Dears,
Over the past few days, I’ve been spending time reading through the
code, and I have some serious concerns about the project’s security and
long-term maintainability.
From what I’ve seen so far, security doesn’t seem to have received the
level of attention that a project of this nature requires. A browser is
one of the most complex and security-sensitive pieces of software to
develop. It handles untrusted content, executes code, manages network
connections, and exposes users to a huge attack surface. Security cannot
be something we address only after problems appear; it needs to be part
of the design and development process from the beginning.
Honestly, I don’t care whether the code was written by AI or by a human.
That’s not the point. What matters is the quality of the implementation,
how well the components are designed, how security issues are handled,
and whether the project can be maintained and improved over time.
Even established browsers like Chrome and Firefox, backed by large
engineering and security teams with years of experience, continue to
face vulnerabilities. They have extensive testing infrastructure,
security researchers, dedicated maintainers, and the resources to
respond to issues. Despite all that, keeping a browser secure is still
an enormous challenge.
That’s why I find the idea of one person independently developing and
maintaining a browser unrealistic in the long run, especially if the
goal is to deliver something secure, reliable, and suitable for everyday
use. Building an initial prototype is one thing; maintaining a secure
browser over years of development is an entirely different challenge.
A project like this needs a team, a clear security architecture, regular
code reviews, automated testing, fuzzing, dependency monitoring, and a
responsible process for handling vulnerabilities. It also needs
considerable time to mature and reach a level of stability that users
can trust.
My concern isn’t about discouraging development or dismissing the idea.
I’m concerned about setting realistic expectations and recognizing the
amount of work required to make this kind of software safe and
sustainable. Adding features quickly is not necessarily progress if the
underlying code is not secure and maintainable.
For these reasons, I don’t believe this browser should be accepted as a
Debian package in its current state. Debian has a responsibility to its
users to distribute software that can be maintained responsibly and
whose security risks have been properly assessed. A browser is
particularly sensitive because vulnerabilities can directly expose users
to malicious websites, compromised content, and other security threats.
have fun and be free
ali miracle
