Firefox 93

#1

Post by NiekvdMaas » Tue, Oct 05, 2021, 1:30 PM UTC

Firefox 93
mozilla.org

Re: Firefox 93

#2

Post by huuuz » Tue, Oct 05, 2021, 1:55 PM UTC

How are downloads performed over http "potentially malicious"?

Re: Firefox 93

#3

Post by kevingadd » Tue, Oct 05, 2021, 1:57 PM UTC

huuuz wrote: post #2

How are downloads performed over http "potentially malicious"?

They can be MITM'd by anyone on a hop between you and the server, and unless they're an authenticode-signed exe they could also have been subtly tampered with at rest

Mind you, HTTPS doesn't mean downloads are safe. Not remotely so. HTTP just means they're way less safe, and if you're on a HTTPS website it definitely should not be serving downloads over HTTP

Re: Firefox 93

#4

Post by CodesInChaos » Tue, Oct 05, 2021, 1:57 PM UTC

huuuz wrote: post #2

How are downloads performed over http "potentially malicious"?

A MitM (e.g. an untrusted WiFi network) could replace a download by a malicious version.

Re: Firefox 93

#5

Post by CodesInChaos » Tue, Oct 05, 2021, 1:58 PM UTC

huuuz wrote: post #2

How are downloads performed over http "potentially malicious"?

I wonder what "insecure connection" means. Does that include `http://localhost`?

Re: Firefox 93

#6

Post by huuuz » Tue, Oct 05, 2021, 1:59 PM UTC

CodesInChaos wrote: post #4

huuuz wrote: post #2

How are downloads performed over http "potentially malicious"?

A MitM (e.g. an untrusted WiFi network) could replace a download by a malicious version.

In that case the html text of the page could be replaced by the attacker so the download link points to an https link.

Re: Firefox 93

#7

Post by theandrewbailey » Tue, Oct 05, 2021, 2:02 PM UTC

> Firefox now supports the new AVIF image format

PARTY!

I've been waiting for this for a long time. The last big hurdle for this was that color spaces weren't applied correctly.

If you haven't taken a look at AVIF, do. You can get a similar looking image in AVIF at half the size as a JPEG. I find AVIF's image artifacts preferable to JPEG's.

Re: Firefox 93

#8

Post by wongarsu » Tue, Oct 05, 2021, 2:03 PM UTC

CodesInChaos wrote: post #5

huuuz wrote: post #2

How are downloads performed over http "potentially malicious"?

I wonder what "insecure connection" means. Does that include ` http://localhost `?

I would expect the same rules as for secure contexts [1], namely "Locally-delivered resources such as those with http://127.0.0.1 URLs, http://localhost and "http://*.localhost URLs (e.g. http://dev.whatever.localhost/), and file:// URLs are also considered to have been delivered securely."

1: https://developer.mozilla.org/en-US/docs/Web/Security/Secure...

Re: Firefox 93

#9

Post by Semaphor » Tue, Oct 05, 2021, 2:07 PM UTC

huuuz wrote: post #6

CodesInChaos wrote: post #4

Earlier quoted context omitted.

A MitM (e.g. an untrusted WiFi network) could replace a download by a malicious version.

In that case the html text of the page could be replaced by the attacker so the download link points to an https link.

It’s for https sites that link http downloads.

Re: Firefox 93

#10

Post by yboris » Tue, Oct 05, 2021, 2:08 PM UTC

theandrewbailey wrote: post #7

> Firefox now supports the new AVIF image format PARTY! I've been waiting for this for a long time. The last big hurdle for this was that color spaces weren't applied correctly. If you haven't taken a look at AVIF, do. You can get a similar looking image in AVIF at half the size as a JPEG. I find AVIF's image artifacts preferable to JPEG's.

I'm looking forward to the wide adoption of JPEG XL (.jxl - "jixel") file format. It's the format that will replace JPEG!

https://jpegxl.info/