Icy Weasel
A macOS browser built for security first, blocking second, and speed close behind.
Native Swift/SwiftUI on WebKit, with a filter compiler, fingerprinting defence and
security policy layer that were each verified against the real engine rather than
written from documentation.
Engine: WebKit, not Chromium. A Chromium fork needs ~70–100 GB of build space
(this machine had 96 GB free) and hours per build; embedding Chromium via CEF means
shipping and patching a ~250 MB engine yourself. WebKit is patched by Apple with the
OS, compiles content-blocking rules to native bytecode, and exposes engine-level
security switches (no-JIT, Lockdown) that no extension can reach. The trade-off:
some sites sniff for Chrome, and there is no browser-extension support.
What is verified
Numbers below come from the test suite, not estimates. Network-dependent tests run with
TEST_RUNNER_IW_NETWORK_TESTS=1 (see Testing).
Blocking — live A/B experiment (RealWorldBlockingTests)
The same page loads 20 real tracker endpoints and 7 legitimate resources, once with
Icy Weasel's lists (A) and once with none (B). B proves each endpoint is reachable, so
a failure under A is attributable to blocking.
| Result |
|---|
| Reachable trackers blocked | 19 / 19 (Google Analytics & Tag Manager, DoubleClick, AdSense, Meta Pixel, Hotjar, Criteo, Taboola, Outbrain, comScore, Pinterest, TikTok, LinkedIn, Clarity, Amazon Ads, Mixpanel, HubSpot, Bing UET, Quantcast) |
| Legitimate resources broken | 0 / 7 (jQuery, lodash, React, htmx, Wikimedia, GitHub, MDN) |
| Requests completed | 27 → 7 |
Real pages (RealWorldBlockingTests, 6 alternating runs per arm, medians)
| Page | Requests | Third-party hosts | DOMContentLoaded | load event |
|---|
| speedtest.net | 95 → 25 | 52 → 6 | 608 → 616 ms | 616 → 629 ms |
| cnn.com | 87 → 77 | 15 → 11 | 612 → 466 ms | 1098 → 1092 ms |
| theguardian.com | 86 → 76 | 4 → 3 | 255 → 369 ms | 414 → 561 ms |
Blocking removes most requests and third-party connections on ad-heavy sites. Its
effect on load time is mixed, and reported as measured: faster on CNN, neutral on
Speedtest, and about 0.1 s slower on The Guardian — a lean page with little to block,
where WebKit's per-request rule matching is the dominant cost. See Speed.
How the rules are laid out
WebKit's ignore-previous-rules cancels only rules above it in the same list, and
lists cannot see each other. The compiler turns that into structure:
- Two families of lists. Cosmetic lists: generic hiding →
$generichide
exceptions → site-specific hiding → $elemhide exceptions → $document exceptions.
Network lists: blocks → request exceptions → $document exceptions. A
$generichide exception therefore can never unblock a network request — the bug
that briefly let @@||bing.com^$generichide unblock bat.bing.com everywhere.
- Site-specific hiding is document-scoped: the site is in the url-filter with
resource-type: document, not .* + if-domain. A .* trigger makes a rule a
candidate on every resource load; 12k of them cost The Guardian ~120 ms of parsing.
- Rules are never merged into selector lists. WebKit's compile-time selector
validation has gaps (an unterminated
[ compiles), and a merged rule with one such
selector silently hides nothing.
- Redundant rules are pruned: a block covered by an unconditional
||parent^
rule is removed; this cannot change any outcome.
- Bisect on compile failure drops a bad rule, or splits a list that is merely too
large — it never discards a chunk.
Filter compiler (RealFilterListTests, CompilerTests, WebKitIntegrationTests)
| Result |
|---|
| Source lines (7 default lists) | 264,852 |
| Rules active | 230,291 in 3 compiled lists (2 network, 1 cosmetic) |
| Rules WebKit rejected | 0 |
| Unsupported syntax, skipped and counted | 5,879 (mostly 2,786 uBO +js() scriptlets) |
| Duplicates removed across lists | 22,662 |
Redundant rules pruned (covered by a ‖host^ rule) | 7,831 |
| First compile (per list or app update) | ~19 s, in the background, with a bundled seed list active meanwhile |
| Relaunch with compiled lists cached | ~5 ms |
| Compiled lists on disk | ~115 MB (in the app's container) |
Cost of the defaults (FingerprintDefenseTests.testInsertionAndInterpreterCost)
| Workload | Stock WebKit | Icy Weasel default | |
|---|
| 10k-cell table build + layout | 39 ms | 48 ms | 1.23× |
| Fingerprinting shim alone on that render | 39 ms | 42 ms | 1.08× |
Cosmetic filter stylesheet, style + layout (StyleCostExperiment) | 7 ms | 8 ms | ~1 ms |
| 30M integer operations (pure compute) | 7 ms | 647 ms | ~90× |
Same, switched per navigation as tabs do (ProductionPathTests) | 7 ms | 487 ms | 70× |
That last row is the one real speed cost, and it is deliberate — see
JavaScript engine.
This is the beginning of the README. Read the rest at the original. Read the full README ↗
