5 ms·

Firefox 6 for web developers

150 points by tbassetto 15y ago

yan 15y ago
"For security reasons, data: and javascript: URIs no longer inherit the security context of the current page when the user enters them in the location bar; instead, a new, empty, security context is created. This means that script loaded by entering javascript: URIs in the location bar no longer has access to DOM methods and the like, for example. These URIs continue to work as before when used by script, however." Good bye bookmarklets?
- int3 15y ago
  I believe bookmarklets still work -- the restriction only applies if the javascript: URIs were typed in by the user.
  - JoshTriplett 15y ago
    Right. Apparently this "security" feature came about because people followed instructions on random facebook pages saying "paste this in your address bar to activate $RANDOM_FAKE_FACEBOOK_FEATURE". You can still run Javascript via the Scratchpad (Web Developer -> Scratchpad, or hit Shift-F4).
- beaumartinez 15y ago
  Interesting. Copying the TinEye bookmarklet, javascript:void(window.open('http://tineye.com/search?pluginver=bookmark_1.0&url='%20+%20encodeURIComponent(document.URL))); into the address bar did nothing; an "Error: uncaught exception: ReferenceError: window is not defined" was logged in the error console. Clicking it as normal worked as expected, though.
- simonw 15y ago
  Sounds smart. It's extremely easy to get an unsophisticated user (heck, any user who isn't a web developer) to paste a random string of junk in to their URL bar - and doing so is a very nasty XSS vector that works no matter what precautions a site's developers have taken. I'm sure I've heard of this attack being used successfully on Facebook, spread through messages that say "paste this in to your URL bar to get X".
  - re 15y ago
    So those messages will say "press [whatever key combo activates the console] and paste this text there for a funny video" instead?
    - pbhjpbhj 15y ago
      Or possibly "drag this link to the toolbar and click when on any page on Facebook to see which of your friends is viewing that page" or whatever.
- ck2 15y ago
  Hopefully there is an about:config to undo that for power-users.
- josscrowcroft 15y ago
  Yeah, I caught this hanging out at the bottom of the list too... Immediately set to thinking how I'm gonna have to go rewrite the dozen or so bookmarklets I've written to support FF6
  - mbrubeck 15y ago
    Bookmarklets are not affected when used as bookmarks. Only URIs typed directly into the location bar are affected.
    - josscrowcroft 15y ago
      Oh, sweet.
gchucky 15y ago
> WebSockets are back! I have a feeling that's going to make a lot of people very happy. Good to see that they were able to solve the security issues.
- JoshTriplett 15y ago
  Server-sent events seem awesome as well. Open a connection to the server, let it stream you events, and each one generates a Javascript event.
  - PedroCandeias 15y ago
    It's hard to believe it's 2011 and there's still no standard way of sending data from a server to a browser other than ajax and comet trickery. This sounds like a step in the right direction.
  - bobfunk 15y ago
    Also seems like server-sent events should be a lot easier to pass through standard load balancers and proxies than web sockets. Very cool...
- robin_reala 15y ago
  For what it’s worth, you have to update your client code to instantiate a MozWebSocket and update your server to support the latest protocol. I know, because I’ve done this today :) We’re using the em-websocket gem though which has been updated recently so it really wasn’t that difficult.
- highriseo 15y ago
  Mozilla is supporting a new version of websockets (https://bugzilla.mozilla.org/show_bug.cgi?id=640003 https://bugzilla.mozilla.org/show_bug.cgi?id=640003) that as of a week ago did not work with a lot of popular libraries yet (socket.io). Its awesome to see better security features in place and I hope that library distributors are fast to follow up with changes in their library.
ck2 15y ago
Thanks for adopting the existing "standard" for touches, now I can remove some of the extra code I had for F4 mobile.
- mbrubeck 15y ago
  Awesome! Please let us know if you find any problems with the touch events in Fx6 mobile. (You can contact me directly at mbrubeck@mozilla.com or file a bug at bugzilla.mozilla.org under the "Fennec" product.)
dbingham 15y ago
I think my favorite part is that they've finally added an auto-update feature. If you open about Firefox, it checks to determine whether or not you're up to date. Especially if they're going to be bringing out frequent releases, I don't want to be constantly reinstalling Firefox.
- kevingadd 15y ago
  That's been there since 4.0 for me.
- brown9-2 15y ago
  That's been there for a while - I'd prefer if they would silently update the browser in the background and active it on the next restart, just as Chrome does. I hate being told that Firefox 5.0 or 6.0 is out, only to find out that there are barely any major changes in this seemingly major version. If you want to release more often and make it a more seemless process, the app should stop announcing each new version like a major release.
  - bzbarsky 15y ago
    The app doesn't announce each new version unless you have add-ons that are incompatible with the new version (in which case you get a dialog telling you so), last I checked. It does tell you that it's applying an update when you do the update startup, so far. That's likely to go away as well.
hendler 15y ago
Happy about websockets. But mostly excited for FF 7 with the memory management improvements. http://blog.mozilla.com/nnethercote/2011/08/09/firefox-7-is-lean-and-fast-2/ http://blog.mozilla.com/nnethercote/2011/08/09/firefox-7-is-... Firebug needs a manual update. see http://getfirebug.com/downloads http://getfirebug.com/downloads [edited to add firebug link] Learned that
- mixmastamyk 15y ago
  Meh, I've been using FF8 nightly for a few weeks and the memory improvements are modest at best. I just had to restart my browser because it got up to 650mb even after closing tabs.
  - tbassetto 15y ago
    It may be caused by poorly written extensions and/or extensions "forced" to be compatible with nightlies.
bzbarsky 15y ago
It'll be interesting to see whether sites start using the CSS auto-hyphenation features....
jfoucher 15y ago
That's good, but what I really want to know is "Will Firebug still work after I upgrade?"
- mbrubeck 15y ago
  Yes: https://getfirebug.com/downloads/ https://getfirebug.com/downloads/
mbrzuzy 15y ago
I'm getting a download rate of anywhere from 4kb/s to 10kb/s for the download. :'(
jdelsman 15y ago
Server sent events and WebSockets are the +1 for me!

150 points by tbassetto 15y ago

yan 15y ago

"For security reasons, data: and javascript: URIs no longer inherit the security context of the current page when the user enters them in the location bar; instead, a new, empty, security context is created. This means that script loaded by entering javascript: URIs in the location bar no longer has access to DOM methods and the like, for example. These URIs continue to work as before when used by script, however." Good bye bookmarklets?

int3 15y ago
I believe bookmarklets still work -- the restriction only applies if the javascript: URIs were typed in by the user.
- JoshTriplett 15y ago
  Right. Apparently this "security" feature came about because people followed instructions on random facebook pages saying "paste this in your address bar to activate $RANDOM_FAKE_FACEBOOK_FEATURE". You can still run Javascript via the Scratchpad (Web Developer -> Scratchpad, or hit Shift-F4).
beaumartinez 15y ago
Interesting. Copying the TinEye bookmarklet, javascript:void(window.open('http://tineye.com/search?pluginver=bookmark_1.0&url='%20+%20encodeURIComponent(document.URL))); into the address bar did nothing; an "Error: uncaught exception: ReferenceError: window is not defined" was logged in the error console. Clicking it as normal worked as expected, though.
simonw 15y ago
Sounds smart. It's extremely easy to get an unsophisticated user (heck, any user who isn't a web developer) to paste a random string of junk in to their URL bar - and doing so is a very nasty XSS vector that works no matter what precautions a site's developers have taken. I'm sure I've heard of this attack being used successfully on Facebook, spread through messages that say "paste this in to your URL bar to get X".
- re 15y ago
  So those messages will say "press [whatever key combo activates the console] and paste this text there for a funny video" instead?
  - pbhjpbhj 15y ago
    Or possibly "drag this link to the toolbar and click when on any page on Facebook to see which of your friends is viewing that page" or whatever.
ck2 15y ago
Hopefully there is an about:config to undo that for power-users.
josscrowcroft 15y ago
Yeah, I caught this hanging out at the bottom of the list too... Immediately set to thinking how I'm gonna have to go rewrite the dozen or so bookmarklets I've written to support FF6
- mbrubeck 15y ago
  Bookmarklets are not affected when used as bookmarks. Only URIs typed directly into the location bar are affected.
  - josscrowcroft 15y ago
    Oh, sweet.

gchucky 15y ago

> WebSockets are back! I have a feeling that's going to make a lot of people very happy. Good to see that they were able to solve the security issues.

JoshTriplett 15y ago
Server-sent events seem awesome as well. Open a connection to the server, let it stream you events, and each one generates a Javascript event.
- PedroCandeias 15y ago
  It's hard to believe it's 2011 and there's still no standard way of sending data from a server to a browser other than ajax and comet trickery. This sounds like a step in the right direction.
- bobfunk 15y ago
  Also seems like server-sent events should be a lot easier to pass through standard load balancers and proxies than web sockets. Very cool...
robin_reala 15y ago
For what it’s worth, you have to update your client code to instantiate a MozWebSocket and update your server to support the latest protocol. I know, because I’ve done this today :) We’re using the em-websocket gem though which has been updated recently so it really wasn’t that difficult.
highriseo 15y ago
Mozilla is supporting a new version of websockets (https://bugzilla.mozilla.org/show_bug.cgi?id=640003 https://bugzilla.mozilla.org/show_bug.cgi?id=640003) that as of a week ago did not work with a lot of popular libraries yet (socket.io). Its awesome to see better security features in place and I hope that library distributors are fast to follow up with changes in their library.

ck2 15y ago

Thanks for adopting the existing "standard" for touches, now I can remove some of the extra code I had for F4 mobile.

mbrubeck 15y ago
Awesome! Please let us know if you find any problems with the touch events in Fx6 mobile. (You can contact me directly at mbrubeck@mozilla.com or file a bug at bugzilla.mozilla.org under the "Fennec" product.)

dbingham 15y ago

I think my favorite part is that they've finally added an auto-update feature. If you open about Firefox, it checks to determine whether or not you're up to date. Especially if they're going to be bringing out frequent releases, I don't want to be constantly reinstalling Firefox.

kevingadd 15y ago
That's been there since 4.0 for me.
brown9-2 15y ago
That's been there for a while - I'd prefer if they would silently update the browser in the background and active it on the next restart, just as Chrome does. I hate being told that Firefox 5.0 or 6.0 is out, only to find out that there are barely any major changes in this seemingly major version. If you want to release more often and make it a more seemless process, the app should stop announcing each new version like a major release.
- bzbarsky 15y ago
  The app doesn't announce each new version unless you have add-ons that are incompatible with the new version (in which case you get a dialog telling you so), last I checked. It does tell you that it's applying an update when you do the update startup, so far. That's likely to go away as well.

hendler 15y ago

Happy about websockets. But mostly excited for FF 7 with the memory management improvements. http://blog.mozilla.com/nnethercote/2011/08/09/firefox-7-is-lean-and-fast-2/ http://blog.mozilla.com/nnethercote/2011/08/09/firefox-7-is-... Firebug needs a manual update. see http://getfirebug.com/downloads http://getfirebug.com/downloads [edited to add firebug link] Learned that

mixmastamyk 15y ago
Meh, I've been using FF8 nightly for a few weeks and the memory improvements are modest at best. I just had to restart my browser because it got up to 650mb even after closing tabs.
- tbassetto 15y ago
  It may be caused by poorly written extensions and/or extensions "forced" to be compatible with nightlies.

bzbarsky 15y ago

It'll be interesting to see whether sites start using the CSS auto-hyphenation features....

jfoucher 15y ago

That's good, but what I really want to know is "Will Firebug still work after I upgrade?"

mbrubeck 15y ago
Yes: https://getfirebug.com/downloads/ https://getfirebug.com/downloads/

mbrzuzy 15y ago

I'm getting a download rate of anywhere from 4kb/s to 10kb/s for the download. :'(

jdelsman 15y ago

Server sent events and WebSockets are the +1 for me!