Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 84.0

mozilla.org

Post reply on HN
Print view View original

161–170 of 328 posts

Re: Firefox 84.0

#161

Post by sfink »

syndacks wrote: post #130
AndrewDucker wrote: post #127

Earlier quoted context omitted.

I'm still stuck with the old Firefox for Android until extensions are generally supported. I'm really looking forward to that though, because other than extensions the new one looks great.

Same here. Is this slated for a future release? If so, do you know which one? I've been trying to find an authoritative source to signal when Android FF will support extensions (that previously worked but no longer do) -- any tips much appreciated.

You can see if it works for the extensions you care about -- https://blog.mozilla.org/addons/2020/09/29/expanded-extensio...

I wouldn't describe that as "support" quite yet, but it's worth giving a shot to see if it works for you.

Re: Firefox 84.0

#162

Post by mook »

pitaj wrote: post #114
Abishek_Muthian wrote: post #81

Earlier quoted context omitted.

What's intriguing to me is no primary password support on FF Android and yet it allows sync with FF protected with a primary password. DDG using Webview with built in ad-blocker seems to be the fastest android web browser I've ever used. I wonder whether it uses Chrome's data compression. But FF Android supports extensions, at least most used ones and I hope with support for more extensions its adoption could grow.

No primary password support? What do you mean? Bitwarden via Android autofill framework works great for me with FF.

I believe Mozilla renamed master password to primary password at some point; it's the password used to encrypt the internal password storage.

Re: Firefox 84.0

#163

Post by tux »

"Firefox now uses more modern techniques for allocating shared memory on Linux, improving performance and increasing compatibility with Docker."

Finally, now I can use Firefox again. I have an older box, about 10-years old :-) I see noticable speed improvement on linux. I only use few extensions with dark theme, like uBlock/uMatrix/Dark-Reader. I've been using "Ungoogled-Chromium" for the past few years. Its nice to see Firefox improving things on linux. Will definantly use it more now.

Re: Firefox 84.0

#164

Post by SomeHacker44 »

macspoofing wrote: post #37
jefftk wrote: post #9

And for developers: https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Rel... The biggest change from my perspective is "Firefox now ensures that localhost URLs — such as http://localhost/ and http://dev.localhost/ — refer to the local host's loopback interface (e.g. http://127.0.0.1 ). As a result, resources loaded from localhost are now assumed to have been delivered securely (see Secure contexts), and also w…

>This is great for local development. Not just. There is a niche for mixed web/native apps whereby the page is loaded from the web, but interacts (at least in part) with a locally hosted web-server.

Like Zoom. Joy.

Re: Firefox 84.0

#165

Post by jansan »

muizelaar wrote: post #80
jansan wrote: post #13

Earlier quoted context omitted.

GPU acceleration is not a magic bullet it seems. In our case drawing large SVGs suddenly becomes really slow when GPU rasterization is enabled. Chrome has the same problem. I really hope we will see more polishing in this area and maybe a cooperation between Chrome and Firefox developers?

Do you have an example url for this?

Here is a bug report that shows the issue on Chrome. It is roughly 7 times slower with hardware rasterization enabled:

https://bugs.chromium.org/p/chromium/issues/detail?id=114367...

This particular example is only slow on Chrome. Even if you move the edge of the shape into the viewport Firefox is much faster than Chrome. But I know from real life examples that Firefox becomes slow if handling large SVGs. I will have to investigate this and file a bug report.

Re: Firefox 84.0

#166

Post by akmittal »

bryanlarsen wrote: post #44
chinhodado wrote: post #11

I love Firefox, I use it everyday, I can't imagine using a browser without Tree Style Tab, or all the things that I can do in about:config. At the same time, I can't shake off the dreadful feeling that it will eventually die one day. The market share keeps falling year by year. What is the most realistic future for Firefox?

Firefox is way too valuable as a hedge against Google hegemony to let die. If they ever lose the Google search money hose and become threatened I do expect a Google competitor to realize that and step in with some funding. Microsoft basing Edge on Chromium was a really stupid move on their part for this reason, and I suspect they are starting to realize it. That being said, I only expect it to be maintained at a hedg…

>Microsoft basing Edge on Chromium was a really stupid move on their part for this reason,

It is not true at all. After a long time Microsoft's browser share in increasing. They probably are quite happy about it,.

Re: Firefox 84.0

#167

Post by lxgr »

ducktective wrote: post #99
distances wrote: post #60

Earlier quoted context omitted.

What's the drama on Android? It's been working great for me for years now.

Same but I've disabled its updates since like a year.

Is that a good idea though, considering that your browser is arguably the largest attack surface there is on your computer?

Re: Firefox 84.0

#168

Post by cycomanic »

jackewiehose wrote: post #123
CJefferson wrote: post #51

Is anyone else worried Firefox on Android is becoming increasingly unusable? How well supported is it my Mozilla I wonder. I often find pages render as blank pages until I refresh, and scrolling will often hang for multiple seconds. I was playing "Jackbox Games" (which is played via the web and PC), and I found those of us on Firefox found the text boxes were broken. Just downloading PDFs was broken for several weeks…

I'm very unhappy with the new FF mobile. The user interface is worse than before in every(!) aspect. There's not a single improvement. And everything feels slower. And there is no offline browsing. On a mobile browser! WTF?! And there is no way to save websites. On a mobile browser, which has very limited connectivity due to its nature. This is just sad. There was a time when I was happy to read about a new FF versio…

I'm completely the opposite. Always had firefox installed on my phone, but it was just too slow and buggy before. When the new FF mobile came out as preview it pretty much became my only browser. I've used chrome maybe max 3 times last month. It's way faster in my experience. Ad-block works great (one of the issues I had with previous FF on android, extensions would easily bring it to a crawl), and I like how they reworked the UI, I still can't believe nobody thought about putting the location bar on the bottom before.

I do also see the blank screen rendering from time to time. However, I have encountered similar things on chrome as well, typically a refresh fixes it. There are some webpages that really don't seem to want to render on FF mobile though (not sure if because of UBO or something else), that's the only time I switch to chrome.

Re: Firefox 84.0

#169

Post by minitech »

pimterry wrote: post #149
bayindirh wrote: post #144

Earlier quoted context omitted.

> For example did you know that cups runs a web server at http://localhost:631 A typical Linux installation can run much more web servers on localhost. I run transmission-daemon, syncthing, cups, sometimes pagico (which is a desktop app which runs a php/web server backend on loopback). I guess that Firefox folks have thought of this otherwise, it'd be patched pretty quickly.

CORS solves much of this - servers have to opt in to allowing these requests, just like any other cross-origin requests. Badwebsite.com in general cannot send a POST to bank.com/send-money from inside your browser, and similarly it cannot POST to localhost:631. There's caveats and of course servers can be configured insecurely, but this isn't a general risk by default.

Both of those requests can be sent. CORS just stops the response from being read. It’s up to web servers on localhost to assume they’re at just as much risk as any other non-local service, and they often fail to do so. (See also DNS rebinding that nets an attacker the opposite set of permissions, in a sense.)

Re: Firefox 84.0

#170

Post by radlad »

est31 wrote: post #107
macspoofing wrote: post #37

Earlier quoted context omitted.

>This is great for local development. Not just. There is a niche for mixed web/native apps whereby the page is loaded from the web, but interacts (at least in part) with a locally hosted web-server.

I think it's a problem from a security point of view to allow websites to do this. Often the server that runs on localhost is poorly secured and may even expose "Access-Control-Allow-Origin: *" headers. And even if it doesn't, the browser still has to run a request to find out whether such a header is present, so some attacker controlled data does end up in these services. This in turn can be used for attacks. Maybe…

One use case is to allow secure authentication.

For example, some software, such as VPN clients, will now open the authentication page in a Chrome/Firefox web browser, rather than in an embedded browser - this is a security win! It affords the ability to use WebAuthn/U2F, password managers, as well as an updated browser.

However, for this to work, you need to pass an authentication token back to the client - this is done by binding to a port locally, and exposing a webserver which receives an authentication token.

Duo Network Gateway[1] authenticates this way, and I'm sure others do as well. I know Palo Alto GlobalProtect, AWS CLI, and others offer web-based authentication now, but don't know specifics of their implementation. (I work at Duo.)

[1] https://duo.com/docs/dng#ssh-servers-diagram

Post reply on HN