Note

This is a submitted post, and it's being published as is, except for this note and a section at the end, based on editorial examination. Short form: it's real, and it works, and it's interesting.

A program is free software if it respects the freedom of its users. Specifically, the users must have four essential freedoms: the freedom to run the program as they wish (freedom 0), the freedom to study and change its source code (freedom 1), the freedom to redistribute exact copies (freedom 2), and the freedom to distribute modified versions (freedom 3). With these freedoms, the users control the program. Without them, the program controls the users, and its developer controls the program.

The browser is where this question matters most. It is the program through which people read, write, bank, vote and talk to each other. It runs code sent by strangers all day long. If any program should be under its users' control, it is this one.

The freedom nobody can exercise#

Several browsers are free software in the legal sense. Their source code is published under free licenses. That is essential, and we should be grateful for it.

But consider freedom 1 in practice. The three engines that nearly every browser is built on each run to tens of millions of lines. No person can read one. A community of volunteers cannot realistically maintain an independent version of one. In practice, only a company with hundreds of paid engineers can decide what such a program does, and so the direction of the web is decided by a few companies, whatever the license says.

Freedom that cannot be exercised is freedom in name only. The license is necessary. It is not sufficient.

This is one place where the difference between "free software" and "open source" shows. The open source idea asks whether the source can be seen and whether the development model is efficient. The free software movement asks whether the users are in control. A program too large for its users ever to understand fails the second question even when it passes the first.

A browser small enough to be controlled#

Nordstjernen is a browser engine written from scratch. It contains no code from Blink, WebKit or Gecko. The complete browser is about 268,000 lines of C, which is small enough for one person to read and audit from beginning to end.

It is not a toy. It runs service workers, IndexedDB, WebAssembly, WebGL and extensions, and it plays video from the large streaming sites. Measured against the shared test suites, it passes 91.5% of the web-platform-tests subtests for HTML, DOM and URL, 73.2% for CSS, and all 82,248 tests of test262. We publish the weak results as well as the strong ones, because users are entitled to know what the program does and does not do.

It is released under the GNU General Public License, version 3 or later. The GPL is a copyleft license: everyone who receives the program receives the four freedoms, and nobody may strip them from a modified version. This matters. A browser under a lax license can be taken, made proprietary, and turned against its users. A copylefted browser cannot.

What the browser refuses to do#

A free program can still mistreat its users if its developers choose to. So it is worth stating what Nordstjernen does not do.

It does not report on you. There is no telemetry, there are no update pings, there are no "studies" and there is no account. It checks sites against Google Safe Browsing by default, but the lists are kept on your machine, only a 4-byte hash prefix is sent when an address matches one, and you can turn the feature off in Settings.

It does not implement Digital Restrictions Management. Encrypted Media Extensions exist to restrict what you may do with your own computer, and they are outside the scope of this project. They will stay there.

It contains no JIT compiler. JavaScript and WebAssembly are interpreted, so no page is ever given memory that is both writable and executable. Each tab runs in its own sandboxed process.

One caution is in order. A free browser does not make the web free. Most sites send nonfree JavaScript programs to your machine, and running them in a free browser does not make them free. What a small, readable browser gives you is the ability to decide: to block, to inspect, and to change how the browser treats what it is sent.

Three browsers#

One implementation of a standard is not a standard. It is a single program whose behavior everyone else must copy. Independent implementations are what keep the web from being the property of whoever maintains the dominant engine. That is the reason to write another browser.

We wrote three, because building the same design in different ways tells us what each choice costs.

Nordstjernen Sol is the full browser, with tabs, a sandboxed process per tab, developer tools, WebDriver, and a binding that lets Java programs drive the engine in a separate process. It runs on GNU/Linux, the BSDs, Android, macOS and Windows.

Southstar is Sol rewritten in Rust, with the Boa JavaScript engine, in about 385,000 lines. It holds no C code of its own.

Northstar is the minimalist: one process, one page per window, about 219,000 lines of C.

Why Northstar is the future#

Sol may be used under the GPL, and so it is free software. It is also offered under a second license, the Nordstjernen Source License, which forbids use in a competing browser. That license is not a free software license. You are never obliged to accept it, but its presence is a complication.

Northstar has no such complication. It is licensed under the GNU GPL version 3 or later, and nothing else. Every user receives the same four freedoms on the same terms.

It is also the edition in which those freedoms are easiest to use. Its HTML parser and JavaScript engine are unmodified upstream releases, so there are no private forks to understand. There is one process, so there is no internal protocol to learn before changing anything. And it is the smallest of the three. A person who wants to know what their browser does can sit down and find out.

That is what a browser should be: a program its users can read, change and share, in practice and not only in principle.

Getting it#

The best way to get a free program is as source code, which you build yourself:

git clone https://github.com/nordstjernen-web/northstar-web-browser.git
cd northstar-web-browser
meson setup builddir && meson compile -C builddir

Packages for GNU/Linux distributions (.deb and .rpm) are published with each Sol release, and there are build recipes for Arch, Alpine, FreeBSD and NetBSD. The browsers can also be installed through npm, which builds them from source.

Builds also exist for Windows, macOS and Android. Those systems, and the stores that distribute programs for them, do not respect your freedom. We publish there because people who have not yet escaped them deserve a browser that does not spy on them. We hope it is a first step and not the last.

The source code and documentation are at nordstjernen.org. Read it, change it, and share your changes.

Editor's Notes#

I tried the Northstar browser, by following the specific installation instructions (because I have MacOS). It works; it's very bare-bones, and looks very GTK (no surprise there), and it even opens up https://bytecode.news/ properly - but the masthead animations don't work yet. It is, however, functional, and very fast, and it builds in about sixty seconds. I haven't tried the JavaFX integration. But it's surprisingly good for the investment of time so far.