Tuesday, February 13, 2024

One less Un*xy option for 32-bit PowerPC

Most of you still using a Power Mac as a daily or occasional driver are probably either running Linux, Tiger or Leopard, and a minority on OS 9. Despite many distributions no longer shipping 32-bit PPC installs, Gentoo Linux still has specific support along with a few others, as does Adélie Linux if you like musl for breakfast. Still, for server duties, where I come from, you bring on the BSDs. In this blog you've already met my long-suffering NetBSD Macintosh IIci which is still trucking to this day and more recently my also-NetBSD G4 Mac mini (which later needed, effectively, a logic board swap), but I also have a Quadra 605 with a full '040 running NetBSD I use for utility tasks and at one time I ran an intermediate incarnation of gopher.floodgap.com on a Power Macintosh 7300 with a Sonnet G3 running NetBSD too. I stuffed that system full with a gig of RAM and a SATA card and it did very well until I got the current POWER6 server in 2010.

NetBSD has the widest support, continuing to run on most 68Ks and PCI Power Macs to this day (leaving out only the NuBus Power Macs which aren't really supported by much of anything anymore, sadly). However, OpenBSD works fine on New World Macs, and FreeBSD has a very mature 32-bit PowerPC port — or, should I say, soon will have had one, since starting in FreeBSD 15 (13.x is the current release), ARMv6, 32-bit Intel and 32-bit PowerPC support will likely be removed. No new 32-bit support will be added, including for RISC-V.

Even though I have a large number of NetBSD systems, I still like FreeBSD, and one of my remote "island" systems runs it. The differences between BSDs are more subtle than with Linux distributions, but you can still enjoy the different flavours that result, and I even ported a little FreeBSD code to the NetBSD kernel so I could support automatic restarts after a power failure on the G4 mini. The fact that the userland and kernel are better matched together probably makes the BSDs better desktop clients, too, especially since on big-endian we're already used to some packages just not building right, so we don't lose a whole lot by running it. (Usually those are the same packages that wouldn't build on anything but Linux anyway.)

This isn't the end for the G5, which should still be able to run the 64-bit version of FreeBSD, and OpenBSD hasn't voiced any firm plans to cut 32-bit loose. However, NetBSD supports the widest range of Macs, including Macs far older than any Power Mac, and frankly if you want to use a Un*x on a Power Mac and have reasonable confidence it will still be running on it for years to come, it's undeniably the one with the best track record.

Tuesday, September 19, 2023

Google ending Basic HTML support for Gmail in 2024

Understandably they're saying little about it publicly, but word is getting around that Google's fast, super-compatible Basic HTML mode for Gmail will be removed in a few short months. "We’re writing to let you know that the Gmail Basic HTML view for desktop web and mobile web will be disabled starting early January 2024. The Gmail Basic HTML views are previous versions of Gmail that were replaced by their modern successors 10+ years ago and do not include full Gmail feature functionality."

There are also reports that you can't set Basic HTML mode now either. Most of you who want to use it probably already are, but if you're not, you can try this, this, this, this or even this to see if it gets around the front-end block.

Google can of course do whatever they want, and there are always maintenance costs to be had with keeping old stuff around — in this case, for users unlikely to be monetized in any meaningful fashion because you don't run all their crap. You are exactly the people Google wants to get rid of and doing so is by design. As such, it's effectively a giant "screw you," and will be a problem for those folks relying on this for a fast way to read Gmail with TenFourFox or any other limited system. (Hey, wanna buy a Pixel 8 to read Gmail?)

Speaking of "screw you," and with no small amount of irony given this is published on a Google platform, I certainly hope the antitrust case goes somewhere.

Tuesday, September 12, 2023

WebP chemspill patch on Github

A fix is in the TenFourFox tree for MFSA 2023-40, a/k/a CVE-2023-4863, which is a heap overflow in the WebP image decoder. Firefox 45 would not ordinarily be vulnerable to this but we have our own basic WebP decoder using Google's library, so we are technically exploitable as well. I was working on a fix of my own but the PM27 fix that roytam1 cherrypicked is cleaner, so I've added that patch and one two (a followup was needed) more for correctness. Although this issue is currently being exploited in the wild, it would require a PowerPC-specific attack to be successful on a Power Mac. You do not need to clobber to update your build.

Thursday, August 31, 2023

August patch set for TenFourFox

The next patch set has landed, bringing the TenFourFox security base up to 115ESR. This includes the usual new certificate roots and updates to pins, HSTS and TLDs, as well as applicable security updates such as a full pull-up to the browser's SCTP support (not that this is frequently used in TenFourFox but rather to make future patches a little more tractable). On the bug fix side there is an update to the ATSUI font blocklist (thanks Chris T) and a wallpaper for a JavaScript-related crash on apple.com (thanks roytam1). Finally, basic adblock has been made stricter and is now also targetting invasive fingerprinting scripts. This adds a bit more overhead to checking the origin but that all runs at native C++ speed, and ensures we're less likely to get bogged down running JavaScript that we'd really rather not.

As this is a base pullup, building this time around will require a full clobber, so be sure to clear out everything before you begin.

For our next set, I'm thinking of an update to Reader Mode, since I firmly believe that's one of the most useful modes to run TenFourFox in on limited Power Mac hardware. That's why we made it sticky and provided a way to automatically open it by site (under Preferences, TenFourFox) — on resource-limited systems a resource-light view of a resource-heavy page is pretty much the way to go. And isn't everything resource-heavy to a Power Mac?

Sunday, July 16, 2023

Floodgap downtime

Just a quick note: Floodgap is down due to upstream issues beyond their control. I'm hoping we'll be back up in a day or two more. Sorry about that. E-mail still works, so anything you've sent me will still get through; this only affects the Web and gopher servers.

Monday, June 5, 2023

Apple provides grated cheese with the wine

Today Apple asked, would you like cheese with your wine?

It's nice that the stench of Intel has finally drifted off Apple's product line, leaving us once again with a RISC cheese grater atop the heap. Still, though (seriously now), no discrete GPUs for those six PCIe slots? Does this mean you're stuck with the MKULTRA M2 Ultra's? That's like throwing a party where you have to wear headphones to hear the music. But at least if you were using it for virtualized x86_64 workloads, Rosetta 2's got you covered, and no one's gonna pull an IBM QuickTransit this time — suggesting x86_64 binaries will have a far longer shelf life on Apple silicon than PowerPC binaries ever did on Intel. At $7000 for the base model, though, I think I'll stick to my Raptor Talos II.

Apple also proved themselves able and willing to compete in drinking games with macOS Sonoma (but fine vintages, mind you), so start your photocopiers. Quick, drink if you thought Apple would basically bring back the Dashboard, which is the first thing I disable when installing Tiger from scratch. If you're Mozilla, drink if you thought Apple would rip off Firefox containers in Safari. And, well, I should have a drink too, because now Power Mac upgraders will get a built-in TenFourFoxBox for desktop web apps. We didn't get macOS Arvin, macOS Edison (now with more power saving features!) or macOS Chico, but don't worry: it will still cost Peanuts.

Don't get me started on that goggles thing.

Thursday, April 20, 2023

April patch set for TenFourFox

As promised, there are new changesets to pick up in the TenFourFox tree. (If you're new to rolling your own TenFourFox build, these instructions still generally apply.) I've tried to limit their scope so that people with a partial build can just pull the changes (git pull) and gmake -f client.mk build without having to "clobber" the tree (completely erase and start over). You'll have to do that for the new ESR when that comes out in a couple months, but I'll spare you that today. Most of these patches are security-related, including one that prevents naughty cookies which would affect us as well, though the rest are mostly crash-preventers and would require PowerPC-specific attacks to be exploitable. There is also an update to the ATSUI font blacklist. As always, if you find problematic fonts that need to be suppressed, post them to issue 566 or in the comments, but read this first.

However, there is one feature update in this patchset: a CSS grid whitelist. Firefox 45, which is the heavily patched underpinning of TenFourFox FPR, has a partially working implementation of CSS grid as explained in this MDN article. CSS grid layout is a more flexible and more generalized way of putting elements on a page than the earlier tables method. Go ahead and try to read that article with the current build before you pull the changes and you'll notice that the page has weirdly scrunched up elements (before a script runs and blanks the whole page with an error). After you build with the updates, you'll notice that while the page still doesn't lay out perfectly right, you can now actually read things. That's because there's a whitelist entry now in TenFourFox that allows grid automatically on developer.mozilla.org (a new layout.css.grid.host.developer.mozilla.org preference defaults to true which is checked for by new code in the CSS parser, and there is also an entry in the problematic scripts filter to block the script that ends up blanking the page when it bugs out). The other issues on that page are unrelated to CSS grid.

This will change things for people who set the global pref layout.css.grid.enabled to true, which we have never shipped in TenFourFox because of (at times significant) bugs in the implementation. This pref is now true, but unless the URL hostname is in the whitelist, CSS grid will still be disabled dynamically and is never enabled for chrome resources. If you set the global pref to false, however, then CSS grid is disabled everywhere. If you were using this for a particular site that lays out better with grid on, post the URL to issue 659 or in the comments and I'll consider adding it to the default set (or add it yourself in about:config).

The next ESR (Firefox 115) comes out end of June-early July, and we'll do the usual root updates then.