11 ms·

Site Isolation in Firefox

jzelinskie 5y ago
Can anyone explain the relationship to the Firefox "Electrolysis" initiative better than this[0]? It looks like Electrolysis was just making the browser kernel <> IPC layer and now Fission is actually divvying up the processes by origin. [0]: https://wiki.mozilla.org/Electrolysis#Thanks https://wiki.mozilla.org/Electrolysis#Thanks
- annyg 5y ago
  hi, co-author of the blog post here. There is a more detailed blog post explaining how Site Isolation is better than the Electrolysis architecture here - https://hacks.mozilla.org/2021/05/introducing-firefox-new-site-isolation-security-architecture/ https://hacks.mozilla.org/2021/05/introducing-firefox-new-si... (also linked to from the security blog post). Hope this is helpful!
  - jzelinskie 5y ago
    Thanks for this link. Not sure how I missed it when it's the very last word, haha. I'm not sure what gave me the impression but, in my mind "process-per-tab" and "Electrolysis" were linked, but that was a misconception: >In great detail, (as of April 2021) Firefox’s parent process launches a fixed number of processes: eight web content processes, up to two additional semi-privileged web content processes, and four utility processes for web extensions, GPU operations, networking, and media decoding. >While separating content into currently eight web content processes already provides a solid foundation, it does not meet the security standards of Mozilla because it allows two completely different sites to end up in the same operating system process and, therefore, share process memory. To counter this, we are targeting a Site Isolation architecture that loads every single site into its own process.
    - cpeterso 5y ago
      > I'm not sure what gave me the impression but, in my mind "process-per-tab" and "Electrolysis" were linked, but that was a misconception: Your impression was mostly correct. Electrolysis is basically process-per-tab until you reach eight tabs, but after that, tabs start sharing those eight content processes.
      - cpeterso 5y ago
        Correction to my earlier statement: the initial version of Electrolysis had just one content process (that could be sandboxed apart from the browser parent process), but was soon followed up with "e10s-multi" with multiple content processes.
    - pseudalopex 5y ago
      > I'm not sure what gave me the impression but, in my mind "process-per-tab" and "Electrolysis" were linked This always was a long term goal I think. It's per site not per tab though.
  - gostsamo 5y ago
    Hi, I'm a blind user and I'm just dropping to say a big thank you for the excellent alt text to the diagrams in the hacks post. Thanks for the browser work as well!
    - arkitaip 5y ago
      Thank YOU for writing comments like these - it encourages us web devs to work harder on accessibility.
    - deleted 5y ago
      [deleted]
  - yorwba 5y ago
    I enjoyed the illustrations, but you should try looking at your article in Firefox for Android: all pictures overflow to the right and it's not even possible to scroll horizontally to see the rest.
korethr 5y ago
When Chrome was new and shiny, I used it for a time. Then, the first time I found myself needing to kill Chrome because it was completely locked up, I found myself staring at a wall of chrome processes in the task list, not knowing which one I needed to kill. At the time, I thought the idea of a separate process for each tab was silly. Though, with Firefox moving towards this model, I guess the engineers at Google were prescient in the correctness of that tradeoff. I do use a lot of tabs, so I fear I'm going to find myself facing the same problem I faced with Chrome: a site misbehaves and locks things up, crap, which process do I kill? A way of tracking which tab maps to which process would be nice, so the next time I trip over a badly-coded page, I don't have to kill everything just to get my browser to respond again. Lazyweb question to y'all: is there a feature in Chrome or Firefox that can do this (mapping tab/page -> process), or have I just stumbled upon a side-project idea?
- annyg 5y ago
  sounds like page "about:processes" in Firefox would be super helpful in this case! you can use it to unload tabs and kill processes.
- gourlaysama 5y ago
  On Firefox you can go to `about:processes`. It lists tabs by process, and includes the PID (on Linux; no idea about other platforms). You can also directly kill tabs and processes from there.
  - dmos62 5y ago
    That's super useful on a resource strapped system. Wish I knew this earlier.
    - nine_k 5y ago
      For a resource-constrained machine, uBlock Origin + Auto Tab Discard save a lot of resources and keep a window with 100 tabs quite usable.
    - rstuart4133 5y ago
podiki 5y ago
Could anyone here who has been using it report their experience with site isolation turned on? Do you find anything it breaks or makes more difficult? Has it altered your privacy/security practices (in terms of addons, other settings, etc.)?
- user764743 5y ago
  I've had site isolation on for more than a year. Never had any issues with it.
- roca 5y ago
  I've had it on for many months and haven't had any issues I could attribute to it. I don't really use Firefox extensions though.
yakubin 5y ago
This provides more technical details: <https://hacks.mozilla.org/2021/05/introducing-firefox-new-site-isolation-security-architecture/ https://hacks.mozilla.org/2021/05/introducing-firefox-new-si...>, which should be more interesting to HN than a marketing announcement. In particular, it seems that "site" isn't precisely defined. It seems to be based on domains, but backed by a human-curated list of "sites": <https://github.com/publicsuffix/list https://github.com/publicsuffix/list>. So it's different than Chrome's "every webpage gets a separate process".
- nly 5y ago
  They've been using the public suffix list for scoping cookies for ages. It's an important list
- JonathonW 5y ago
  Chrome's policy is pretty much the same; while it can generate a process-per-tab under most conditions, the guarantee it actually makes (in modern versions of Chrome) is that sites (including different-origin iframes) are isolated into different processes. They use the PSL to determine which sites constitute a different origin, just like Firefox does.
  - Dylan16807 5y ago
    I don't know if "most conditions" is even true. Even when it's only running a handful of processes and I have plenty of ram free I cannot convince it to use more than one process for twitch tabs.
    - lxgr 5y ago
      I think there are some restrictions on tab "navigation source". (Something about a fairly obscure JavaScript feature that links tabs opened via click navigation, if I recall correctly.) Does this also happen when you type the Twitch URL in a new tab?
      - Dylan16807 5y ago
jdlyga 5y ago
Does anyone remember Firesomething? The extension that randomized the name of Firefox to OceanMonkey, WaterHorse, FlameTiger, etc? Powerful extensions and much better UI are the main reasons so many of us switched to Firefox back in the early 2000s.
______- 5y ago
@dang please delete this comment
- esclerofilo 5y ago
  This is about isolation in OS processes, not browser containers.
oblio 5y ago
Software is hard. Chrome had this in 2008. Firefox had to be rearchitected 14 years for this.
- nfoz 5y ago
  Browsers are too big and the web is too complex. Engineering failures all around. As engineers, we should not accept this status quo; we should replace it. We need a new web and new software.
  - MaxBarraclough 5y ago
    See Gemini and Gopher. https://news.ycombinator.com/item?id=23042424 https://news.ycombinator.com/item?id=23042424
    - approxim8ion 5y ago
      Gopher is the opposite of new. Gemini is interesting for sure, but it's not an alternative to the web as they fully admit. It's an alternative to a subset of the web. Let's call it the document web. Blogs and articles and so on. But as entertaining as it is, it is a very very small subset.
      - sfink 5y ago
        That's the point. If you want the web, you need today's browsers. If you want a subset of the web, your "document web" for example, you can get away with something simpler.
      - MaxBarraclough 5y ago
        Respectfully, you're failing to engage with the purpose of the project. > it's not an alternative to the web Right. You can't have a lightweight drop-in alternative to the web, pretty much by definition. Any platform capable of everything modern browsers are capable of, is by definition enormously complex. > it is a very very small subset That's not a flaw, it's a design goal. It isn't meant to be a half-baked portable GUI toolkit the way the modern web platform is, it's meant to be a simple and minimal format, stable and easy to implement. There are other formats somewhat like this in common usage, like man pages and, of course markdown.
jedberg 5y ago
Has anyone tried this along with Container Tabs? Do they play nicely? Does it offer any advantage over Container Tabs?
- rcMgD2BwE72F 5y ago
  Any idea? I'd love to drop https://addons.mozilla.org/en-US/firefox/addon/temporary-containers/ https://addons.mozilla.org/en-US/firefox/addon/temporary-con..., which automatically assigns a temporary container to any new tab, which plays nicely with the https://addons.mozilla.org/en-US/firefox/addon/multi-account-containers/ https://addons.mozilla.org/en-US/firefox/addon/multi-account... but uses too much memory (at least from my experience).
  - jedberg 5y ago
    I use the same add-ons. I just enabled site isolation. I'll let you know how it goes.
  - OrvalWintermute 5y ago
    I think they are complementary, since one is about browser site isolation, and one is about process isolation on the computer. Using temporary containers, multi-account containers, site isolation, along with a number of other privacy/security addons such as Umatrix, LocalCDN, and many others, I have not noticed any slowdown. This on an older broadwell i7 with 32GB of ram.
    - jedberg 5y ago
      So far it seems to work fine for me too. Can you share you list of security/privacy addons? I've used Umatrix but never heard of LocalCDN. Was wondering what other gems you may have found.
      - OrvalWintermute 5y ago
        Here is a complete list of security/privacy addons I am using, a small number of which I have disabled, as I regularly toggle them depending on what I am doing at the time AdNauseam Archive Page ClearURLs Cookie AutoDelete Cookie Remover Decentraleyes DoH Roll-Out Don't track me Google DuckDuckGo Facebook Container Firefox Multi-Account Containers Firefox Private Network Firefox Relay Firefox Screenshots First Party Isolation Google Container Google search link fix Greasemonkey HistoryBlock HTTPS Everywhere I don't care about cookies Laboratory Link Cleaner LocalCDN PinPatrol Privacy Badger Privacy Pass Redirect AMP to HTML Skip Redirect Tampermonkey Temporary Containers Trocker Twitter Container uBlock Origin Ugly Email uMatrix Wappalyzer Zoom Redirector
ksml 5y ago
This is really interesting. Prior to this, Firefox's isolation model was much weaker than Chrome's due to only having a pool of 8 content processes. If I'm reading the technical blog correctly [1], this will move to a process-per-site model without also doing process-per-tab as Chrome does, i.e. if you have several tabs open on the same site, they'd be in the same process. This seems much less resource intensive than Chrome's model while still delivering similar security properties. [1] https://hacks.mozilla.org/2021/05/introducing-firefox-new-site-isolation-security-architecture/ https://hacks.mozilla.org/2021/05/introducing-firefox-new-si...
- chimeracoder 5y ago
  > process-per-tab as Chrome does This is a common misconception. Chrome doesn't technically do process-per-tab. Chrome's model can most succinctly be described as process-per-domain, although even then, there are rare instances where two tabs opened on different domains will actually share the same process.
  - staticassertion 5y ago
    It's "scheme + eTLD + 1", with a flag to set it to per origin.
  - chrismorgan 5y ago
    It’s a misconception that Google fostered right from the start. They did advertise Chrome as process-per-tab: https://www.google.com/googlebooks/chrome/big_04.html https://www.google.com/googlebooks/chrome/big_04.html, pages 6 and 7 also definitely agree. (I haven’t read all through it again now, but I should also note that the process in the very centre of https://www.google.com/googlebooks/chrome/big_38.html https://www.google.com/googlebooks/chrome/big_38.html shows what appears to be two tabs under it, which supports it not necessarily being process-per-tab.) But either it never actually was, or they abandoned it as impractical even before release (https://stackoverflow.com/q/42804 https://stackoverflow.com/q/42804 has answers agreeing it isn’t process-per-tab on the day after the first release). So either Google lied, or they released the comic including a glaring and rather significant factual error (even if it had been true when Scott first drew the pages). It’s frustrating when parties pull these shenanigans, making big claims around things like security and performance predicated on points that are simply not true, but never retracting those points properly or repudiating them, so that the misconception persists.
bastijn 5y ago
Offtopic, Mozilla blog articles like the click through more details one aways have the most awesome images. They almost tell the story without a need to read the text. Other one I remember is the one on webassembly [0]. Similar style images. They really allow you to scroll through the post quickly and see if it is interesting to read in detail. [0] https://hacks.mozilla.org/2019/08/webassembly-interface-types/ https://hacks.mozilla.org/2019/08/webassembly-interface-type...
- virginia_a 5y ago
  Thank you for the positive feedback.
zamadatix 5y ago
In case anyone is wondering about the stability I've been running this for a couple of months now and stability has gotten pretty darn good. I'm excited to see it go into stable builds soon.
- virginia_a 5y ago
  Thank you for this feedback. Firefox Fission team appreciates it. If you see any problems, please file using this template: https://bugzilla.mozilla.org/enter_bug.cgi?product=Core&bug_type=defect&short_desc=%5bFission%5d&blocked=fission-dogfooding https://bugzilla.mozilla.org/enter_bug.cgi?product=Core&bug_... .
iggldiggl 5y ago
Any news about the memory usage overhead this brings? The original design goal when the work on site isolation started was 1 GB overhead for a browsing session with 100 separate origins (can't remember how many tabs that was supposed to correspond to, although due to iframes it was definitively less than 100 tabs). Was this goal reached in the end, or perhaps even surpassed, or missed after all? I guess this also makes adblockers even more valuable in terms of saving memory, since each blocked third party-iframe that doesn't load is potentially one additional process that doesn't have to be created…
- mccr8 5y ago
  I think the overhead is something more like 15MB per process, on Windows. It is higher on other OSes, due in part to the way they load executables. In practice, the total overhead is less bad than you might expect, because people usually don't have that many unique sites open. Telemetry shows that unique sites per tab decreases as the number of tabs increases. It really depends on what web sites you have open. If you have a single tab with an ad-laden news site, the overhead will be high, but if you have a bunch of Google Docs tabs open, there's no overhead.
  - iggldiggl 5y ago
    Okay, so it seems the original target wasn't quite reached unfortunately. On the other hand I guess you're right about "people usually don't have that many unique sites open", so the original design value of 100 separate origins was probably purposely chosen to be on the large side, and thinking about it, I guess not having that many unique sites open usually fits my usage patterns, too. The unknown factor I can't really judge is how many iframes with potentially separate origins the pages I normally visit use, though. Looking at it positively, one additional potential benefit could be that I have a few long-lived tabs that I always keep open – under the current model, this means that the content processes associated with those tabs never die and possibly slowly accumulate cruft and memory fragmentation from additional tabs that happen to be loaded in them (and later closed again). Under the new model on the other hand, closing all tabs associated with a domain should be enough to get the associated content process to exit and free up really all memory used by those now closed tabs.
daxelrod 5y ago
This is fantastic work that will greatly improve the security of Firefox; big thanks to those who have worked on it. Is there data on what effect it will have on memory use? One of the primary reasons I use Firefox is that it uses significantly less memory than Chrome, and the entire OS seems to function better as a result (I've seen the most stark difference on macOS). I had been under the impression that most of the reason Chrome uses so much memory is its multiprocess model. I understand that maybe we need to give that up for better security, but it would be nice to know if that's indeed the tradeoff being made here.
- virginia_a 5y ago
  Yes, more processes come with the cost of more memory but we have reducing the process overhead in Firefox in order to minimize that cost as much as possible. We will continue doing memory reductions and will have numbers to report when we roll-out to all our users. Thank you for your continued support and use of Firefox.
  - daxelrod 5y ago
    Awesome! I'll look out for these numbers. Do you need more data? If so, what's the best way for me to add to it? Would that be installing Nightly, setting fission.autostart to true, and enabling some telemetry?
madars 5y ago
How good is Firefox sandboxing these days? Last time I looked it was years behind Chrome's, but site isolation is definitely a step in the right direction. It would be sad if one day Chromium removed Manifest v2 and there was no alternative.
- roca 5y ago
  Not as good as Chrome's, but constantly improving and good enough that Firefox sandbox escapes are Quite A Big Deal, not trivial.
lumost 5y ago
FireFox appears to be accelerating their feature velocity post Mozilla resizing. Curious what changes they made internally to refocus development.
- spartanatreyu 5y ago
  This has likely been in the works for years.
huntermeyer 5y ago
Does anyone else get ANNOYED by the UI of Mozilla's blog on mobile? Looking at the navbar, the horizontal and vertical alignment is all over the place, the search input has no placeholder or label, background colors are inconsistent, and paddings are just bizarre.
- causality0 5y ago
  It's garbage. The new tab button doesn't follow the status bar to the top of the screen so unless you like it on the bottom you can't browse one-handed given the giant stretch between opening the tab manager and opening a new tab. Not to mention the fact the extension ecosystem is still crippled. There's still no user-agent switcher, meaning there are sites I literally cannot access from my phone without installing an old version of Firefox Mobile or go back to using Dolphin Browser. "View Desktop Version" perversely still tells sites you're on a mobile browser.

Can anyone explain the relationship to the Firefox "Electrolysis" initiative better than this[0]? It looks like Electrolysis was just making the browser kernel <> IPC layer and now Fission is actually divvying up the processes by origin. [0]: https://wiki.mozilla.org/Electrolysis#Thanks https://wiki.mozilla.org/Electrolysis#Thanks

annyg 5y ago
hi, co-author of the blog post here. There is a more detailed blog post explaining how Site Isolation is better than the Electrolysis architecture here - https://hacks.mozilla.org/2021/05/introducing-firefox-new-site-isolation-security-architecture/ https://hacks.mozilla.org/2021/05/introducing-firefox-new-si... (also linked to from the security blog post). Hope this is helpful!
- jzelinskie 5y ago
  Thanks for this link. Not sure how I missed it when it's the very last word, haha. I'm not sure what gave me the impression but, in my mind "process-per-tab" and "Electrolysis" were linked, but that was a misconception: >In great detail, (as of April 2021) Firefox’s parent process launches a fixed number of processes: eight web content processes, up to two additional semi-privileged web content processes, and four utility processes for web extensions, GPU operations, networking, and media decoding. >While separating content into currently eight web content processes already provides a solid foundation, it does not meet the security standards of Mozilla because it allows two completely different sites to end up in the same operating system process and, therefore, share process memory. To counter this, we are targeting a Site Isolation architecture that loads every single site into its own process.
  - cpeterso 5y ago
    > I'm not sure what gave me the impression but, in my mind "process-per-tab" and "Electrolysis" were linked, but that was a misconception: Your impression was mostly correct. Electrolysis is basically process-per-tab until you reach eight tabs, but after that, tabs start sharing those eight content processes.
    - cpeterso 5y ago
      Correction to my earlier statement: the initial version of Electrolysis had just one content process (that could be sandboxed apart from the browser parent process), but was soon followed up with "e10s-multi" with multiple content processes.
  - pseudalopex 5y ago
    > I'm not sure what gave me the impression but, in my mind "process-per-tab" and "Electrolysis" were linked This always was a long term goal I think. It's per site not per tab though.
- gostsamo 5y ago
  Hi, I'm a blind user and I'm just dropping to say a big thank you for the excellent alt text to the diagrams in the hacks post. Thanks for the browser work as well!
  - arkitaip 5y ago
    Thank YOU for writing comments like these - it encourages us web devs to work harder on accessibility.
  - deleted 5y ago
    [deleted]
- yorwba 5y ago
  I enjoyed the illustrations, but you should try looking at your article in Firefox for Android: all pictures overflow to the right and it's not even possible to scroll horizontally to see the rest.

korethr 5y ago

When Chrome was new and shiny, I used it for a time. Then, the first time I found myself needing to kill Chrome because it was completely locked up, I found myself staring at a wall of chrome processes in the task list, not knowing which one I needed to kill. At the time, I thought the idea of a separate process for each tab was silly. Though, with Firefox moving towards this model, I guess the engineers at Google were prescient in the correctness of that tradeoff. I do use a lot of tabs, so I fear I'm going to find myself facing the same problem I faced with Chrome: a site misbehaves and locks things up, crap, which process do I kill? A way of tracking which tab maps to which process would be nice, so the next time I trip over a badly-coded page, I don't have to kill everything just to get my browser to respond again. Lazyweb question to y'all: is there a feature in Chrome or Firefox that can do this (mapping tab/page -> process), or have I just stumbled upon a side-project idea?

annyg 5y ago
sounds like page "about:processes" in Firefox would be super helpful in this case! you can use it to unload tabs and kill processes.
gourlaysama 5y ago
On Firefox you can go to `about:processes`. It lists tabs by process, and includes the PID (on Linux; no idea about other platforms). You can also directly kill tabs and processes from there.
- dmos62 5y ago
  That's super useful on a resource strapped system. Wish I knew this earlier.
  - nine_k 5y ago
    For a resource-constrained machine, uBlock Origin + Auto Tab Discard save a lot of resources and keep a window with 100 tabs quite usable.
  - rstuart4133 5y ago

podiki 5y ago

Could anyone here who has been using it report their experience with site isolation turned on? Do you find anything it breaks or makes more difficult? Has it altered your privacy/security practices (in terms of addons, other settings, etc.)?

user764743 5y ago
I've had site isolation on for more than a year. Never had any issues with it.
roca 5y ago
I've had it on for many months and haven't had any issues I could attribute to it. I don't really use Firefox extensions though.

yakubin 5y ago

This provides more technical details: <https://hacks.mozilla.org/2021/05/introducing-firefox-new-site-isolation-security-architecture/ https://hacks.mozilla.org/2021/05/introducing-firefox-new-si...>, which should be more interesting to HN than a marketing announcement. In particular, it seems that "site" isn't precisely defined. It seems to be based on domains, but backed by a human-curated list of "sites": <https://github.com/publicsuffix/list https://github.com/publicsuffix/list>. So it's different than Chrome's "every webpage gets a separate process".

nly 5y ago
They've been using the public suffix list for scoping cookies for ages. It's an important list
JonathonW 5y ago
Chrome's policy is pretty much the same; while it can generate a process-per-tab under most conditions, the guarantee it actually makes (in modern versions of Chrome) is that sites (including different-origin iframes) are isolated into different processes. They use the PSL to determine which sites constitute a different origin, just like Firefox does.
- Dylan16807 5y ago
  I don't know if "most conditions" is even true. Even when it's only running a handful of processes and I have plenty of ram free I cannot convince it to use more than one process for twitch tabs.
  - lxgr 5y ago
    I think there are some restrictions on tab "navigation source". (Something about a fairly obscure JavaScript feature that links tabs opened via click navigation, if I recall correctly.) Does this also happen when you type the Twitch URL in a new tab?
    - Dylan16807 5y ago

jdlyga 5y ago

Does anyone remember Firesomething? The extension that randomized the name of Firefox to OceanMonkey, WaterHorse, FlameTiger, etc? Powerful extensions and much better UI are the main reasons so many of us switched to Firefox back in the early 2000s.

______- 5y ago

@dang please delete this comment

esclerofilo 5y ago
This is about isolation in OS processes, not browser containers.

oblio 5y ago

Software is hard. Chrome had this in 2008. Firefox had to be rearchitected 14 years for this.

nfoz 5y ago
Browsers are too big and the web is too complex. Engineering failures all around. As engineers, we should not accept this status quo; we should replace it. We need a new web and new software.
- MaxBarraclough 5y ago
  See Gemini and Gopher. https://news.ycombinator.com/item?id=23042424 https://news.ycombinator.com/item?id=23042424
  - approxim8ion 5y ago
    Gopher is the opposite of new. Gemini is interesting for sure, but it's not an alternative to the web as they fully admit. It's an alternative to a subset of the web. Let's call it the document web. Blogs and articles and so on. But as entertaining as it is, it is a very very small subset.
    - sfink 5y ago
      That's the point. If you want the web, you need today's browsers. If you want a subset of the web, your "document web" for example, you can get away with something simpler.
    - MaxBarraclough 5y ago
      Respectfully, you're failing to engage with the purpose of the project. > it's not an alternative to the web Right. You can't have a lightweight drop-in alternative to the web, pretty much by definition. Any platform capable of everything modern browsers are capable of, is by definition enormously complex. > it is a very very small subset That's not a flaw, it's a design goal. It isn't meant to be a half-baked portable GUI toolkit the way the modern web platform is, it's meant to be a simple and minimal format, stable and easy to implement. There are other formats somewhat like this in common usage, like man pages and, of course markdown.

jedberg 5y ago

Has anyone tried this along with Container Tabs? Do they play nicely? Does it offer any advantage over Container Tabs?

rcMgD2BwE72F 5y ago
Any idea? I'd love to drop https://addons.mozilla.org/en-US/firefox/addon/temporary-containers/ https://addons.mozilla.org/en-US/firefox/addon/temporary-con..., which automatically assigns a temporary container to any new tab, which plays nicely with the https://addons.mozilla.org/en-US/firefox/addon/multi-account-containers/ https://addons.mozilla.org/en-US/firefox/addon/multi-account... but uses too much memory (at least from my experience).
- jedberg 5y ago
  I use the same add-ons. I just enabled site isolation. I'll let you know how it goes.
- OrvalWintermute 5y ago
  I think they are complementary, since one is about browser site isolation, and one is about process isolation on the computer. Using temporary containers, multi-account containers, site isolation, along with a number of other privacy/security addons such as Umatrix, LocalCDN, and many others, I have not noticed any slowdown. This on an older broadwell i7 with 32GB of ram.
  - jedberg 5y ago
    So far it seems to work fine for me too. Can you share you list of security/privacy addons? I've used Umatrix but never heard of LocalCDN. Was wondering what other gems you may have found.
    - OrvalWintermute 5y ago
      Here is a complete list of security/privacy addons I am using, a small number of which I have disabled, as I regularly toggle them depending on what I am doing at the time AdNauseam Archive Page ClearURLs Cookie AutoDelete Cookie Remover Decentraleyes DoH Roll-Out Don't track me Google DuckDuckGo Facebook Container Firefox Multi-Account Containers Firefox Private Network Firefox Relay Firefox Screenshots First Party Isolation Google Container Google search link fix Greasemonkey HistoryBlock HTTPS Everywhere I don't care about cookies Laboratory Link Cleaner LocalCDN PinPatrol Privacy Badger Privacy Pass Redirect AMP to HTML Skip Redirect Tampermonkey Temporary Containers Trocker Twitter Container uBlock Origin Ugly Email uMatrix Wappalyzer Zoom Redirector

ksml 5y ago

This is really interesting. Prior to this, Firefox's isolation model was much weaker than Chrome's due to only having a pool of 8 content processes. If I'm reading the technical blog correctly [1], this will move to a process-per-site model without also doing process-per-tab as Chrome does, i.e. if you have several tabs open on the same site, they'd be in the same process. This seems much less resource intensive than Chrome's model while still delivering similar security properties. [1] https://hacks.mozilla.org/2021/05/introducing-firefox-new-site-isolation-security-architecture/ https://hacks.mozilla.org/2021/05/introducing-firefox-new-si...

chimeracoder 5y ago
> process-per-tab as Chrome does This is a common misconception. Chrome doesn't technically do process-per-tab. Chrome's model can most succinctly be described as process-per-domain, although even then, there are rare instances where two tabs opened on different domains will actually share the same process.
- staticassertion 5y ago
  It's "scheme + eTLD + 1", with a flag to set it to per origin.
- chrismorgan 5y ago
  It’s a misconception that Google fostered right from the start. They did advertise Chrome as process-per-tab: https://www.google.com/googlebooks/chrome/big_04.html https://www.google.com/googlebooks/chrome/big_04.html, pages 6 and 7 also definitely agree. (I haven’t read all through it again now, but I should also note that the process in the very centre of https://www.google.com/googlebooks/chrome/big_38.html https://www.google.com/googlebooks/chrome/big_38.html shows what appears to be two tabs under it, which supports it not necessarily being process-per-tab.) But either it never actually was, or they abandoned it as impractical even before release (https://stackoverflow.com/q/42804 https://stackoverflow.com/q/42804 has answers agreeing it isn’t process-per-tab on the day after the first release). So either Google lied, or they released the comic including a glaring and rather significant factual error (even if it had been true when Scott first drew the pages). It’s frustrating when parties pull these shenanigans, making big claims around things like security and performance predicated on points that are simply not true, but never retracting those points properly or repudiating them, so that the misconception persists.

bastijn 5y ago

Offtopic, Mozilla blog articles like the click through more details one aways have the most awesome images. They almost tell the story without a need to read the text. Other one I remember is the one on webassembly [0]. Similar style images. They really allow you to scroll through the post quickly and see if it is interesting to read in detail. [0] https://hacks.mozilla.org/2019/08/webassembly-interface-types/ https://hacks.mozilla.org/2019/08/webassembly-interface-type...

virginia_a 5y ago
Thank you for the positive feedback.

zamadatix 5y ago

In case anyone is wondering about the stability I've been running this for a couple of months now and stability has gotten pretty darn good. I'm excited to see it go into stable builds soon.

virginia_a 5y ago
Thank you for this feedback. Firefox Fission team appreciates it. If you see any problems, please file using this template: https://bugzilla.mozilla.org/enter_bug.cgi?product=Core&bug_type=defect&short_desc=%5bFission%5d&blocked=fission-dogfooding https://bugzilla.mozilla.org/enter_bug.cgi?product=Core&bug_... .

iggldiggl 5y ago

Any news about the memory usage overhead this brings? The original design goal when the work on site isolation started was 1 GB overhead for a browsing session with 100 separate origins (can't remember how many tabs that was supposed to correspond to, although due to iframes it was definitively less than 100 tabs). Was this goal reached in the end, or perhaps even surpassed, or missed after all? I guess this also makes adblockers even more valuable in terms of saving memory, since each blocked third party-iframe that doesn't load is potentially one additional process that doesn't have to be created…

mccr8 5y ago
I think the overhead is something more like 15MB per process, on Windows. It is higher on other OSes, due in part to the way they load executables. In practice, the total overhead is less bad than you might expect, because people usually don't have that many unique sites open. Telemetry shows that unique sites per tab decreases as the number of tabs increases. It really depends on what web sites you have open. If you have a single tab with an ad-laden news site, the overhead will be high, but if you have a bunch of Google Docs tabs open, there's no overhead.
- iggldiggl 5y ago
  Okay, so it seems the original target wasn't quite reached unfortunately. On the other hand I guess you're right about "people usually don't have that many unique sites open", so the original design value of 100 separate origins was probably purposely chosen to be on the large side, and thinking about it, I guess not having that many unique sites open usually fits my usage patterns, too. The unknown factor I can't really judge is how many iframes with potentially separate origins the pages I normally visit use, though. Looking at it positively, one additional potential benefit could be that I have a few long-lived tabs that I always keep open – under the current model, this means that the content processes associated with those tabs never die and possibly slowly accumulate cruft and memory fragmentation from additional tabs that happen to be loaded in them (and later closed again). Under the new model on the other hand, closing all tabs associated with a domain should be enough to get the associated content process to exit and free up really all memory used by those now closed tabs.

daxelrod 5y ago

This is fantastic work that will greatly improve the security of Firefox; big thanks to those who have worked on it. Is there data on what effect it will have on memory use? One of the primary reasons I use Firefox is that it uses significantly less memory than Chrome, and the entire OS seems to function better as a result (I've seen the most stark difference on macOS). I had been under the impression that most of the reason Chrome uses so much memory is its multiprocess model. I understand that maybe we need to give that up for better security, but it would be nice to know if that's indeed the tradeoff being made here.

virginia_a 5y ago
Yes, more processes come with the cost of more memory but we have reducing the process overhead in Firefox in order to minimize that cost as much as possible. We will continue doing memory reductions and will have numbers to report when we roll-out to all our users. Thank you for your continued support and use of Firefox.
- daxelrod 5y ago
  Awesome! I'll look out for these numbers. Do you need more data? If so, what's the best way for me to add to it? Would that be installing Nightly, setting fission.autostart to true, and enabling some telemetry?

madars 5y ago

How good is Firefox sandboxing these days? Last time I looked it was years behind Chrome's, but site isolation is definitely a step in the right direction. It would be sad if one day Chromium removed Manifest v2 and there was no alternative.

roca 5y ago
Not as good as Chrome's, but constantly improving and good enough that Firefox sandbox escapes are Quite A Big Deal, not trivial.

lumost 5y ago

FireFox appears to be accelerating their feature velocity post Mozilla resizing. Curious what changes they made internally to refocus development.

spartanatreyu 5y ago
This has likely been in the works for years.

huntermeyer 5y ago

Does anyone else get ANNOYED by the UI of Mozilla's blog on mobile? Looking at the navbar, the horizontal and vertical alignment is all over the place, the search input has no placeholder or label, background colors are inconsistent, and paddings are just bizarre.

causality0 5y ago
It's garbage. The new tab button doesn't follow the status bar to the top of the screen so unless you like it on the bottom you can't browse one-handed given the giant stretch between opening the tab manager and opening a new tab. Not to mention the fact the extension ecosystem is still crippled. There's still no user-agent switcher, meaning there are sites I literally cannot access from my phone without installing an old version of Firefox Mobile or go back to using Dolphin Browser. "View Desktop Version" perversely still tells sites you're on a mobile browser.