On Mon, Oct 19, 2026 at 9:20 PM Gard Spreemann <[email protected]> wrote: > Will there be churn of 20M more lines ("half a Firefox") between two Debian > releases?
I don't think so. However, a high rate of change in the source code could be a positive sign, that we are improving the actual product, constantly refactoring the code and doing real software engineering work, the way it can be done in 2026, using AI llms such as Claude, a state-of-the-art software development process for 2026. > I worry that the processes upstream are unacceptable. I fear that huge > chunks of Nordstjernen's code comes straight from an LLM without human > review whatsoever. I do not believe that this is a foundation for a > healthy Debian package. I'd love to be shown wrong. The process is typical for many open source projects on Github, these are some aspects of the current process: - There are frequent public releases, 34 so far, people use the browser and report bugs, we fix the bugs. See the essay The Cathedral and the Bazaar by Eric S. Raymond. https://en.wikipedia.org/wiki/The_Cathedral_and_the_Bazaar - The developers and I use the browser and see for ourselves how it functions on the websites we test it on. It is quite easy to see if the browser successfully supports a particular website just by watching it. - We review the source code, some parts manually, and frequently review the full source code using Claude with a specific focus, such as: - Security review - Updating dependencies - Performance profiling - Searching for memory leaks and infinite loops. - Reviewing the code with focus on the actual HTML and CSS specifications. - Continuous integration and tests run on Github, with various tools there for code quality. - The review of the code is more on a high-level abstraction, using the LLM as a tool for understanding the code. - We use web-platform-tests frequently to test the browser: https://web-platform-tests.org/ > What would happen if someone discovered a security issue (or legal issue, or RC bug, or whatever) in a version of Nordstjernen (hypothetically) shipped in Debian? If a security issue, or any issue is discovered, then it can be fixed as soon as possible. The browser is very secure, and we try to make design decisions with a security perspective. - The browser doesn't have a JIT compiler which is a common source for security vulnerabilities in Firefox and Chrome. - On Linux it uses Landlock in the kernel to restrict access control: https://docs.kernel.org/userspace-api/landlock.html >> Please see "Lehman's laws of software evolution", which is about software evolution and software decay: >> https://en.wikipedia.org/wiki/Lehman%27s_laws_of_software_evolution > >Forgive me, but could you spoonfeed me the point here? Manny Lehman (computer scientist) studied the evolution and decay of software, I encourage you to see his research, since it is relevant for the discussion of software maintenance. I remember reading some of his work as a student at NTNU. The point is to encourage studying the research on software evolution. For example he defined a law which states that " the quality of an E-type system will appear to be declining unless it is rigorously maintained and adapted to operational environment changes", which is relevant for this discussion about software quality and software maintenance. >> Nordstjernen was implemented initially using Claude, in the "AI-era", >> while Firefox and Chrome has been implemented over a very long time, >> and accumulated software bloat, decay and is more complex to maintain, >> in my opinion. > > Could you elaborate a bit on why you have come to hold this opinion, and > why Debian maintaners should share it? This is based on my own observations, I have previously studied the source code of Firefox to some extent in order to better understand it, and this was part of my motivation for creating this web browser project. You don't have to share my opinion on this. In summary, the development process of this web browser is adapted to the modern technology where AI LLM tools actually write the source code. We use AI LLM tools, manual testing on real websites, testing harnesses and testing on real users to improve the browser. What I have described here is how things have been done so far, of course the development process can be improved and changed as the project evolves and we get a better understanding, or if you have specific improvements to the process that you see are needed. Sincerely, Andreas Røsdal
