13 ms·

Firefox 127

160 points by skilled 2y ago

bachmeier 2y ago
> The Screenshots feature in Firefox has gotten a big update! It now supports taking screenshots of file types like SVG, XML, and more as well as various about: pages within Firefox. We've also made the screenshot tool more accessible to everyone by implementing new keyboard shortcuts and adding theme compatibility and High Contrast Mode (HCM) support. And finally, performance for capturing large screenshots has been improved. I have no problem with this feature, but am curious if it brings any new functionality beyond existing screenshot tools.
- rwmj 2y ago
  I actually used the screenshots feature for the first time (to illustrate my devconf.cz talk this week, do come, it's free!). The nice thing about it is that you can scroll the page while framing the screenshot, allowing you to take a shot of the whole page including everything below the fold. I think such a feature needs to be integrated into the browser.
  - _flux 2y ago
    > I think such a feature needs to be integrated into the browser. It certainly helps/simplifies the problem, but I imagine in most cases a builtin image stitcher inside the screenshot tool could also work in great majority of cases. Infact I would expect someone have done that already..
    - rwmj 2y ago
      Yeah, definitely possible. The firefox screenshot feature is fairly smoothly integrated and intuitive, a rare moment of clarity from their UI team.
  - sgc 2y ago
    Just use `screenshot --fullpage` from the console. I usually do something like `screenshot --dpr 3 --fullpage` for a higher resolution image
    - rwmj 2y ago
      "Console" being the Linux shell or the Firefox JS console? I don't understand how that could work from the shell.
      - jonnybarnes 2y ago
        Yes, Console being the Firefox DevTools console
        aragilar 2y ago
        Is this different to the Web Developer console?
    - crtasm 2y ago
      Or rightclick on the page, Take Screenshot, Save full page button the --dpr option sounds useful, I'll try that out.
- wildpeaks 2y ago
  I hope it fixes the "too long filename" issue that often prevents screenshots from being saved (e.g. tweets with long messages) because it seems to use the window title to generate the filename.
- smoe 2y ago
  I use the Firefox screenshot tool quite a lot, mostly because it automatically snaps the region to DOM elements. This makes it less fiddly to take cleanly cropped screenshots of sections, especially if they don't entirely fit on the screen. I'm not that knowledgeable about the screenshot tooling space, but I feel all my needs are covered with the default system one plus the Firefox screenshot tool for convenience in some cases.
  - manuelmoreale 2y ago
    Maybe it's not the exact use case and maybe you know about this already but just in case, in the dev tools, if you right click on a node in the inspector you can directly take a screenshot of that specific node.
  - troyvit 2y ago
    Yeah I also like how I can get a whole page pretty easily, even if the page is several screens long.
- CuriousCosmic 2y ago
  One really important one for even non-dev users is that it isn't affected by DRM protections. Windows' screenshot tool nowadays blacks out any DRM content which makes screenshotting frames from a show, etc a royal pain in the ass, This is presumably because the tool can now also do video recording but either way it's very frustrating. The firefox tool doesn't have that issue.
qwertox 2y ago
I wish there was an option to disable the spawning of the "you have been updated" tab. I never read it, and, worse, the tab which was active when I closed Firefox will no longer be active, forcing me to go through a couple of tabs to find it again, while reloading all the tabs which I click through while searching. It's really annoying.
- asicsp 2y ago
  I think that's already there. I must have done it long back since I don't remember the last time I got it. Could be a flag if it's not an option in preferences.
- JadeNB 2y ago
  There's got to be an about:config entry that tells Firefox whether it's already displayed that tab, which, at worst, you could manually edit before starting. But, even if that were an acceptable solution, I couldn't find it with a quick search for "display", "update", or "tab", nor even find an up-to-date list of entries (I think that http://kb.mozillazine.org/About:config_entries http://kb.mozillazine.org/About:config_entries is quite old). EDIT: Actually, I know for sure that there's some preference that controls this, because I just updated and didn't see the new page; but I forget what it is. One suggestion I saw in https://superuser.com/a/1392487 https://superuser.com/a/1392487 was to change various addresses to non-existent pages; based on the names of their default values, `app.update.url.manual` might be a relevant one.
- ffpip 2y ago
  Try Type about:config in URL bar -> click proceed -> Search "browser.startup.homepage_override.mstone" in the shown search bar -> change value to "ignore" https://kb.mozillazine.org/Startup.homepage_override_url https://kb.mozillazine.org/Startup.homepage_override_url
  - qwertox 2y ago
    Thanks, this looks promising. I hope it also works with the "last session" tabs and doesn't pop up a homepage (If browser.startup.homepage_override.mstone is set to “ignore”, the browser’s homepage will not be overridden after updates.). I love Firefox's about:config page, it has so many options.
calvinmorrison 2y ago
[flagged]
- RyEgswuCsn 2y ago
  True browser-centric digital gurus don't restart their computer unless there is a power cut. They also don't shutdown their browser either.
  - _flux 2y ago
    Though the times you need to do this, do you want to wait for the extra two seconds? Certainly not! But actually I will enable this feature..
conradfr 2y ago
> Firefox will now automatically try to upgrade <img>, <audio>, and <video> elements from HTTP to HTTPS if they are embedded within an HTTPS page. If these so-called mixed content elements do not support HTTPS, they will no longer load. This is not so great for radio streaming as a lot of them still use http shoutcast servers (often with direct ip instead of domain name, so no https there anyway).
- mdaniel 2y ago
  > (often with direct ip instead of domain name, so no https there anyway). That's not true, one can have IP addresses in certificates, it's just very rare because virtual hosting makes "single IP" services rare nowadays: https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.6 https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.6 ("Defined options include an Internet electronic mail address, a DNS name, an IP address, and a Uniform Resource Identifier (URI).") OpenSSL uses "IP:" syntax in their subjectAltName field (e.g. https://mta.openssl.org/pipermail/openssl-users/2016-September/004515.html https://mta.openssl.org/pipermail/openssl-users/2016-Septemb... ) and the CAB seems to be on-board, subject to some "well, watch out for ..." language https://cabforum.org/working-groups/server/guidance-ip-addresses-certificates/ https://cabforum.org/working-groups/server/guidance-ip-addre...
  - _flux 2y ago
    So do CAs in general offer those? Are they as affordable as "normal" certs? Certainly you need to be paying for that those kind of certificates, possibly some premium? It's probably not worth it anyway, because you're now stuck with that single IP, for little benefit. In general IPs just don't get HTTPS certificates acquired for them.
    - mdaniel 2y ago
      Seems to be free from ZeroSSL https://help.zerossl.com/hc/en-us/articles/360060119973-Is-It-Possible-To-Generate-a-SSL-Certificate-for-an-IP-Address https://help.zerossl.com/hc/en-us/articles/360060119973-Is-I... but Letsencrypt decided against it since their whole thing is about proving ownership over a domain, or set of domains, and doing that for an IP address would be some nonsense. I would be absolutely shocked if the "name brand" cert issuers don't support CSRs containing iPAddress SAN entries, since it's very clearly part of the RFC, but I haven't ever had a need to try such a stunt, either
giancarlostoro 2y ago
> Firefox will now automatically try to upgrade <img>, <audio>, and <video> elements from HTTP to HTTPS if they are embedded within an HTTPS page. If these so-called mixed content elements do not support HTTPS, they will no longer load. Really interesting, and I think it makes sense, why show a padlock and mislead the user if not all content is properly going through HTTPS?
- deleted 2y ago
  [deleted]
- ffpip 2y ago
  They don't show a full padlock. They show one with a warning icon
- reidrac 2y ago
  Does it? so if the content can't be auto-upgraded to HTTPS, will be blocked. I rather have a padlock with a warning that... a broken website because missing content?
  - kstrauser 2y ago
    I'd say the website was already broken. I'd rather block content than have insecure resources fetched with a potentially sensitive referrer. That is, I don't want `https://example.com/why-does-my-butt-hurt https://example.com/why-does-my-butt-hurt` to fetch `http://media.example.com/spacer.gif http://media.example.com/spacer.gif` over the coffee shop's open wi-fi.
    - giancarlostoro 2y ago
      Very solid point and why it matters. I wonder if other browsers are or will do the same.
  - ygjb 2y ago
    There is an article linked in the release notes that allows users to opt-in to a less secure option. https://blog.mozilla.org/security/2024/06/05/firefox-will-upgrade-more-mixed-content-in-version-127/ https://blog.mozilla.org/security/2024/06/05/firefox-will-up...
red_admiral 2y ago
I'm just happy the update is not "We've integrated new AI features".
- mostlysimilar 2y ago
  Don't hold your breath, it's Mozilla after all. They're king of shooting themselves in the foot to pursue trends.
- lye 2y ago
  Why? Fully offline translations they've added in one of the recent versions are nice, I've used them today to read a couple of articles in French and did not notice any difference with Google Translate (compared them side by side). Another AI-related feature they promised recently are automatically generated alt descriptions for images that don't have any. Seems like a massively useful feature for the visually impaired.
  - red_admiral 2y ago
    To give a serious answer to your serious reply to my snarky post: I think we're in an AI hype cycle, I don't deny that AI is sometimes useful but it seems like everyone and their dog is trying to add some kind of "AI" to their product now, without thinking through either the value to the end user, or any privacy implications. They've just heard that AI = $$$ and are running with it. In some cases it even becomes one more way to slurp up everyone's data for ads and training yet more AI. Even Microsoft Recall could be useful for many people, but it should have been opt-in from the start. Personally I'd also wish that AI modules were only installed when you opt in, so you don't take up valuable space (especially on mobile) with a massive matrix of model weights unless the user actually asks for that.
    - asadotzler 2y ago
      I am responsible for the Firefox Translation feature (with my dev partner Andre Natal) and I'm proud to have introduced a great "AI" feature. Firefox Translation is powered by small language models (and a transformer architecture) that gives you 100% local translation with a minimal of hassle. It's the opposite of AI-hype and when I was at Mozilla building this, everyone was on the same page as me with using AI only where appropriate and not as a hype mechanism. I left Mozilla about a year ago so perhaps things have changed, but IMO you don't have to worry about Mozilla treating AI as $$$ (mostly because it's actually a huge cost center, I couldn't even get budget to train up beyond about 10 languages when Firefox is available in 100 languages.)
RheingoldRiver 2y ago
> navigator.clipboard.read()/write() has been enabled (see documentation). A paste context menu will appear for the user to confirm when attempting to read clipboard content that is not originated from a same-origin page. FINALLY, I've been following the ticket to implement this for so long
- ivanjermakov 2y ago
  Usually FF is the first to implement experimental specs, but this took so damn long.
  - difosfor 2y ago
    They still haven't finished WebCodecs support unfortunately
bastien2 2y ago
Still haven't fixed the white flash
- ranger_danger 2y ago
  Works on my machine /shrug
MattSteelblade 2y ago
I await with bated breath for integrated vertical tabs.
- beretguy 2y ago
  Try WaterFox.
AdmiralAsshat 2y ago
"Close Duplicate Tabs" is actually a really useful feature for some. My Firefox at work has dozens of tabs open at any given moment, mostly JIRA tickets, and it's very easy to have the same issue open in three different tabs when I'm constantly opening links from email, Teams, etc. I had looked into installing an extension to get similar functionality, but held off. I'm glad it's now baked into the software.
- lyu07282 2y ago
  Close all other tabs is also pretty useful yet infuriatingly hidden behind another context menu... their ux sucks imho
  - culi 2y ago
    Duplicate tab is my most useful. I like being able to maintain the history while starting a new tab
    - pxeger1 2y ago
      Tip: you can duplicate a tab by middle-clicking the refresh button
    - eikenberry 2y ago
      It is a manual function, not automatic. So best of both worlds. :)
    - hrnn 2y ago
      you can "sort of" duplicate a tab by ctrl + clicking on the back button. I use that more than duplicating.
- createaccount99 2y ago
  The problem is that duplicate tabs don't appear duplicate when they have different tracking params. Unless they somehow figured that out.
mrandish 2y ago
To Firefox's credit, they are the last major browser to inject themselves into our computer's startup (and at least they are providing notice and a way to disable it). I find it not only annoying but arrogant how most other software companies assume our lives revolve around their particular tool. So much so that, obviously, we must want their software to leech our time, bandwidth and power running its setup caching (and checking for / installing updates) every damn time we boot our computers. No need to ask permission to inject your silent bloat into our daily lives or even offer a way to disable adding it! Ultimately, I blame the OS for allowing apps to inject startup cruft silently and without explicit user consent. Aside from increasing the security/privacy attack surface, that ever-growing pile of aging cruft-ware makes their OS slower and less stable. It's now a regular manual maintenance task to de-cruft each of my PCs. And since Windows has so thoughtfully provided over a dozen legitimate ways for apps to silently insert startup bloat, a special tool is needed: Autoruns (https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns https://learn.microsoft.com/en-us/sysinternals/downloads/aut...). Amazingly, many apps now go and check that all their startup cruft is intact and, if not, "fix" it every time they run (looking at you Chrome).
- Steltek 2y ago
  Moving PCs to a more mobile-like environment, where apps are always sandboxed and all permissions are explicit, sounds so tempting. But then you realize that manufacturers will always cross the line: MS and Apple apps get special privileges, the bootloader will be permanently locked, and you'll eat your DRM because you have no other choice. I prefer to curate my own apps and if they misbehave, they're uninstalled immediately. The downside there is this philosophy feels a lot like, "I don't need a virus scanner because I'm too good to get stung by a virus". Still, it seems better than the alternative hell.
  - jwells89 2y ago
    The problem is, reliably catching programs misbehaving is non-trivial even for the technically capable, let alone everybody else which easily results in a lot of damage having been done by the time they’re caught, if they’re caught. I don’t think there’s a practical way forward for desktop OSes that don’t embrace sandboxing and tight permission controls, at least for the masses. Even for myself, I’d be more comfortable using an OS like that — if trust of the corporations making the OSes becomes an issue, the solution that’s apparent to me is to run a Linux distribution with deeply integrated permissions and sandboxing, not to run without either.
JimDabell 2y ago
> You can now set Firefox to automatically launch whenever you start or restart your Windows computer. Setting Firefox to auto-launch optimizes efficiency in our browser-centric digital routines, eliminating manual startup delays and facilitating immediate web access. What’s going on at Mozilla that caused normal release notes to get transformed into awful marketing speak like this?
- nullc 2y ago
  Sounds like someone using a particularly pathetic RLHFed LLM such as OpenAI's products.
- VWWHFSfQ 2y ago
  Firefox and Mozilla are basically dead living only off of Google's charity. It's a welfare case. If I didn't personally know some Mozilla employees then I would honestly be surprised that anyone actually worked there.
- inanutshellus 2y ago
  Mozilla is explaining why you'd enable a feature they defaulted off. Those benefit from a sales pitch. If anything, I'd say it's the opposite problem -- that, instead of a marketer, they left the marketing speak to an alpha nerd and no one else proofread it.
  - moritzwarhier 2y ago
    Haha, reading again, this is pretty apt. Hopefully it fits with the target audience, to me it read relatively sound. How did Chrome advertise this at the time? "Security"? The full maximum Google Experience?
- ReadCarlBarks 2y ago
  Related: https://connect.mozilla.org/t5/discussions/mozilla-now-only-seems-to-speak-using-creepy-gibberish-lunatic/m-p/16863 https://connect.mozilla.org/t5/discussions/mozilla-now-only-...
silverwind 2y ago
Developer release notes here: https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Releases/127 https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Rel... Notably, Async Clipboard API is now fully enabled.
lopkeny12ko 2y ago
> Firefox will now automatically try to upgrade <img>, <audio>, and <video> elements from HTTP to HTTPS if they are embedded within an HTTPS page. If these so-called mixed content elements do not support HTTPS, they will no longer load. Web developers make no sense to me. In one moment, it's all about "not breaking the web" (see: Smooshgate, and the stubborn resistance to reasonable API naming because it would break a 15-year-old third party library). And then they casually drop a huge breaking change like this. Ok.
- arp242 2y ago
  It's almost as if people consider all possible upsides and downsides, and try to make a good trade-off for that specific situation, instead of adhering to a simplistic black/white thinking...
- coldpie 2y ago
  It's all trade-offs. No one likes breaking software. In this case, it's a security issue, so that can justify a breaking change.
- halJordan 2y ago
  Safari already disallows mixed content, so not really new. And it's been an error for a long time, no one should really be surprised that their broken code is broken causing their website to break. It's more surprising that you are demanding we keep allowing affirmatively wrong code.
- cesarb 2y ago
  Changes made in the name of security have a higher chance of being allowed to break backwards compatibility. If changing that API name fixed some security issue, or even reduced the security exposure of some part of the browser, it might be allowed even if it breaks some third-part library.
qwertyuiop_ 2y ago
Tangential question to fellow tech observers, have any of you Mac users found an optimal plugin/ extension similar to ublock origin for Safari ? Safari is buttery smooth and runs cool. I hate to use Firefox / Chrome just for ublock origin's reasons.
- tracker1 2y ago
  Less than perfect, but could start with a PiHole or other blocking DNS service.
- jcotton42 2y ago
  AdGuard has been working well enough for me.
- promiseofbeans 2y ago
  If you use Kagi's Orion (which is Webkit, like Safari), you can install either Firefox or Chrome extensions from their respective stores
thesnide 2y ago
> the CPU architecture for 32-bit x86 Linux will now be reported as x86_64 in Firefox's User-Agent And in a few months, everyone will state that no 32 bit users remain and support can be dropped. #facepalm
- Akashic101 2y ago
  I'm curious, what kind of features in the Web are dependent on the PC being x32 or x64? What even would there be to shut down?
  - CuriousCosmic 2y ago
    Downloads. If the user agent reports 32 bit, when you go to download an installer, the page can present you with the 32 bit version. Likewise with 64 bit (from the early days when 32 bit was more common). Same goes with reporting that it's x86 vs ARM. So now if you are on an old 32 bit machine and try to install new software from the web, it'll give you a 64 bit installer that you almost certainly won't even be able to run on your machine. Now with linux that's less of an issue given that installs on linux already depend on a ton of stuff (and linux users tend to understand the difference between 32bit and 64bit)
    - ReadCarlBarks 2y ago
      Linux users don't usually download installers from websites.
      - thesnide 2y ago
        No, but then the firefox team will stop caring for 32bit because some online metric shows that there is no 32bit firefox users anymore
Avlin67 2y ago
why it loads for ages sometimes ? it feels sluggish and unstable on latests versions...
- asadotzler 2y ago
  Try a Firefox Refresh. about:support, click the button in the top right.
beretguy 2y ago
Let me know when they add tab groups.

160 points by skilled 2y ago

> The Screenshots feature in Firefox has gotten a big update! It now supports taking screenshots of file types like SVG, XML, and more as well as various about: pages within Firefox. We've also made the screenshot tool more accessible to everyone by implementing new keyboard shortcuts and adding theme compatibility and High Contrast Mode (HCM) support. And finally, performance for capturing large screenshots has been improved. I have no problem with this feature, but am curious if it brings any new functionality beyond existing screenshot tools.

rwmj 2y ago
I actually used the screenshots feature for the first time (to illustrate my devconf.cz talk this week, do come, it's free!). The nice thing about it is that you can scroll the page while framing the screenshot, allowing you to take a shot of the whole page including everything below the fold. I think such a feature needs to be integrated into the browser.
- _flux 2y ago
  > I think such a feature needs to be integrated into the browser. It certainly helps/simplifies the problem, but I imagine in most cases a builtin image stitcher inside the screenshot tool could also work in great majority of cases. Infact I would expect someone have done that already..
  - rwmj 2y ago
    Yeah, definitely possible. The firefox screenshot feature is fairly smoothly integrated and intuitive, a rare moment of clarity from their UI team.
- sgc 2y ago
  Just use `screenshot --fullpage` from the console. I usually do something like `screenshot --dpr 3 --fullpage` for a higher resolution image
  - rwmj 2y ago
    "Console" being the Linux shell or the Firefox JS console? I don't understand how that could work from the shell.
    - jonnybarnes 2y ago
      Yes, Console being the Firefox DevTools console
      - aragilar 2y ago
        Is this different to the Web Developer console?
  - crtasm 2y ago
    Or rightclick on the page, Take Screenshot, Save full page button the --dpr option sounds useful, I'll try that out.
wildpeaks 2y ago
I hope it fixes the "too long filename" issue that often prevents screenshots from being saved (e.g. tweets with long messages) because it seems to use the window title to generate the filename.
smoe 2y ago
I use the Firefox screenshot tool quite a lot, mostly because it automatically snaps the region to DOM elements. This makes it less fiddly to take cleanly cropped screenshots of sections, especially if they don't entirely fit on the screen. I'm not that knowledgeable about the screenshot tooling space, but I feel all my needs are covered with the default system one plus the Firefox screenshot tool for convenience in some cases.
- manuelmoreale 2y ago
  Maybe it's not the exact use case and maybe you know about this already but just in case, in the dev tools, if you right click on a node in the inspector you can directly take a screenshot of that specific node.
- troyvit 2y ago
  Yeah I also like how I can get a whole page pretty easily, even if the page is several screens long.
CuriousCosmic 2y ago
One really important one for even non-dev users is that it isn't affected by DRM protections. Windows' screenshot tool nowadays blacks out any DRM content which makes screenshotting frames from a show, etc a royal pain in the ass, This is presumably because the tool can now also do video recording but either way it's very frustrating. The firefox tool doesn't have that issue.

qwertox 2y ago

I wish there was an option to disable the spawning of the "you have been updated" tab. I never read it, and, worse, the tab which was active when I closed Firefox will no longer be active, forcing me to go through a couple of tabs to find it again, while reloading all the tabs which I click through while searching. It's really annoying.

asicsp 2y ago
I think that's already there. I must have done it long back since I don't remember the last time I got it. Could be a flag if it's not an option in preferences.
JadeNB 2y ago
There's got to be an about:config entry that tells Firefox whether it's already displayed that tab, which, at worst, you could manually edit before starting. But, even if that were an acceptable solution, I couldn't find it with a quick search for "display", "update", or "tab", nor even find an up-to-date list of entries (I think that http://kb.mozillazine.org/About:config_entries http://kb.mozillazine.org/About:config_entries is quite old). EDIT: Actually, I know for sure that there's some preference that controls this, because I just updated and didn't see the new page; but I forget what it is. One suggestion I saw in https://superuser.com/a/1392487 https://superuser.com/a/1392487 was to change various addresses to non-existent pages; based on the names of their default values, `app.update.url.manual` might be a relevant one.
ffpip 2y ago
Try Type about:config in URL bar -> click proceed -> Search "browser.startup.homepage_override.mstone" in the shown search bar -> change value to "ignore" https://kb.mozillazine.org/Startup.homepage_override_url https://kb.mozillazine.org/Startup.homepage_override_url
- qwertox 2y ago
  Thanks, this looks promising. I hope it also works with the "last session" tabs and doesn't pop up a homepage (If browser.startup.homepage_override.mstone is set to “ignore”, the browser’s homepage will not be overridden after updates.). I love Firefox's about:config page, it has so many options.

calvinmorrison 2y ago

[flagged]

RyEgswuCsn 2y ago
True browser-centric digital gurus don't restart their computer unless there is a power cut. They also don't shutdown their browser either.
- _flux 2y ago
  Though the times you need to do this, do you want to wait for the extra two seconds? Certainly not! But actually I will enable this feature..

conradfr 2y ago

> Firefox will now automatically try to upgrade <img>, <audio>, and <video> elements from HTTP to HTTPS if they are embedded within an HTTPS page. If these so-called mixed content elements do not support HTTPS, they will no longer load. This is not so great for radio streaming as a lot of them still use http shoutcast servers (often with direct ip instead of domain name, so no https there anyway).

mdaniel 2y ago
> (often with direct ip instead of domain name, so no https there anyway). That's not true, one can have IP addresses in certificates, it's just very rare because virtual hosting makes "single IP" services rare nowadays: https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.6 https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.6 ("Defined options include an Internet electronic mail address, a DNS name, an IP address, and a Uniform Resource Identifier (URI).") OpenSSL uses "IP:" syntax in their subjectAltName field (e.g. https://mta.openssl.org/pipermail/openssl-users/2016-September/004515.html https://mta.openssl.org/pipermail/openssl-users/2016-Septemb... ) and the CAB seems to be on-board, subject to some "well, watch out for ..." language https://cabforum.org/working-groups/server/guidance-ip-addresses-certificates/ https://cabforum.org/working-groups/server/guidance-ip-addre...
- _flux 2y ago
  So do CAs in general offer those? Are they as affordable as "normal" certs? Certainly you need to be paying for that those kind of certificates, possibly some premium? It's probably not worth it anyway, because you're now stuck with that single IP, for little benefit. In general IPs just don't get HTTPS certificates acquired for them.
  - mdaniel 2y ago
    Seems to be free from ZeroSSL https://help.zerossl.com/hc/en-us/articles/360060119973-Is-It-Possible-To-Generate-a-SSL-Certificate-for-an-IP-Address https://help.zerossl.com/hc/en-us/articles/360060119973-Is-I... but Letsencrypt decided against it since their whole thing is about proving ownership over a domain, or set of domains, and doing that for an IP address would be some nonsense. I would be absolutely shocked if the "name brand" cert issuers don't support CSRs containing iPAddress SAN entries, since it's very clearly part of the RFC, but I haven't ever had a need to try such a stunt, either

giancarlostoro 2y ago

> Firefox will now automatically try to upgrade <img>, <audio>, and <video> elements from HTTP to HTTPS if they are embedded within an HTTPS page. If these so-called mixed content elements do not support HTTPS, they will no longer load. Really interesting, and I think it makes sense, why show a padlock and mislead the user if not all content is properly going through HTTPS?

deleted 2y ago
[deleted]
ffpip 2y ago
They don't show a full padlock. They show one with a warning icon
reidrac 2y ago
Does it? so if the content can't be auto-upgraded to HTTPS, will be blocked. I rather have a padlock with a warning that... a broken website because missing content?
- kstrauser 2y ago
  I'd say the website was already broken. I'd rather block content than have insecure resources fetched with a potentially sensitive referrer. That is, I don't want `https://example.com/why-does-my-butt-hurt https://example.com/why-does-my-butt-hurt` to fetch `http://media.example.com/spacer.gif http://media.example.com/spacer.gif` over the coffee shop's open wi-fi.
  - giancarlostoro 2y ago
    Very solid point and why it matters. I wonder if other browsers are or will do the same.
- ygjb 2y ago
  There is an article linked in the release notes that allows users to opt-in to a less secure option. https://blog.mozilla.org/security/2024/06/05/firefox-will-upgrade-more-mixed-content-in-version-127/ https://blog.mozilla.org/security/2024/06/05/firefox-will-up...

red_admiral 2y ago

I'm just happy the update is not "We've integrated new AI features".

mostlysimilar 2y ago
Don't hold your breath, it's Mozilla after all. They're king of shooting themselves in the foot to pursue trends.
lye 2y ago
Why? Fully offline translations they've added in one of the recent versions are nice, I've used them today to read a couple of articles in French and did not notice any difference with Google Translate (compared them side by side). Another AI-related feature they promised recently are automatically generated alt descriptions for images that don't have any. Seems like a massively useful feature for the visually impaired.
- red_admiral 2y ago
  To give a serious answer to your serious reply to my snarky post: I think we're in an AI hype cycle, I don't deny that AI is sometimes useful but it seems like everyone and their dog is trying to add some kind of "AI" to their product now, without thinking through either the value to the end user, or any privacy implications. They've just heard that AI = $$$ and are running with it. In some cases it even becomes one more way to slurp up everyone's data for ads and training yet more AI. Even Microsoft Recall could be useful for many people, but it should have been opt-in from the start. Personally I'd also wish that AI modules were only installed when you opt in, so you don't take up valuable space (especially on mobile) with a massive matrix of model weights unless the user actually asks for that.
  - asadotzler 2y ago
    I am responsible for the Firefox Translation feature (with my dev partner Andre Natal) and I'm proud to have introduced a great "AI" feature. Firefox Translation is powered by small language models (and a transformer architecture) that gives you 100% local translation with a minimal of hassle. It's the opposite of AI-hype and when I was at Mozilla building this, everyone was on the same page as me with using AI only where appropriate and not as a hype mechanism. I left Mozilla about a year ago so perhaps things have changed, but IMO you don't have to worry about Mozilla treating AI as $$$ (mostly because it's actually a huge cost center, I couldn't even get budget to train up beyond about 10 languages when Firefox is available in 100 languages.)

RheingoldRiver 2y ago

> navigator.clipboard.read()/write() has been enabled (see documentation). A paste context menu will appear for the user to confirm when attempting to read clipboard content that is not originated from a same-origin page. FINALLY, I've been following the ticket to implement this for so long

ivanjermakov 2y ago
Usually FF is the first to implement experimental specs, but this took so damn long.
- difosfor 2y ago
  They still haven't finished WebCodecs support unfortunately

bastien2 2y ago

Still haven't fixed the white flash

ranger_danger 2y ago
Works on my machine /shrug

MattSteelblade 2y ago

I await with bated breath for integrated vertical tabs.

beretguy 2y ago
Try WaterFox.

AdmiralAsshat 2y ago

"Close Duplicate Tabs" is actually a really useful feature for some. My Firefox at work has dozens of tabs open at any given moment, mostly JIRA tickets, and it's very easy to have the same issue open in three different tabs when I'm constantly opening links from email, Teams, etc. I had looked into installing an extension to get similar functionality, but held off. I'm glad it's now baked into the software.

lyu07282 2y ago
Close all other tabs is also pretty useful yet infuriatingly hidden behind another context menu... their ux sucks imho
- culi 2y ago
  Duplicate tab is my most useful. I like being able to maintain the history while starting a new tab
  - pxeger1 2y ago
    Tip: you can duplicate a tab by middle-clicking the refresh button
  - eikenberry 2y ago
    It is a manual function, not automatic. So best of both worlds. :)
  - hrnn 2y ago
    you can "sort of" duplicate a tab by ctrl + clicking on the back button. I use that more than duplicating.
createaccount99 2y ago
The problem is that duplicate tabs don't appear duplicate when they have different tracking params. Unless they somehow figured that out.

mrandish 2y ago

To Firefox's credit, they are the last major browser to inject themselves into our computer's startup (and at least they are providing notice and a way to disable it). I find it not only annoying but arrogant how most other software companies assume our lives revolve around their particular tool. So much so that, obviously, we must want their software to leech our time, bandwidth and power running its setup caching (and checking for / installing updates) every damn time we boot our computers. No need to ask permission to inject your silent bloat into our daily lives or even offer a way to disable adding it! Ultimately, I blame the OS for allowing apps to inject startup cruft silently and without explicit user consent. Aside from increasing the security/privacy attack surface, that ever-growing pile of aging cruft-ware makes their OS slower and less stable. It's now a regular manual maintenance task to de-cruft each of my PCs. And since Windows has so thoughtfully provided over a dozen legitimate ways for apps to silently insert startup bloat, a special tool is needed: Autoruns (https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns https://learn.microsoft.com/en-us/sysinternals/downloads/aut...). Amazingly, many apps now go and check that all their startup cruft is intact and, if not, "fix" it every time they run (looking at you Chrome).

Steltek 2y ago
Moving PCs to a more mobile-like environment, where apps are always sandboxed and all permissions are explicit, sounds so tempting. But then you realize that manufacturers will always cross the line: MS and Apple apps get special privileges, the bootloader will be permanently locked, and you'll eat your DRM because you have no other choice. I prefer to curate my own apps and if they misbehave, they're uninstalled immediately. The downside there is this philosophy feels a lot like, "I don't need a virus scanner because I'm too good to get stung by a virus". Still, it seems better than the alternative hell.
- jwells89 2y ago
  The problem is, reliably catching programs misbehaving is non-trivial even for the technically capable, let alone everybody else which easily results in a lot of damage having been done by the time they’re caught, if they’re caught. I don’t think there’s a practical way forward for desktop OSes that don’t embrace sandboxing and tight permission controls, at least for the masses. Even for myself, I’d be more comfortable using an OS like that — if trust of the corporations making the OSes becomes an issue, the solution that’s apparent to me is to run a Linux distribution with deeply integrated permissions and sandboxing, not to run without either.

JimDabell 2y ago

> You can now set Firefox to automatically launch whenever you start or restart your Windows computer. Setting Firefox to auto-launch optimizes efficiency in our browser-centric digital routines, eliminating manual startup delays and facilitating immediate web access. What’s going on at Mozilla that caused normal release notes to get transformed into awful marketing speak like this?

nullc 2y ago
Sounds like someone using a particularly pathetic RLHFed LLM such as OpenAI's products.
VWWHFSfQ 2y ago
Firefox and Mozilla are basically dead living only off of Google's charity. It's a welfare case. If I didn't personally know some Mozilla employees then I would honestly be surprised that anyone actually worked there.
inanutshellus 2y ago
Mozilla is explaining why you'd enable a feature they defaulted off. Those benefit from a sales pitch. If anything, I'd say it's the opposite problem -- that, instead of a marketer, they left the marketing speak to an alpha nerd and no one else proofread it.
- moritzwarhier 2y ago
  Haha, reading again, this is pretty apt. Hopefully it fits with the target audience, to me it read relatively sound. How did Chrome advertise this at the time? "Security"? The full maximum Google Experience?
ReadCarlBarks 2y ago
Related: https://connect.mozilla.org/t5/discussions/mozilla-now-only-seems-to-speak-using-creepy-gibberish-lunatic/m-p/16863 https://connect.mozilla.org/t5/discussions/mozilla-now-only-...

silverwind 2y ago

Developer release notes here: https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Releases/127 https://developer.mozilla.org/en-US/docs/Mozilla/Firefox/Rel... Notably, Async Clipboard API is now fully enabled.

lopkeny12ko 2y ago

> Firefox will now automatically try to upgrade <img>, <audio>, and <video> elements from HTTP to HTTPS if they are embedded within an HTTPS page. If these so-called mixed content elements do not support HTTPS, they will no longer load. Web developers make no sense to me. In one moment, it's all about "not breaking the web" (see: Smooshgate, and the stubborn resistance to reasonable API naming because it would break a 15-year-old third party library). And then they casually drop a huge breaking change like this. Ok.

arp242 2y ago
It's almost as if people consider all possible upsides and downsides, and try to make a good trade-off for that specific situation, instead of adhering to a simplistic black/white thinking...
coldpie 2y ago
It's all trade-offs. No one likes breaking software. In this case, it's a security issue, so that can justify a breaking change.
halJordan 2y ago
Safari already disallows mixed content, so not really new. And it's been an error for a long time, no one should really be surprised that their broken code is broken causing their website to break. It's more surprising that you are demanding we keep allowing affirmatively wrong code.
cesarb 2y ago
Changes made in the name of security have a higher chance of being allowed to break backwards compatibility. If changing that API name fixed some security issue, or even reduced the security exposure of some part of the browser, it might be allowed even if it breaks some third-part library.

qwertyuiop_ 2y ago

Tangential question to fellow tech observers, have any of you Mac users found an optimal plugin/ extension similar to ublock origin for Safari ? Safari is buttery smooth and runs cool. I hate to use Firefox / Chrome just for ublock origin's reasons.

tracker1 2y ago
Less than perfect, but could start with a PiHole or other blocking DNS service.
jcotton42 2y ago
AdGuard has been working well enough for me.
promiseofbeans 2y ago
If you use Kagi's Orion (which is Webkit, like Safari), you can install either Firefox or Chrome extensions from their respective stores

thesnide 2y ago

> the CPU architecture for 32-bit x86 Linux will now be reported as x86_64 in Firefox's User-Agent And in a few months, everyone will state that no 32 bit users remain and support can be dropped. #facepalm

Akashic101 2y ago
I'm curious, what kind of features in the Web are dependent on the PC being x32 or x64? What even would there be to shut down?
- CuriousCosmic 2y ago
  Downloads. If the user agent reports 32 bit, when you go to download an installer, the page can present you with the 32 bit version. Likewise with 64 bit (from the early days when 32 bit was more common). Same goes with reporting that it's x86 vs ARM. So now if you are on an old 32 bit machine and try to install new software from the web, it'll give you a 64 bit installer that you almost certainly won't even be able to run on your machine. Now with linux that's less of an issue given that installs on linux already depend on a ton of stuff (and linux users tend to understand the difference between 32bit and 64bit)
  - ReadCarlBarks 2y ago
    Linux users don't usually download installers from websites.
    - thesnide 2y ago
      No, but then the firefox team will stop caring for 32bit because some online metric shows that there is no 32bit firefox users anymore

Avlin67 2y ago

why it loads for ages sometimes ? it feels sluggish and unstable on latests versions...

asadotzler 2y ago
Try a Firefox Refresh. about:support, click the button in the top right.

beretguy 2y ago

Let me know when they add tab groups.