10 ms·

Firefox 37 Release Notes

159 points by footpath 12y ago

publicfig 12y ago
I understand that the Heartbeat user rating system can be disabled, but I'm still very much against it and think it will drive a lot of less technically-savvy users mad. I honestly thought it was an April Fools joke at first through reading it.
- itsthatguyagain 12y ago
  And sigh, yet something else I'll have to disable (or remember to disable) on new installs and upgrades. I wonder if non-savvy people will be able to figure out how to disable it so it doesn't interrupt their time on the internet.
  - walterbell 12y ago
    Yikes. At what point will people start backporting security fixes to an older version of Firefox, to avoid the forced bundling of unwanted browser "features"?
    - mccr8 12y ago
      I realize that you are just making a snarky dig, but probably never. It would be a huge amount of work just to backport basic security fixes, and almost impossible to backport large architectural changes that are made in the service of security. Are you going to backport multiprocess Firefox once that is working? It is much easier to flip a preference. If you wanted to get sophisticated, you could create an addon that disables all of the preferences you dislike.
      - jamespo 12y ago
        Will setting the about:config option to disable be preserved across browsers with firefox sync?
        reubenmorais 12y ago
        It will if there's a corresponding services.sync.prefs.sync.the.pref.you.want.synced.here pref set.
      - walterbell 12y ago
        > you could create an addon that disables all of the preferences you dislike. That's a good idea. Another option is to patch the code to remove the new features, unless Mozilla has taken steps to deter unbundling.
        sp332 12y ago
        Mozilla is very protective of the Firefox trademark. They don't even use it for their own nightly builds, because they want people to associate "Firefox" with stability. So they make it very easy to unbundle.
    - melling 12y ago
      There's an opportunity cost to supporting older versions. Sure, there's always going to be a small group of people who are happy with what they currently have but most people are happy moving forward. If there's a big enough market, perhaps some company will backport the security fixes. How much are you willing to pay? Another option is that you could volunteer and start the fork. Of course, there's that other problem where developers are only going to support the latest browser.
      - walterbell 12y ago
        A functional subset would not be a fork. If users were given a choice, we would find out which version they considered best aligned with the brand.
        melling 12y ago
        You aren't being clear. Do you think that older code that gives older functionality doesn't ever get changed? Patches will have to be created, etc. It's not trivial work. And as I mentioned, web developers aren't going to support the older CSS/HTML/JavaScript in your older browser.
        walterbell 12y ago
        Lack of clarity was due to sibling comment. Repeating here: an option is to patch the current code to remove unwanted new features. This provides users with current features, e.g. CSS/HTML/JS and security fixes, a "minimal build" of the browser.
- johnchristopher 12y ago
  I wondered what that `Hearbeat` thing was so for once I checked the release notes and https://wiki.mozilla.org/Advocacy/heartbeat#Experience_Flow https://wiki.mozilla.org/Advocacy/heartbeat#Experience_Flow > Every day a random subset of users are offered a rating widget > After rating Firefox, an ENGAGEMENT page may open in a background tab. That's... not the phoenix I signed up for.
  - maxerickson 12y ago
    Even when it was Phoenix, the branding or whatever you want to call it was to focus on users. Compared to Mozilla/Navigator that meant stripping out a whole lot of stuff, but an effort to find out what their broader set of users want is not incompatible with the original mission. (I'm sure I'll toggle this off)
  - danpat 12y ago
    Related: https://careers.mozilla.org/en-US/position/oXqA0fwH https://careers.mozilla.org/en-US/position/oXqA0fwH
- ehPReth 12y ago
  The check-in URL for heartbeat seems to be HTTP ("http://self-repair.mozilla.org/%LOCALE%/repair" http://self-repair.mozilla.org/%LOCALE%/repair"). Will Firefox 37.0 automatically convert that to HTTPS (HSTS preload, etc) or is there an insecure redirect lurking?
  - fabrice_d 12y ago
    It's a https url. Check the source: http://mxr.mozilla.org/mozilla-central/source/browser/app/profile/firefox.js?rev=77a2c0f13869#1029 http://mxr.mozilla.org/mozilla-central/source/browser/app/pr...
    - ehPReth 12y ago
      Is the 'mozilla-release' branch for the current 37.0 release? It shows 'http' instead of 'https': https://mxr.mozilla.org/mozilla-release/source/browser/app/profile/firefox.js#1036 https://mxr.mozilla.org/mozilla-release/source/browser/app/p...
      - fabrice_d 12y ago
        You're right. It was changed to https in https://bugzilla.mozilla.org/show_bug.cgi?id=1138323 https://bugzilla.mozilla.org/show_bug.cgi?id=1138323 and will only end up in Firefox 39
        ehPReth 12y ago
        Ah, I see. Thanks! Too bad it didn't land for 37.0 but glad to see it fixed for the future
- coldpie 12y ago
  Just wondering, what do you find so problematic about it? These kinds of rating prompts are extremely common in the mobile app space. They work there, presumably, or they wouldn't be so common. Why don't you think the idea will work here? I'm a big fan of Firefox, and I would find being prompted to provide them with useful feedback a positive experience.
  - freehunter 12y ago
    There are a lot of things that work in the mobile space that are use-hostile. The only reason they work is due to limited choice (or at least the perception of limited choice). Ads popping up in between games is common, let's support Firefox by randomly disabling the pop-up blocker. IAP is common, let's give users the ability to view static sites, but CSS is ten sites for 99c, Javascript is five sites for $1.99, or you can get it all for $99! Subscribers get SSL added on for only $15/mo.
drzaiusapelord 12y ago
>Yandex set as default search provider for the Turkish locale Interesting. Looks like Putin's relationship with Erdogan gets cozier all the time. Yandex has a very strong connection to Russian intelligence services: http://www.bbc.com/news/business-13274443 http://www.bbc.com/news/business-13274443
- k__ 12y ago
  This may be, but what has it to do with Firefox? Doesn't Mozilla decides for itself, which default it sets?
  - walterbell 12y ago
    Is Yandex paying Mozilla to be the default for Turkey?
    - dublinben 12y ago
      That's usually how these deals come about. No figures were revealed in the press release, but it should eventually become public in their yearly IRS filing.
    - gkya 12y ago
      Well, probably. Yandex has been active in the market here in Turkey, offering its services including a map with street views. They also put up ads on TV and billboards.
- ldng 12y ago
  Hum, never though of it this way. It also make business sence since Yandex strength is probably the handling of complex language in information retrieval. I always though the angle was to then address middle-east market with better indexing/search of Arabic content. Now, it's not impossible there is a political angle to it.
- isxek 12y ago
  Doesn't DuckDuckGo use Yandex's search results?
DangerousPie 12y ago
> Implemented a subset of the Media Source Extensions (MSE) API to allow native HTML5 playback on YouTube This is great! Actually just today I was wondering why Firefox was still using the Flash player for Youtube. Now it isn't anymore :)
- kzrdude 12y ago
  Firefox was stuck on 360p html5 video before, I'm going to try this asap
- JoshTriplett 12y ago
  As far as I can tell, HTML5 playback has worked just fine in Firefox for a while (including HD), for any video that doesn't have ads. MSE just allows additional features in HTML5 playback, such as DASH (which dynamically adjusts bitrate to match available connection bandwidth/quality). (Personally, whenever it fails, or sometimes even when it doesn't, I use youtube-dl.)
  - elektronjunge 12y ago
    This is correct. I haven't had flash on my computer for nearly a year and I've been able to watch hd youtube videos in firefox.
  - shmerl 12y ago
    No, it didn't work for anything higher than 720p. For those Youtube requires using DASH + MSE.
    - jfreax 12y ago
      I read this everywhere, but I am able to watch 1080p Youtube videos with html5 just fine since, yeahh... always, at least it feels like that. I tried it just a second ago. So it works definitively with Firefox 36 on Gentoo Linux. What am I doing "wrong"? What am I missing here?
      - 12y ago
blinkingled 12y ago
Working great on Lollipop here. Prior version was crashing quite a bit.
- darklajid 12y ago
  I'm about to give it up on Android again. Nice browser. Better than Chrome. But the UI sucks. First they managed to have a different UI on tablets (phone: Tab button in the upper right corner, upper left on the tablet). Then they iterated and came out with a new (and soon to be if not already) mandatory tablet UI that just .. well .. it's bad. I still regularly try to open a link in a tab and hit 'share', because at some point in the past they decided that the menu on a link should be - share - open in tab - open in private tab etc. I'm a fan, use it on the desktop, wish that FxOS succeeds - but Fennec is a constant nuisance and complete UX failure for me.
  - blinkingled 12y ago
    Yeah the ui is kind of hit and miss and performance not quite as good but it's getting there and we can have add ons! Wish I had the time and drive to contribute to the ux - truly appreciate having the option of independent browser on mobile device.
  - babuskov 12y ago
    The main problem on Android for me is that there's absolutely no way to download a file. Chrome has Save Link As option for links, but Firefox does not. It's interesting that you can still download videos if you let them play and then hold the finger in the middle of the video until a menu pops up and you can Save it from there. So the download functionality is there, it just isn't exposed. This is a shame, because that download function works much better than the one in Chrome (with Firefox, you can pause/continue).
    - TazeTSchnitzel 12y ago
      > The main problem on Android for me is that there's absolutely no way to download a file. That's really odd given that Android has a proper filesystem that applications can (and do!) access.
Silhouette 12y ago
The new Security Panel on the Network Monitor display seems helpful. Even better, it seems that Firefox has finally stopped erroneously reporting that some pages with multimedia content served properly over HTTPS were only partially encrypted. This had been a long-standing issue and the early comments from developers were not promising, so kudos and my personal thanks to whoever has fixed this one.
mmastrac 12y ago
"display: contents" is an interesting addition. It appears to take an element out of the tree, replacing it entirely with its children. Anyone have any thoughts on what that could be used for?
- dguaraglia 12y ago
  I imagine you can use it to ensure that elements that are added simply for semantic purposes (like, say, containers for other elements that are there just to group them logically) do not create any boxing side effects, like default padding and similar non-obvious CSS buggery.
  - taeric 12y ago
    I fear that now we will just replace it with another set of non-obvious CSS behavior. Consider, does this property nest well? How does absolute positioning work against something like this? Do they just ignore the parent box, since they are replacing it? Undefined or Browser specific. Or just a further explosion of the spec?
    - bzbarsky 12y ago
      All of this is defined in the spec. display:contents just means that in the box tree the box is elided and its child boxes are placed where it used to be, and then things proceed as normal. If you have nested display:contents things, it just works: you end up with a box and what used to be its great-nephews/nieces in the same flat list is all.
      - taeric 12y ago
        My point is really that I am not even sure what I would expect to happen in such cases. To the point that I will find it hardly surprising when developers on a browser inevitably makes a mistake in implementation. So, yes, this may all be there in the spec. But this is really just making the spec larger and larger with what seems to be nominal, if not decreasing, gains.
erichurkman 12y ago
Don't forget to check the Firefox 37 for developers [0] page which has more detailed info (it's linked from the sidebar of the public release notes). [0] https://developer.mozilla.org/en-US/Firefox/Releases/37 https://developer.mozilla.org/en-US/Firefox/Releases/37
shmerl 12y ago
MSE on Youtube at last. UPDATE: Strangely, media.mediasource.enabled still remained false for me in Firefox 37 (Linux). I had to manually set it to true, and it's highlighted, meaning that default is still false... Not sure how it fits with release notes then.
- doublec 12y ago
  MSE is only enabled by default on Windows for this release. You can enable it manually for other platforms via the about:config setting.
  - shmerl 12y ago
    Was it still buggy on Linux? Release notes mention some other points as relevant to the Windows version only, so it probably made sense to mention it for MSE too to avoid confusion.
    - doublec 12y ago
      Not so much buggy as less tested. I use it on my linux laptop and have relatively few issues.
    - doublec 12y ago
      Release notes have been updated to say Windows only now.
      - shmerl 12y ago
        Thanks!
  - sagischwarz 12y ago
    On a Windows 8.1 machine with FF37, I get "An error occured, please try again later." for all videos on YouTube. Disabling media.mediasource.enabled in about:config fixes the problem. Anyone else?
super_mario 12y ago
So, Mozilla wants to change the ad industry, while preserving user privacy? https://careers.mozilla.org/en-US/position/oXqA0fwH https://careers.mozilla.org/en-US/position/oXqA0fwH I am extremely curious to find out what exactly do they have in mind here?
- azakai 12y ago
  Perhaps relates to sponsored tiles, https://www.mozilla.org/en-US/firefox/tiles/ https://www.mozilla.org/en-US/firefox/tiles/ I believe those allow advertising without tracking of users.
pkrumins 12y ago
I just added Firefox 37 to Browserling. If you don't want to install it, you can try it live in your browser at this address: https://www.browserling.com/browse/firefox/37/news.ycombinator.com We've 3 servers handling demo sessions so you may have to wait in the queue to try it.
TazeTSchnitzel 12y ago
Opportunistic encryption's really the big news. Will make the NSA's job harder. Edit: Unfortunately, you must be using SPDY or HTTP/2 to use it. That's a real shame. I already had self-signed TLS and added the header, but then discovered it doesn't work with HTTP/1.1 (and with no good reason, either).
- shawabawa3 12y ago
  >(and with no good reason, either). From their site: OE is not available with HTTP/1 servers because that protocol does not carry the scheme as part of each transaction which is a necessary ingredient for the Alt-Svc approach.
  - TazeTSchnitzel 12y ago
    Ah, alright. That's a shame. I hope they can come up with some way to do it.
yuhong 12y ago
They disabled insecure TLS version fallback. Older versions of the Certicom TLS stack used in older versions of WebLogic are affected for example (change to JSSE).
- Tobu 12y ago
  The next release (in six weeks) will also disable RC4 fallback, except for a few sites which are on a whitelist for one release after that.
droope 12y ago
It's frankly ridiculous how you guys criticize Mozilla for all these things, when they are practically the only organization in the whole internet which continues to value privacy.
- lomnakkus 12y ago
  Who is "you guys"? I personally applaud Mozilla for their stance on many things. Especially for allowing/enabling things like NoScript. However, I must admit that this has a practical limit, at least for me. Without per-process tabs (or similar) Firefox will start to lag more and more behind modern browsers and at some point the deficit will become insurmountable. (I realize the difficulty of achvieving this, but as a practical matter, it must happen, otherwise...) EDIT: I should say that I usually keep Firefox open for days (with only ~30-40 tabs) and at some point it starts consuming unreasonable amounts of CPU just... idling (apparently).
  - theandrewbailey 12y ago
    Mozilla's per process project is called 'Electrolysis'. It's been in the works for years, but Mozilla is saying that it's going to be released (in not beta form) later this year. https://wiki.mozilla.org/Electrolysis https://wiki.mozilla.org/Electrolysis
    - lomnakkus 12y ago
      Yes, I'm familiar with it. (Should probably have mentioned it explicitly, sorry about that.)
  - Amezarak 12y ago
    > Without per-process tabs (or similar) Firefox will start to lag more and more behind modern browsers and at some point the deficit will become insurmountable. (I realize the difficulty of achvieving this, but as a practical matter, it must happen, otherwise...) Why? Setting aside that, as the sibling comment points out, Electrolysis is on the roadmap, why? I use Firefox every day with dozens to hundreds of tabs in 1-2 windows and the fact it's not process-per-tab has never bothered me or even been something I noticed. Sure, it's nice to have theoretically; if the browser crashed all the time then sure, I'd like to have just one tab go away instead of session-restoring the whole thing, but that's a minor convenience, and according to about:crashes, it's only happen about two dozen times in two years anyway. On the other hand, it's nice that, despite having 32 tabs open right now, Firefox is only using 210MB of memory. There are advantages (stability, sandboxing) and disadvantages (memory usage) to the process-per-tab model. I think there's a fair argument that Mozilla should implement it in Firefox, but I don't understand in what sense Firefox would be lagging behind other browsers if they didn't implement it. The Ideal Browser does not necessarily require process-per-tab nor is there some Ideal Browser all the browsers are converging to that Firefox is further behind on.

159 points by footpath 12y ago

I understand that the Heartbeat user rating system can be disabled, but I'm still very much against it and think it will drive a lot of less technically-savvy users mad. I honestly thought it was an April Fools joke at first through reading it.

itsthatguyagain 12y ago
And sigh, yet something else I'll have to disable (or remember to disable) on new installs and upgrades. I wonder if non-savvy people will be able to figure out how to disable it so it doesn't interrupt their time on the internet.
- walterbell 12y ago
  Yikes. At what point will people start backporting security fixes to an older version of Firefox, to avoid the forced bundling of unwanted browser "features"?
  - mccr8 12y ago
    I realize that you are just making a snarky dig, but probably never. It would be a huge amount of work just to backport basic security fixes, and almost impossible to backport large architectural changes that are made in the service of security. Are you going to backport multiprocess Firefox once that is working? It is much easier to flip a preference. If you wanted to get sophisticated, you could create an addon that disables all of the preferences you dislike.
    - jamespo 12y ago
      Will setting the about:config option to disable be preserved across browsers with firefox sync?
      - reubenmorais 12y ago
        It will if there's a corresponding services.sync.prefs.sync.the.pref.you.want.synced.here pref set.
    - walterbell 12y ago
      > you could create an addon that disables all of the preferences you dislike. That's a good idea. Another option is to patch the code to remove the new features, unless Mozilla has taken steps to deter unbundling.
      - sp332 12y ago
        Mozilla is very protective of the Firefox trademark. They don't even use it for their own nightly builds, because they want people to associate "Firefox" with stability. So they make it very easy to unbundle.
  - melling 12y ago
    There's an opportunity cost to supporting older versions. Sure, there's always going to be a small group of people who are happy with what they currently have but most people are happy moving forward. If there's a big enough market, perhaps some company will backport the security fixes. How much are you willing to pay? Another option is that you could volunteer and start the fork. Of course, there's that other problem where developers are only going to support the latest browser.
    - walterbell 12y ago
      A functional subset would not be a fork. If users were given a choice, we would find out which version they considered best aligned with the brand.
      - melling 12y ago
        You aren't being clear. Do you think that older code that gives older functionality doesn't ever get changed? Patches will have to be created, etc. It's not trivial work. And as I mentioned, web developers aren't going to support the older CSS/HTML/JavaScript in your older browser.
        walterbell 12y ago
        Lack of clarity was due to sibling comment. Repeating here: an option is to patch the current code to remove unwanted new features. This provides users with current features, e.g. CSS/HTML/JS and security fixes, a "minimal build" of the browser.
johnchristopher 12y ago
I wondered what that `Hearbeat` thing was so for once I checked the release notes and https://wiki.mozilla.org/Advocacy/heartbeat#Experience_Flow https://wiki.mozilla.org/Advocacy/heartbeat#Experience_Flow > Every day a random subset of users are offered a rating widget > After rating Firefox, an ENGAGEMENT page may open in a background tab. That's... not the phoenix I signed up for.
- maxerickson 12y ago
  Even when it was Phoenix, the branding or whatever you want to call it was to focus on users. Compared to Mozilla/Navigator that meant stripping out a whole lot of stuff, but an effort to find out what their broader set of users want is not incompatible with the original mission. (I'm sure I'll toggle this off)
- danpat 12y ago
  Related: https://careers.mozilla.org/en-US/position/oXqA0fwH https://careers.mozilla.org/en-US/position/oXqA0fwH
ehPReth 12y ago
The check-in URL for heartbeat seems to be HTTP ("http://self-repair.mozilla.org/%LOCALE%/repair" http://self-repair.mozilla.org/%LOCALE%/repair"). Will Firefox 37.0 automatically convert that to HTTPS (HSTS preload, etc) or is there an insecure redirect lurking?
- fabrice_d 12y ago
  It's a https url. Check the source: http://mxr.mozilla.org/mozilla-central/source/browser/app/profile/firefox.js?rev=77a2c0f13869#1029 http://mxr.mozilla.org/mozilla-central/source/browser/app/pr...
  - ehPReth 12y ago
    Is the 'mozilla-release' branch for the current 37.0 release? It shows 'http' instead of 'https': https://mxr.mozilla.org/mozilla-release/source/browser/app/profile/firefox.js#1036 https://mxr.mozilla.org/mozilla-release/source/browser/app/p...
    - fabrice_d 12y ago
      You're right. It was changed to https in https://bugzilla.mozilla.org/show_bug.cgi?id=1138323 https://bugzilla.mozilla.org/show_bug.cgi?id=1138323 and will only end up in Firefox 39
      - ehPReth 12y ago
        Ah, I see. Thanks! Too bad it didn't land for 37.0 but glad to see it fixed for the future
coldpie 12y ago
Just wondering, what do you find so problematic about it? These kinds of rating prompts are extremely common in the mobile app space. They work there, presumably, or they wouldn't be so common. Why don't you think the idea will work here? I'm a big fan of Firefox, and I would find being prompted to provide them with useful feedback a positive experience.
- freehunter 12y ago
  There are a lot of things that work in the mobile space that are use-hostile. The only reason they work is due to limited choice (or at least the perception of limited choice). Ads popping up in between games is common, let's support Firefox by randomly disabling the pop-up blocker. IAP is common, let's give users the ability to view static sites, but CSS is ten sites for 99c, Javascript is five sites for $1.99, or you can get it all for $99! Subscribers get SSL added on for only $15/mo.

drzaiusapelord 12y ago

>Yandex set as default search provider for the Turkish locale Interesting. Looks like Putin's relationship with Erdogan gets cozier all the time. Yandex has a very strong connection to Russian intelligence services: http://www.bbc.com/news/business-13274443 http://www.bbc.com/news/business-13274443

k__ 12y ago
This may be, but what has it to do with Firefox? Doesn't Mozilla decides for itself, which default it sets?
- walterbell 12y ago
  Is Yandex paying Mozilla to be the default for Turkey?
  - dublinben 12y ago
    That's usually how these deals come about. No figures were revealed in the press release, but it should eventually become public in their yearly IRS filing.
  - gkya 12y ago
    Well, probably. Yandex has been active in the market here in Turkey, offering its services including a map with street views. They also put up ads on TV and billboards.
ldng 12y ago
Hum, never though of it this way. It also make business sence since Yandex strength is probably the handling of complex language in information retrieval. I always though the angle was to then address middle-east market with better indexing/search of Arabic content. Now, it's not impossible there is a political angle to it.
isxek 12y ago
Doesn't DuckDuckGo use Yandex's search results?

DangerousPie 12y ago

> Implemented a subset of the Media Source Extensions (MSE) API to allow native HTML5 playback on YouTube This is great! Actually just today I was wondering why Firefox was still using the Flash player for Youtube. Now it isn't anymore :)

kzrdude 12y ago
Firefox was stuck on 360p html5 video before, I'm going to try this asap
JoshTriplett 12y ago
As far as I can tell, HTML5 playback has worked just fine in Firefox for a while (including HD), for any video that doesn't have ads. MSE just allows additional features in HTML5 playback, such as DASH (which dynamically adjusts bitrate to match available connection bandwidth/quality). (Personally, whenever it fails, or sometimes even when it doesn't, I use youtube-dl.)
- elektronjunge 12y ago
  This is correct. I haven't had flash on my computer for nearly a year and I've been able to watch hd youtube videos in firefox.
- shmerl 12y ago
  No, it didn't work for anything higher than 720p. For those Youtube requires using DASH + MSE.
  - jfreax 12y ago
    I read this everywhere, but I am able to watch 1080p Youtube videos with html5 just fine since, yeahh... always, at least it feels like that. I tried it just a second ago. So it works definitively with Firefox 36 on Gentoo Linux. What am I doing "wrong"? What am I missing here?
    - 12y ago

blinkingled 12y ago

Working great on Lollipop here. Prior version was crashing quite a bit.

darklajid 12y ago
I'm about to give it up on Android again. Nice browser. Better than Chrome. But the UI sucks. First they managed to have a different UI on tablets (phone: Tab button in the upper right corner, upper left on the tablet). Then they iterated and came out with a new (and soon to be if not already) mandatory tablet UI that just .. well .. it's bad. I still regularly try to open a link in a tab and hit 'share', because at some point in the past they decided that the menu on a link should be - share - open in tab - open in private tab etc. I'm a fan, use it on the desktop, wish that FxOS succeeds - but Fennec is a constant nuisance and complete UX failure for me.
- blinkingled 12y ago
  Yeah the ui is kind of hit and miss and performance not quite as good but it's getting there and we can have add ons! Wish I had the time and drive to contribute to the ux - truly appreciate having the option of independent browser on mobile device.
- babuskov 12y ago
  The main problem on Android for me is that there's absolutely no way to download a file. Chrome has Save Link As option for links, but Firefox does not. It's interesting that you can still download videos if you let them play and then hold the finger in the middle of the video until a menu pops up and you can Save it from there. So the download functionality is there, it just isn't exposed. This is a shame, because that download function works much better than the one in Chrome (with Firefox, you can pause/continue).
  - TazeTSchnitzel 12y ago
    > The main problem on Android for me is that there's absolutely no way to download a file. That's really odd given that Android has a proper filesystem that applications can (and do!) access.

Silhouette 12y ago

The new Security Panel on the Network Monitor display seems helpful. Even better, it seems that Firefox has finally stopped erroneously reporting that some pages with multimedia content served properly over HTTPS were only partially encrypted. This had been a long-standing issue and the early comments from developers were not promising, so kudos and my personal thanks to whoever has fixed this one.

mmastrac 12y ago

"display: contents" is an interesting addition. It appears to take an element out of the tree, replacing it entirely with its children. Anyone have any thoughts on what that could be used for?

dguaraglia 12y ago
I imagine you can use it to ensure that elements that are added simply for semantic purposes (like, say, containers for other elements that are there just to group them logically) do not create any boxing side effects, like default padding and similar non-obvious CSS buggery.
- taeric 12y ago
  I fear that now we will just replace it with another set of non-obvious CSS behavior. Consider, does this property nest well? How does absolute positioning work against something like this? Do they just ignore the parent box, since they are replacing it? Undefined or Browser specific. Or just a further explosion of the spec?
  - bzbarsky 12y ago
    All of this is defined in the spec. display:contents just means that in the box tree the box is elided and its child boxes are placed where it used to be, and then things proceed as normal. If you have nested display:contents things, it just works: you end up with a box and what used to be its great-nephews/nieces in the same flat list is all.
    - taeric 12y ago
      My point is really that I am not even sure what I would expect to happen in such cases. To the point that I will find it hardly surprising when developers on a browser inevitably makes a mistake in implementation. So, yes, this may all be there in the spec. But this is really just making the spec larger and larger with what seems to be nominal, if not decreasing, gains.

erichurkman 12y ago

Don't forget to check the Firefox 37 for developers [0] page which has more detailed info (it's linked from the sidebar of the public release notes). [0] https://developer.mozilla.org/en-US/Firefox/Releases/37 https://developer.mozilla.org/en-US/Firefox/Releases/37

shmerl 12y ago

MSE on Youtube at last. UPDATE: Strangely, media.mediasource.enabled still remained false for me in Firefox 37 (Linux). I had to manually set it to true, and it's highlighted, meaning that default is still false... Not sure how it fits with release notes then.

doublec 12y ago
MSE is only enabled by default on Windows for this release. You can enable it manually for other platforms via the about:config setting.
- shmerl 12y ago
  Was it still buggy on Linux? Release notes mention some other points as relevant to the Windows version only, so it probably made sense to mention it for MSE too to avoid confusion.
  - doublec 12y ago
    Not so much buggy as less tested. I use it on my linux laptop and have relatively few issues.
  - doublec 12y ago
    Release notes have been updated to say Windows only now.
    - shmerl 12y ago
      Thanks!
- sagischwarz 12y ago
  On a Windows 8.1 machine with FF37, I get "An error occured, please try again later." for all videos on YouTube. Disabling media.mediasource.enabled in about:config fixes the problem. Anyone else?

super_mario 12y ago

So, Mozilla wants to change the ad industry, while preserving user privacy? https://careers.mozilla.org/en-US/position/oXqA0fwH https://careers.mozilla.org/en-US/position/oXqA0fwH I am extremely curious to find out what exactly do they have in mind here?

azakai 12y ago
Perhaps relates to sponsored tiles, https://www.mozilla.org/en-US/firefox/tiles/ https://www.mozilla.org/en-US/firefox/tiles/ I believe those allow advertising without tracking of users.

pkrumins 12y ago

I just added Firefox 37 to Browserling. If you don't want to install it, you can try it live in your browser at this address: https://www.browserling.com/browse/firefox/37/news.ycombinator.com We've 3 servers handling demo sessions so you may have to wait in the queue to try it.

TazeTSchnitzel 12y ago

Opportunistic encryption's really the big news. Will make the NSA's job harder. Edit: Unfortunately, you must be using SPDY or HTTP/2 to use it. That's a real shame. I already had self-signed TLS and added the header, but then discovered it doesn't work with HTTP/1.1 (and with no good reason, either).

shawabawa3 12y ago
>(and with no good reason, either). From their site: OE is not available with HTTP/1 servers because that protocol does not carry the scheme as part of each transaction which is a necessary ingredient for the Alt-Svc approach.
- TazeTSchnitzel 12y ago
  Ah, alright. That's a shame. I hope they can come up with some way to do it.

yuhong 12y ago

They disabled insecure TLS version fallback. Older versions of the Certicom TLS stack used in older versions of WebLogic are affected for example (change to JSSE).

Tobu 12y ago
The next release (in six weeks) will also disable RC4 fallback, except for a few sites which are on a whitelist for one release after that.

droope 12y ago

It's frankly ridiculous how you guys criticize Mozilla for all these things, when they are practically the only organization in the whole internet which continues to value privacy.

lomnakkus 12y ago
Who is "you guys"? I personally applaud Mozilla for their stance on many things. Especially for allowing/enabling things like NoScript. However, I must admit that this has a practical limit, at least for me. Without per-process tabs (or similar) Firefox will start to lag more and more behind modern browsers and at some point the deficit will become insurmountable. (I realize the difficulty of achvieving this, but as a practical matter, it must happen, otherwise...) EDIT: I should say that I usually keep Firefox open for days (with only ~30-40 tabs) and at some point it starts consuming unreasonable amounts of CPU just... idling (apparently).
- theandrewbailey 12y ago
  Mozilla's per process project is called 'Electrolysis'. It's been in the works for years, but Mozilla is saying that it's going to be released (in not beta form) later this year. https://wiki.mozilla.org/Electrolysis https://wiki.mozilla.org/Electrolysis
  - lomnakkus 12y ago
    Yes, I'm familiar with it. (Should probably have mentioned it explicitly, sorry about that.)
- Amezarak 12y ago
  > Without per-process tabs (or similar) Firefox will start to lag more and more behind modern browsers and at some point the deficit will become insurmountable. (I realize the difficulty of achvieving this, but as a practical matter, it must happen, otherwise...) Why? Setting aside that, as the sibling comment points out, Electrolysis is on the roadmap, why? I use Firefox every day with dozens to hundreds of tabs in 1-2 windows and the fact it's not process-per-tab has never bothered me or even been something I noticed. Sure, it's nice to have theoretically; if the browser crashed all the time then sure, I'd like to have just one tab go away instead of session-restoring the whole thing, but that's a minor convenience, and according to about:crashes, it's only happen about two dozen times in two years anyway. On the other hand, it's nice that, despite having 32 tabs open right now, Firefox is only using 210MB of memory. There are advantages (stability, sandboxing) and disadvantages (memory usage) to the process-per-tab model. I think there's a fair argument that Mozilla should implement it in Firefox, but I don't understand in what sense Firefox would be lagging behind other browsers if they didn't implement it. The Ideal Browser does not necessarily require process-per-tab nor is there some Ideal Browser all the browsers are converging to that Firefox is further behind on.