Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 90 supports Fetch Metadata Request Headers

blog.mozilla.org

Post reply on HN
Print view View original

41–50 of 109 posts

Re: Firefox 90 supports Fetch Metadata Request Headers

#41

Post by vbezhenar »

atonse wrote: post #25
drchickensalad wrote: post #12

Earlier quoted context omitted.

Safari truly is IE in 2021

I don’t quite understand this argument. Can you give me a couple examples of Safari holding back major parts of web design? Or is it more obscure stuff like some webGL engine? Because I use Safari specifically for privacy reasons and it also used to never trigger my fans to full speed just to play videos, like Chrome. I also have read that while Safari does tend to take longer, their implementations tend to be more p…

Absence of push notifications makes it impossible to develop a lots of web apps.

Also more user-friendly way to install desktop shortcut would help tremendously to make web apps more popular. Of course Apple is not interested with that, but it's still sad.

Re: Firefox 90 supports Fetch Metadata Request Headers

#42

Post by silon42 »

contravariant wrote: post #13
ChrisSD wrote: post #7

Earlier quoted context omitted.

If ESNI is fundamentally flawed, how is it better than nothing at all? At that point isn't it just cargo cult "protection"?

You're gonna have to support the statement that ESNI is fundamentally flawed a bit better for that argument to work.

IMO, SNI should only be added at the firewall (using HTTPS proxy, for example), so the network operator can monitor/filter which hosts are being accessed.

Re: Firefox 90 supports Fetch Metadata Request Headers

#43

Post by danielheath »

atonse wrote: post #25
drchickensalad wrote: post #12

Earlier quoted context omitted.

Safari truly is IE in 2021

I don’t quite understand this argument. Can you give me a couple examples of Safari holding back major parts of web design? Or is it more obscure stuff like some webGL engine? Because I use Safari specifically for privacy reasons and it also used to never trigger my fans to full speed just to play videos, like Chrome. I also have read that while Safari does tend to take longer, their implementations tend to be more p…

I often try to use a feature and it doesn't work properly on one browser. It's nearly always mobile safari. This week, I've dealt with scroll-snap (which makes URL anchors work correctly with a sticky header) being supported but only for some layouts (every other browser works).

Today I spent hours debugging why pages with a particular iframe embed would log you out of the parent site on Safari / iOS. Possibly because the same first-party resource was requested from both outside and inside the frame? Not sure yet.

If you attempt to use localStorage from a private tab on safari, it reports that it's present and working, but raises an exception on any access (every other platform either does not expose localStorage in private tabs, or clears it after).

Re: Firefox 90 supports Fetch Metadata Request Headers

#44

Post by darthmaim »

atonse wrote: post #25
drchickensalad wrote: post #12

Earlier quoted context omitted.

Safari truly is IE in 2021

I don’t quite understand this argument. Can you give me a couple examples of Safari holding back major parts of web design? Or is it more obscure stuff like some webGL engine? Because I use Safari specifically for privacy reasons and it also used to never trigger my fans to full speed just to play videos, like Chrome. I also have read that while Safari does tend to take longer, their implementations tend to be more p…

Here are some examples: https://infrequently.org/2021/04/progress-delayed/

Re: Firefox 90 supports Fetch Metadata Request Headers

#45

Post by hiccuphippo »

dbg31415 wrote: post #35
floatingatoll wrote: post #29

Earlier quoted context omitted.

That sounds like a reproducible bug report, with an easy test case (“run this script and measure laptop battery life, in Firefox and Safari”). If you haven’t already provided that in a bug report to the software developers, you should do so. Shopping your concern to an unrelated thread about security headers isn’t likely to get far on HN, certainly nowhere near as much as a testable bug would.

Eh, I'm willing to take a few downvotes if it means raising awareness. I tag pretty much every Firefox post with some sort of report on battery life. I've added bug reports... doesn't ever seem to get taken seriously. Like I said I'm OK with taking a few downvotes on the off chance someone on the Firefox team may actually see this and be able to prioritize work to address the issue. Firefox is my primary browser, but…

Isn't it less work to do the bug report in the proper place than post about everytime in half-related threads? You could even send it as its own post to HN to do the raise awareness part.

Re: Firefox 90 supports Fetch Metadata Request Headers

#47

Post by tialaramex »

silon42 wrote: post #42
contravariant wrote: post #13

Earlier quoted context omitted.

You're gonna have to support the statement that ESNI is fundamentally flawed a bit better for that argument to work.

IMO, SNI should only be added at the firewall (using HTTPS proxy, for example), so the network operator can monitor/filter which hosts are being accessed.

This doesn't make any sense.

If you actually have a "HTTPS proxy" then the entire transaction is plaintext at that proxy, the operator can do whatever they want.

In particular they can choose whether they want to support protocol extensions like eSNI or ECH on either or both sides of the proxy.

If your idea is "But surely it should just pass through extensions it doesn't understand" what you've got there is nonsense, it isn't a "firewall" it's a dumpster fire. The extensions have meaning to the peers, if it tries to pass extensions through without understanding them it's now speaking gibberish to both sides.

Re: Firefox 90 supports Fetch Metadata Request Headers

#48

Post by Vinnl »

coldpie wrote: post #36
account42 wrote: post #23

Earlier quoted context omitted.

Exactly - why do I as a user want this? I already need an extension to fake the Referer...

The article explains why you as a user want this.

Specifically:

> allows web applications to protect themselves and their users against various cross-origin threats

Re: Firefox 90 supports Fetch Metadata Request Headers

#49

Post by alexghr »

TazeTSchnitzel wrote: post #46

Does this essentially solve XSRF? Would it no longer be necessary to use XSRF tokens?

I think they could replace XSRF tokens, but until all major browsers support the headers (Safari 11 seems to be missing support, see other comments) you can't really block requests that don't have the new Sec-Fetch-* headers.

Re: Firefox 90 supports Fetch Metadata Request Headers

#50

Post by Santosh83 »

The_rationalist wrote: post #32
account42 wrote: post #23

Earlier quoted context omitted.

Exactly - why do I as a user want this? I already need an extension to fake the Referer...

Which extension?

You should reach out to dang. You seem to be shadowbanned or something. All your comments show up as grayed out and 'dead'. I 'vouched' for this before I could reply.
Post reply on HN