Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox 38 released

mozilla.org

Post reply on HN
Print view View original

81–90 of 133 posts

Re: Firefox 38 released

#81

Post by quadrangle »

dao- wrote: post #53
phireal wrote: post #6

Earlier quoted context omitted.

Presumably this: https://bugzilla.mozilla.org/show_bug.cgi?id=956906 I think it means that sites can't overrule the browser's inclination to store passwords. The argument seems to be the browser makers will store passwords safely.

> The argument seems to be the browser makers will store passwords safely. Not quite. Unless you set a master password, whoever owns your computer will own the passwords stored by your browser. The argument is that disabling autocomplete makes users choose poor passwords that are easy to remember, or write passwords down somewhere, which is at least as bad as having passwords stored in your browser profile.

writing passwords down somewhere, such as on PAPER, is not a particularly bad idea unless you keep the paper by your computer.

Re: Firefox 38 released

#82

Post by hsivonen »

conductor wrote: post #73
hsivonen wrote: post #64

Earlier quoted context omitted.

Firefox checks SHA-512 hashes at download time. If you have local malware that changes the GMP DLLs thereafter, the malware might as well change Firefox itself.

It can't change Firefox itself if it has no administrative privileges but it can change anything in the user's directories.

Your scenario already has the malware running with the user's privileges. This means that the malware already has more privileges than sandboxed GMPs in your scenario.

Re: Firefox 38 released

#83

Post by wldcordeiro »

portaljacker wrote: post #17
Touche wrote: post #7

> Mac OS X: Implemented a subset of the Media Source Extensions (MSE) API to allow native HTML5 playback on YouTube HTML5 > Implemented Encrypted Media Extensions (EME) API to support encrypted HTML5 video/audio playback (Windows Vista or later only) HTML5 > Automatically download Adobe Primetime Content Decryption Module (CDM) for DRM playback through EME (Windows Vista or later only) :( Notice which OSes are left o…

Does EME being implemented finally mean that I can uninstall Silverlight for watching Netflix in Firefox in the near future?

I believe that now you can use the HTML5 player on Netflix if you're on OS X or Windows. Linux still can't however.

Re: Firefox 38 released

#84

Post by aroch »

dolske wrote: post #76
aroch wrote: post #16

Earlier quoted context omitted.

IMO, what's even more annoying are sites that detect whether you've used a password manager to fill your credentials and then 1) won't log you in, 2) frequently require you to clear your cookies and 3) sometimes make you change your password.

Do you have examples of such sites? I'd be interested in seeing what they're doing, and how we can fix password manager to avoid that.

Either Uni. of Wisconsin or Baylor (at least the graduate application stuff) was one of them

Re: Firefox 38 released

#85

Post by venomsnake »

coldpie wrote: post #50
venomsnake wrote: post #37

Earlier quoted context omitted.

Well ... I have found that thepiratebay works flawlessly to deliver videos on any platform. It is sad that we are moving backwards. Right now I WANT to give netflix money for Daredevil ... and there is no legal way for me to do so ...

Hmmm? What OS do you run? Netflix works great on the Linux version of Google Chrome. Yes, you have to use proprietary software, but it does work.

It is what region I live.

Re: Firefox 38 released

#86

Post by sandstrom »

phireal wrote: post #6
dubcanada wrote: post #5

Anyone have any insight on why they removed autocomplete from username & password fields?

Presumably this: https://bugzilla.mozilla.org/show_bug.cgi?id=956906 I think it means that sites can't overrule the browser's inclination to store passwords. The argument seems to be the browser makers will store passwords safely.

There are some valid use-cases, e.g. in web-apps with an user-admin section. It's useful that when adding user 2 (or N) it won't auto-fill with details from the previous user (that you just added).

If anyone has that issue, a workaround is to add multiple email/password inputs (dummies) around the real-one, and hide them. In Chrome, this causes it to 'give up' and not try to auto-fill the fields.

Re: Firefox 38 released

#87

Post by hsivonen »

duaneb wrote: post #72
hsivonen wrote: post #64

Earlier quoted context omitted.

Firefox checks SHA-512 hashes at download time. If you have local malware that changes the GMP DLLs thereafter, the malware might as well change Firefox itself.

> If you have local malware that changes the GMP DLLs thereafter, the malware might as well change Firefox itself. Well hopefully firefox itself is signed. This is exactly what signing is designed to prevent.

For software that runs as non-admin, authenticode is very much about checking delivery-time integrity. If you have admin-level malware, it can replace signed software (that gets run without admin privs and doesn't have UAC at launch) with unsigned lookalikes.

Re: Firefox 38 released

#88

Post by JohnTHaller »

yarrel wrote: post #74
javaun wrote: post #26

Earlier quoted context omitted.

Hey Touche, I work on Firefox at Mozilla. We launched EME on Win32 (Vista+) first because that is by far the biggest share of Fx users. We will keep rolling out new platforms, the work will be long and hard. Streaming providers want to move off of Silverlight and Flash but will still support them for the foreseeable future, so content is still available.

You should be ashamed of doing the work of adding EME to Firefox. Please don't add it to other platforms. Remove it from Windows. If the work will be long and hard there are better uses of your time than working to ensure that "streaming providers" can oppose Mozilla's vision of an open web.

Don't criticize Mozilla. The users have spoken and the vast majority don't care about DRM on streaming media. They just want to watch YouTube, Vimeo, Netflix, etc in their browser and have it work. Google, Apple et al put their full weight behind DRM and patent-encumbered formats, so Mozilla has to go along with it to stay relevant.

If you don't want EME on principle, an alternate version of Firefox without EME is available.

Re: Firefox 38 released

#89

Post by JohnTHaller »

k-mcgrady wrote: post #22
portaljacker wrote: post #17

Earlier quoted context omitted.

Does EME being implemented finally mean that I can uninstall Silverlight for watching Netflix in Firefox in the near future?

Don't do it. I've been using the non-silverlight Netflix in Safari and it's such a nightmare I switched back. Constantly fails to load content.

Safari on Mac OS X uses entirely different code than Firefox on Windows for encrypted media. It's more a limitation of OS X. On Windows, Firefox will download and install the Adobe Media bits to handle DRM video.

Re: Firefox 38 released

#90

Post by riquito »

dubcanada wrote: post #5

Anyone have any insight on why they removed autocomplete from username & password fields?

From the bug tracker https://bugzilla.mozilla.org/show_bug.cgi?id=956906#c100

Summary of the change, so people don't have to wade through a long discussion:

  - This change makes it so that `autocomplete=off` does not stop the Password Manager from working. Normal form autofill can be disabled as usual.
  - The password manager *always* prompts if it wants to save a password. Passwords are not saved without permission from the user.
  - We are the third browser to implement this change, after IE and Chrome.
  - This can be undone locally by flipping the `signon.storeWhenAutocompleteOff` pref (from about:config) off.
  - The rationale behind this change was the widespread abuse of the `autocomplete` attribute to prevent password saving where no prevention is required. This change gives users full control over password saving, without compromising on security (again, the user is always prompted).
Post reply on HN