close eye on NoScript development will be aware that the rapid-release schedule for Firefox is causing a lot of problems, with new versions frequently breaking NoScript's core functionality. If you're concerned about the future of Firefox as a product, and you're running Microsoft Windows, you could try the Pale Moon browser.

In a nutshell: It's a fork of Firefox, reusing 99% of it, but optimised for performance, released only for Windows, and reverting many of the user interface changes that Mozilla has applied since Firefox 4.

For example, it restores the status bar (by integrating the Status-4-Evar addon), removes parental controls and accessibility features (for performance reasons), removes the silent-update functionality, and cherry-picks changes from Fx rather than following the rapid-release schedule. It does update major version numbers for compatibility reasons, but doesn't apply all of Mozilla's changes.

For those who really hate Firefox 4 and everything about it, Pale Moon also has a 'legacy' branch equivalent to Firefox 3.6. Unfortunately it has now been discontinued, but it includes several bugfixes after Mozilla dropped 3.6.

The Pale Moon homepage is http://www.palemoon.org. The developer lists the interface changes and reasons here.

ETA: This post represents only my personal findings about a product with relevance to NoScript users. Pale Moon is not officially endorsed by the forum, nor is it an officially-supported platform for NoScript (although, since it uses mostly the same codebase as Firefox, it can work, as noted on the NoScript download page).

Oct 12, 2012 4:52 pm
Since I've got a few questions from concerned users of Pale Moon about the currently released version 15.2 in relation to Mozilla pulling their Firefox version 16.0 from the download servers in an emergency stop of distribution:

The critical security issue that had Mozilla pull Firefox 16.0 off the wire is N/A for Pale Moon!

The issue is in new code added to the Firefox 16 code base, which is not being used in Pale Moon. The security issue and Mozilla's 16.0.1 emergency fix for it do not apply to any version of Pale Moon.

OK, fine.

But now what about the 3 security related fixes in 16.0.2?
Does he even have access to those bugs (still restricted at this point) to even know what they are about (except in the most general sense)?

Are PM15.2 users exposed to those?

And you've got to remember, that some of these security fixes are back-ported to FF 10 ESR. So if 10 is getting them, shouldn't PM? Was the 16.0.1 fix back-ported? If so, you would think it would be necessary in PM too?

(No I'm not expecting you to know the answer.)

Just that until some response comes from PM, we don't know.

Plus I don't really see how using PM does anything to appease issues between rapid-release & extension development.

therube wrote: But now what about the 3 security related fixes in 16.0.2?
Does he even have access to those bugs (still restricted at this point) to even know what they are about (except in the most general sense)?

Probably not, if they're restricted. You win some and lose some, I guess.

And you've got to remember, that some of these security fixes are back-ported to FF 10 ESR. So if 10 is getting them, shouldn't PM? Was the 16.0.1 fix back-ported? If so, you would think it would be necessary in PM too?

Probably...depends on where they occur in the codebase, but chances are that PM is affected. I guess it depends on how much time the developer has; like NoScript, it's a one-man project.

(No I'm not expecting you to know the answer.)

Just that until some response comes from PM, we don't know.

True enough. I guess we can gauge the developer's effectiveness by how quickly+well he responds to situations like these.

Plus I don't really see how using PM does anything to appease issues between rapid-release & extension development.

Well, since PM is just cherry-picking changes, theoretically it should break extensions less often. As mentioned earlier, the major version number gets incremented just for compatibility reasons; the codebase is mostly Fx 12. But it does depend on what gets cherry-picked, of course.

YMMV. Personally, I've tinkered with it, but as I'm running Ubuntu, I have to run it via Wine, which is slower and less convenient. So I mostly stick to Fx - but if I can ever get a native Linux build sorted out, I'll put it through its paces much more thoroughly. Due to my lack of experience with building from Fx source, the one time I tried to build PM from source, I ended up with something that mostly looked like Pale Moon, but called itself Nightly, and I think used the Fx default homepage instead of the PM one. Guardian could probably do it right.

Well, once the fixes get merged into the public developement tree (like the release one) the PM dev might try to find and then back-port the fix even without access to the bug ticket.

And concerning building Firefox (at least the official kind), when I last tried building it under Linux it was child-play compared to what hoops you had to jump through to get a good Windows build (not to mention the longer build time).

I too was concerned about the 16.x fixes. However, for various reasons I sometimes use last F3, 3.6.28. He took it a bit farther, patching some things, including a couple of potential security issues IIRC, that were found after 3.6.28 lost support. He took it to his 3.6.32.

Still doesn't eliminate the risks of using an unsupported browser, of course, but perhaps cuts it a bit.

As for speed, yes, it seemed very fast, but when I ran the same route with Fx, it seemed just as fast. Being a mimimalist who does not keep 20 or 50 or 100 tabs open , I didn't see a difference. Haven't had time to play with heavy loads (video, streaming, etc.) to see if there is a noticeable difference.

As for the latest release versions, I tend to agree with therube that it might not be an overall gain. If F17 is released and includes security fixes, then X weeks later F18 is released and includes security fixes, not only are we annoyed by the stuff that breaks, but we have to be worried about whether PM will include those fixes, and how rapidly. If indeed PM doesn't cause the regressions that rapid-release is "rapidly" becoming famous for, yes, that's a win. Only time will tell on that -- unless someone has long-term experience with PM?


ETA: His migration tool for carrying your settings from Fx to PM is very convenient. The portable version is a nice plus, too. Unfortunately, the migration tool doesn't work if either browser is portable -- it looks in the expected HD locations for both profiles. However, synching manually, as in someone's sticky post, works on the portables, too, although the locations are a bit different between (port) Fx and PM.

Update: I have a Linux build of Pale Moon 15.2.1, if anyone wants to try it. It took some tweaking to fix the build process, and I'm still new to the subject, so absolutely no guarantees, but I'm working with the Pale Moon author to fix it up and submit it as a contributed build.