Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 84.0

mozilla.org

Post reply on HN
Print view View original

251–260 of 328 posts

Re: Firefox 84.0

#251

Post by cortic »

JoshTriplett wrote: post #246
cortic wrote: post #217

Earlier quoted context omitted.

> can change this in the configuration dialog, The options in config were greyed out in 83. > "proper menu system", do you mean.. The ability to make multi tier menu with icons or text instead of both >Doing so would result in running an outdated Doing so would result in a stable system that wouldn't just randomly disable all addons from working, security related addons at that.

> The options in config were greyed out in 83. I'm running Firefox 83, and those options are still available. It's critically important that Firefox support disabling telemetry. If you've edited those options via one of the lower-level preference systems, such as autoconfig.js, you may have locked them, which would cause them to show up as greyed out.

about:config and search toolkit.telemetry.enabled I checked on a fresh 83 and its greyed out.

You need to create the file firefox.cfg in install Dir and enter lockPref("toolkit.telemetry.enabled", false); To override it And to get that to work you need to create /defaults/pref/autoconfig.js with pref("general.config.obscure_value", 0); and pref("general.config.filename", "firefox.cfg.js");

Its getting harder and harder to make a good browser out of FF, I personally don't mind the work, but things like Lockwise replacing a working password manager without the needed options and no addons to fix it or workarounds, i can see it messing up fields in PasswordFox but can no longer do anything about it.

Re: Firefox 84.0

#252

Post by ce4 »

CameronNemo wrote: post #142
cpeterso wrote: post #117

Earlier quoted context omitted.

You can install any add-on from addons.mozilla.org in Firefox Nightly for Android: https://blog.mozilla.org/addons/2020/09/29/expanded-extensio...

IIRC fennec (from fdroid) is going to allow all add ons too.

Thanks for the info! What a relief, I'm currently still on v68 to not lose uMatrix, bypass paywalls, amp redirect to html, old reddit redirect and others.

I'm really waiting for this

Re: Firefox 84.0

#253

Post by mrlala »

Since this is a firefox thread, I have a very annoying bug that I haven't had much luck searching on... any luck here?

I really like the picture-in-picture feature of firefox. However, if I have a video in PiP mode and I click pause, randomly about 5-10 seconds later it unpauses and keeps playing. This happens on both Hulu and Netflix.. on multiple computers and has been going on for quite some time.

Seems like such a common thing I'm surprised it hasn't been fixed.

Re: Firefox 84.0

#254

Post by rgbrenner »

washadjeffmad wrote: post #27
chinhodado wrote: post #11

I love Firefox, I use it everyday, I can't imagine using a browser without Tree Style Tab, or all the things that I can do in about:config. At the same time, I can't shake off the dreadful feeling that it will eventually die one day. The market share keeps falling year by year. What is the most realistic future for Firefox?

It's being outpaced by other browsers in a rapidly expanding field, not falling in usage. Safari and Edge are defaults on iOS, MacOS, and Windows, and Chrome is the default on Android. I imagine we're primarily seeing the effects platform capture everywhere else.

Firefox says they have 200m monthly active users. In 2018, techcrunch wrote about that same report and said "this data shows a downward trend for monthly active Firefox users, which now measure about 250 million, down from well over 300 million last April."

So I would be concerned.. they're actively bleeding users... not just being outpaced in a growing market.

https://techcrunch.com/2018/08/28/mozilla-publishes-its-fire...

https://data.firefox.com/dashboard/user-activity

Re: Firefox 84.0

#256

Post by totetsu »

johnchristopher wrote: post #79
jefftk wrote: post #9

And for developers: https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Rel... The biggest change from my perspective is "Firefox now ensures that localhost URLs — such as http://localhost/ and http://dev.localhost/ — refer to the local host's loopback interface (e.g. http://127.0.0.1 ). As a result, resources loaded from localhost are now assumed to have been delivered securely (see Secure contexts), and also w…

Does it mean I can curl https://whatever.localhost without SSL warning for self signed certificates ? That would simplify my life when developing stuff on localhost and importing them between different things over http(s). edit: Kids, you see those articles that regularly hit the frontpage about work/life balance ? The ones about how you need healthy sleep patterns and crunching all night long is actually bad for you…

also isnt there an ignore ssl option in man crul?

Re: Firefox 84.0

#257

Post by d3nj4l »

cycomanic wrote: post #168
jackewiehose wrote: post #123

Earlier quoted context omitted.

I'm very unhappy with the new FF mobile. The user interface is worse than before in every(!) aspect. There's not a single improvement. And everything feels slower. And there is no offline browsing. On a mobile browser! WTF?! And there is no way to save websites. On a mobile browser, which has very limited connectivity due to its nature. This is just sad. There was a time when I was happy to read about a new FF versio…

I'm completely the opposite. Always had firefox installed on my phone, but it was just too slow and buggy before. When the new FF mobile came out as preview it pretty much became my only browser. I've used chrome maybe max 3 times last month. It's way faster in my experience. Ad-block works great (one of the issues I had with previous FF on android, extensions would easily bring it to a crawl), and I like how they re…

> I still can't believe nobody thought about putting the location bar on the bottom before.

This turned out to be a surprisingly big deal to me. Every time I have to use Chrome for some reason I am bothered by how out of the way the location bar is. I think some other browsers have tried to put it at the bottom, but none that are as popular as Firefox or Chrome.

Re: Firefox 84.0

#258

Post by radlad »

est31 wrote: post #184
radlad wrote: post #170

Earlier quoted context omitted.

One use case is to allow secure authentication. For example, some software, such as VPN clients, will now open the authentication page in a Chrome/Firefox web browser, rather than in an embedded browser - this is a security win! It affords the ability to use WebAuthn/U2F, password managers, as well as an updated browser. However, for this to work, you need to pass an authentication token back to the client - this is…

Interesting points, thank you. The cloud service could communicate with the local device's client through a separate connection though that the client opens with that cloud service, no need to do this via the local JS. The only benefit I could think of would be that it makes it easier to correlate the local client with the authenticating user, but you could just have a token that you make part of the URL the client v…

> Also it doesnt fully solve the correlation problem either, on the same computer, two clients could run under two different OS level accounts. Will it just send its authentication token to one of those clients?

When the request is made to the server, the port that is temporarily bound is also sent with the request. This tells the server what URL they should POST back to. The port is random for each authentication.

> The cloud service could communicate with the local device's client through a separate connection though that the client opens with that cloud service, no need to do this via the local JS.

FWIW, no Javascript necessary. Just a regular POST form & Location headers. In any case, you're right - you could open up a separate connection to the server with a correlation ID, and include the same correlation ID in the initial request to the authentication server, and then upgrade the connection's permissions after the fact. You ought to be careful of session fixation attacks here. (Attacker can send Victim a link, and when Victim authenticates, Attacker is logged in. With a local web server receiving the token, when Victim authenticates, they see an error instead.)

As always, there's engineering tradeoffs in building different solutions. Some factors (besides concerns around session fixation) that may come into play:

- Typically, the authentication and authorization step occurs prior to opening a tunnel or long-lived connection. Shifting when this occurs can have unexpected or unwanted side effects. In the case of the DNG, which protects web applications in addition to SSH servers, authentication is typically provided via cookies, and so the tunnel opened for SSH is actually a sort of Websocket connection. With the approach I have described, authentication occurs prior to upgrading the HTTP request into a Websocket, in the same manner it does for web applications. In the approach you suggest, this would have to flip a bit, meaning re-implementing authentication inside the Websocket connection itself.

- What if the authentication server is not the service provider? For example, in the SAML ECP profile, the client negotiates an authentication token from the authentication server on behalf of the service provider. It then takes this token back to the service provider for cryptographic verification. You could instead teach the authentication server how to talk to the service provider directly (e.g. the HTTP-Artifact protocol) - but this works better if you own both the IdP and the SP. In many cases, customers may bring their own identity provider (e.g. Okta) with them to the service provider (e.g. GlobalProtect.)

Re: Firefox 84.0

#259

Post by koolba »

Did they fix the bug where you couldn’t search for empty strings using quick search hot keys?

Previously a search for an empty string would go to the quick search link with an empty query. The previous release wouldn’t let you submit the search without a non-white space query. Which breaks using the quick searches as bookmarks.

Re: Firefox 84.0

#260

Post by radlad »

minitech wrote: post #169
pimterry wrote: post #149

Earlier quoted context omitted.

CORS solves much of this - servers have to opt in to allowing these requests, just like any other cross-origin requests. Badwebsite.com in general cannot send a POST to bank.com/send-money from inside your browser, and similarly it cannot POST to localhost:631. There's caveats and of course servers can be configured insecurely, but this isn't a general risk by default.

Both of those requests can be sent. CORS just stops the response from being read. It’s up to web servers on localhost to assume they’re at just as much risk as any other non-local service, and they often fail to do so. (See also DNS rebinding that nets an attacker the opposite set of permissions, in a sense.)

That's not actually true, at least via Ajax. Certainly you can just throw a POST at the website, and we hope that any web server is secured with CSRF protection. Additionally, the SameSite changes recently introduced by Chrome should further mitigate this problem.[1]

> The Cross-Origin Resource Sharing standard works by adding new HTTP headers that let servers describe which origins are permitted to read that information from a web browser. Additionally, for HTTP request methods that can cause side-effects on server data (in particular, HTTP methods other than GET, or POST with certain MIME types), the specification mandates that browsers "preflight" the request, soliciting supported methods from the server with the HTTP OPTIONS request method, and then, upon "approval" from the server, sending the actual request. Servers can also inform clients whether "credentials" (such as Cookies and HTTP Authentication) should be sent with requests.[2]

[1] https://www.chromium.org/updates/same-site/faq

[2] https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS

Post reply on HN