Firefox 74 | Hacker News Reader

Firefox 74

mozilla.org

540 pointsreplax260 comments

The Facebook container is great, but I wish there was an option for the built-in Multi-Account containers to work this way. I've been doing what the Facebook Container extension does, but with built-in containers, and the experience is very clunky.

The two biggest issues are that I can't give the container a list of domains beforehand and say "everything under google.com should open here". I have to go to each Google subdomain and set it to "always open in this container" with three or four clicks. The other major issue is that there's no way to have links outside those domains open outside the container, so whenever I click a link on Gmail that goes to Github, Github opens in the Google container and I always have to copy/paste the address to a new tab.

Fixing those two annoyances would make the built-in containers feature amazing. Maybe I should file a feature request.

EDIT: I have filed a feature request: https://bugzilla.mozilla.org/show_bug.cgi?id=1621276

Do you know of Firefox Multi-Account Containers?

Yes, those are the ones I'm talking about.

You are right the user experience is chunky and not self explanatory. But what you are trying to achieve is possible. Play with the settings a bit. I have it in a way that if I type a domain that is assigned to a container, it will ask me first if I want to open it in its default container or a different one.

That's not what he (and I and many others) are asking for.

The site linked to is not assigned to any container. It opens in the old container, while it should open in the default container.

I'm just trying to help.

The idea of having a link clicked inside a container and expect it to go to a different container as a default setting, seems to contradict web standars. Now, if you've explicitly assigned the clicked domain to a different container, then yes, it should go to its container (which is how it works, to me at least).

> seems to contradict web standars

But if I click a Google link, it already goes to a different container (the Google one), because I've told it to.

> Now, if you've explicitly assigned the clicked domain to a different container, then yes, it should go to its container

I am trying to assign "all non-google.com links" to open in the default container.

I'm simply explaining something you hadn't understood.

But I'm not aware of any "web standard" codifying container behaviour.

There are (standarized) things that get sent to x.com when you click on a link to it on m.com. Stuff that wouldn't be there if you actually copy pasted the link.

Referer? Great.

What does that have to do with containers, or better, why do you believe what many users want is forbidden by "web standards"?

> whenever I click a link on Gmail that goes to Github, Github opens in the Google container and I always have to copy/paste the address to a new tab.

You can right-click links and open them in a "New Container Tab" (including "No Container").

Edit: You can also right-click on the tabs and select "Reopen in Container"

Sure, but it's not as convenient as doing it automatically.

I feel like that's probably by design. If you were in a session and clicking links, the assumption is if you're in the container already, you'd want to remain in the container. I don't disagree it would be nice for you to be able to specify domains per containers, but yeah, maybe that'll come in the future..

It's definitely by design, since the containers are meant to segregate accounts (e.g. a company container and a personal container), but a second mode would be useful since many people are using them for per-site isolation.

If you specify a catch-all url to open in No Container, would that work?

  !*.google.com , Google
  !* , No Container

Oh wow, that did work, thanks! It's odd, because the extension reordered the catch-all URL to the top, so I'm not sure how the specificity goes.

With the base multi account container extension https://addons.mozilla.org/en-US/firefox/addon/multi-account... you can right click in any page and have it remember the container for that domain. For example you open abc.com in container "Personal" once, then you can tell it do remember to use that container whenever you go to abc.com.

The Conex extension https://github.com/kesselborn/conex goes beyond by (optionally) prompting you for which container you want. The best part of this extension is that it lets you hide tabs that aren't in the same container, effectively giving you tab groups based on container. Once you get used to it, you won't want to go back to having 80 tabs displayed at once.

In addition

> you can tell it do remember to use that container whenever you go to abc.com

My problem with that is that, even if I do this, it doesn't remember it for foo.abc.com, and when I'm in the container, links to def.com won't open outside the container.

I use Containise for that, it lets you set wildcards: https://addons.mozilla.org/en-US/firefox/addon/containerise/

Unfortunately that doesn't open other links outside the container :/

Temporary containers will do that https://addons.mozilla.org/en-US/firefox/addon/temporary-con...

All urls that are not "pinned" to a container open in a temporary container.

I use FF, I don't use FB, but I still think this is wrong. Browser is not a place to decide which companies are good and which are bad. As much as I despise Facebook I still don't think it's fair.

"I disapprove of what you say, but I will defend to the death your right to say it". All companies should have the same access to the technology in user's browser. Favoring Google by Chrome seems no different than blocking Facebook by Firefox. It's the same behavior, just a difference in opinions.

edit: to clarify, I am in agreement with the parent comment, the above is just about Facebook container being a feature

How is this tantamount to deciding which companies are good and bad? Mozilla have simply identified an extremely common way people are tracked online and are doing their best to contain it.

Same rules should apply to everybody. You should be able to decide some rules, even heuristics that can catch tracking across multiple sites and suggest user to disable it rather than pointing to entity and applying different rules to it than to everybody else.

You can set up containers for every domain you like. Facebook just comes as a predefined option because 90% of users are going to choose that domain anyway.

FYI the facebook container is an addon one has to download and enable, it's not built-in.

That makes perfect sense then.

No, they shouldnt. Everybody isnt the problem, its large scale privacy destroying services that are the problem.

Singling out facebook and google would absolutely be correct actions, and making it more obvious to users how to do that is a net good.

It's wrong for the browser to give me a way to containerize whatever domain I want?

Absolutely not, but you should be the one choosing the domain.

I am, Firefox doesn't do this by default.

Facebook Container is an optional extension, not installed by default. And you can write your own extension for different domains. In fact, people have created several such extensions, such as Google Container, Temporary Containers, and others. It's true though that the Facebook Container extension is actively marketed by Mozilla.

At first glance, this seems to be pretty opinionated, with a hip 30 second commercial

https://www.mozilla.org/en-US/firefox/facebookcontainer/

He is not saying for the browser to do it automatically out of the box. He wants to be able to configure the browser with a list of domains. That is perfectly reasonable.

Define what you mean by "fair". It is Mozilla's (right) opinion that Facebook is a hugely corrupt corporation and entity, the technology itself doesn't just work on Fedbook, they just use Fedbook as their prime example.

Even it were true, which is not, Facebook had been anything but fair to its users (and non users) in case you didn’t get a chance to follow the news. Since Mozilla is all about user’s privacy and safety online and Facebook is such a huge menace than it actually makes sense to offer a targeted solution. But again, it’s just an implementation of a container, nothing specific to Facebook.

You realize Facebook Container is not part of Firefox, it's an extension you have to install yourself.

> whenever I click a link on Gmail that goes to Github, Github opens in the Google container

Google intercepts clicks and redirects them through a Google Domain to track clickthru. If you're in Gmail and hover over a link it will show the actual destination but onclick your browser opens a mail.google.com URL that redirects to the destination URL.

It doesn't matter though, the tracking domain would run in the container and github outside it.

I don't want google to know that I clicked on the link. That is sensitive.

Switch to an email provider that doesn't want to track you. You can be on Fastmail in an hour if you have your own domain.

I have used fastmail for ~10 years. However google still has far too many ways to track me.

Why are you worried about GMail's outgoing links if you're using Fastmail?

Gmail is not the only place where outgoing links get this treatment. Random websites do it too once in a while.

protonmail did the oddest thing to me the other day. It sent an email to my gmail account to inform me that I had received an email at my protonmail address. I was stunned. The main point of having the protonmail account was to keep google out of my business.

Now I have to find a provider that doesn't leak in the dumbest of ways.

In protonmail, Settings → Daily email notifications → Disabled. No, I don't understand why that isn't the default setting either.

Yes. The email protonmail sent to my gmail account informed me of this lovely default. One email too late.

Use a mail client like Thunderbird.

The browser have to intercept 302 redirects and javascript .location assignments, open safe locations in a different container. Would that be a new window or the same window but with container change?

In the former scenario you'd basically get 2 new tabs, in the later you'd have a tab represent two different containers based on where you navigate in history.

Either way it sounds unsavory.

Firefox already does what you describe. It's a new tab.

This extension removes the URL intercept/redirect on Gmail and many other sites:

https://addons.mozilla.org/en-US/firefox/addon/skip-redirect...

This one handles the other situation, tracking parameters added to the URL that are intentionally passed to the target site:

https://addons.mozilla.org/en-US/firefox/addon/neat-url/

Thanks for the link. I just spent a few minutes looking at this extention’s creator’s github activity. Installing this will be my first todo list activity whenever I first use my laptop today.

That redirect always bugged me.

EDIT: I just noticed on the install page "This is not a Recommended Extension. Make sure you trust it before installing.Learn more" which is annoying.

ClearURLs by Kevin R. is recommended by Mozilla, so maybe that's a better option:

https://addons.mozilla.org/en-US/firefox/addon/clearurls/

This is the real problem in my opinion. The URL shown in the status bar should always match the URL which is opened after clicking on the link. Anything else is deception.

I don't know how you'd enforce it at the browser level because obviously there are tons of legit uses for modifying a link on click... but it should be enforced somehow.

What are legit uses for modifying a link on click? I've only seen that used for tracking.

The classic use is after a site redesign or migration to a new domain, due to organizational name change, or whatever. You don't want to break all of the incoming links that are out there, but you want people to get to the page they were trying to reach.

That's handled by redirects with HTTP 301 messages, not JavaScript hijacking links on the referrer page, which is what Google search pages do.

I might have badly expressed myself - I'm specifically talking about changing the link target in the link's onclick handler like Google does, such that the link target shown in the browser is different from the actual target.

> The other major issue is that there's no way to have links outside those domains open outside the container, so whenever I click a link on Gmail that goes to Github, Github opens in the Google container and I always have to copy/paste the address to a new tab.

I had the same problem so I made a small extension that does that:

https://addons.mozilla.org/de/firefox/addon/container-outgoi...

I also wish that the basic container feature worked like this.

In the meantime, I am very happy with the unofficial "Google Container" addon [1], which is just a copy of the Facebook container that works its magic on Google domains instead.

Give it a try. It doesn't interfere with the official Facebook container addon.

[1] https://github.com/containers-everywhere/contain-google

That's great, thank you!

To complete GAFAN/GAFAM or whatever it is called there's also one for Amazon [1] and Microsoft [2] (I wouldn't care to avoid tracking by Apple or Netflix).

[1] https://addons.mozilla.org/en-US/firefox/addon/contain-amazo...

[2] https://addons.mozilla.org/en-US/firefox/addon/microsoft-con...

Why is it OK to be track by Apple or Netflix?

> Why is it OK to be track by Apple or Netflix?

That is not what I asserted.

I asserted I don't care about it. I don't believe Netflix tracks me outside of .netflix.com and I don't believe Apple tracks me outside of .apple.com (and the other domains ofc). If they do, you have to convince me it is harming my interests (ie. my privacy or freedom of choice).

I know Google tracks me, I know Facebook tracks me. Their profit model is surrounded by this tracking. I know Amazon and Microsoft track me. Their profit model partly relies on tracking.

But there are thousands big ones out there. Cloudflare, Cloudfront, Baidu, Yandex, Akamai, Tencent, Twitter, Yahoo, Disqus, Uber, Airbnb, Pinterest etc. Why bring up Apple and Netflix specifically?

netflix is the N and apple is an A in GAFAN

Going for the high trees instead of low hanging fruit. Why? On average, larger impact.

There's Invidation addon to avoid Twitter/YouTube and redirect to Nitter/Invidious, and there's some addons to avoid CDNs such as Cloudflare / Amazon/ Akamai. There's also an addon to remove garbage in URLs such as AMP (I mean, wtf?).

If you want to avoid these completely, plus GAFAM, your internet (browsing) experience isn't annoying; it is broken.

I avoid Uber/Airbnb/Pinterest already (niches I don't care about) and Yandex/Baidu is not meant for my demographics.

If Baidu, Tencent, Cloudflare etc are "low hanging fruit" then Netflix is an even lower hanging fruit. It's just a streaming service. Even Twitch has a wider audience than them. Which is the reason I was confused why you brought those two up specifically, instead of the bigger players who are way more ubiquitous.

Invidition is just a wrapper. Doesn't solve the larger problem which is what's happening on the server. Last time I tried it YouTube was completely broken because Google changed a tiny little thing.

Obviously Netflix is low hanging fruit. Its just that people use the term GAFAN sometimes, and sometimes GAFAM. I don't know the exact logic of why using one or the other, so I did mention Netflix and Microsoft.

Twitch is Amazon.

I'm aware of wrapper usage. I just use youtube-dl from CLI whenever I see a YouTube linked referenced which should interest me.

Probably because there are containerizer addons for Apple and Netflix, specifically, and not for the other sites you mention.

Now that Apple is forcing app developers to use Sign in with Apple -- and developers will have to also allow it on their websites so you can access your account there -- Apple will be able to use the Sign in with Apple javascript they serve to track you around the web just like Facebook and Google do, even if you don't use any Apple products.

While this is true, it is obvious how the other names he listed would benefit from such tracking. It is not clear to me why Apple would do this, as it runs opposite of their product marketing, and their business model does not obviously benefit from tracking the way the others do.

I didn't say they would or should. Just that they will be able to.

I wish every domain could automatically be opened in an individual container. I don't even need to know about them.

That would break a lot of stuff, though. And then I don't just mean "bad" tracking, but normal auth flows etc

You're quite right - I have some trouble with "modal" popup windows and the Atlassian Single Sign On in particular with the temporary extensions tab. But I eventually figured out to copy and paste those URLs and manually whitelist them to a specific container tab

I wouldn't recommend it for family or friends, but I'm happy with the trade off

There is a temp container extension that does exactly this.

Ask and ye shall receive: https://addons.mozilla.org/en-US/firefox/addon/temporary-con...

I use this in combination with "normal" containers and it works a treat

Same. The mix is IMO the best way to get privacy while keeping usability. It obsoletes things like cookie auto-delete.

There is some annoying UI lag when opening a new tab though, as it takes a fraction of a second to swap from default to a new temporary container.

I use this plus Containerise, but with recent updates to Temporary Containers, I don't think I need Containerise any more.

Just curious: is there significant overhead to running each domain in it's own container?

There's also the privacy.firstparty.isolate in about:config which isolates each site.

That's an existing Firefox feature called First Party Isolation. Here's a plugin that toggles it:

https://github.com/mozfreddyb/webext-firstpartyisolation

It sometimes (rarely) breaks payment processors but otherwise works fine

Apart from those 2 issues, a smaller annoyance but I really wish 'Reopen in Container' would just reuse the tab. At least I've personally not once felt the need to keep the original tab open.

Do containers sync across devices yet? Having to re-establish all of my container rules on my work and personal computers is tedious

I just opened mine and got a notification that they can now sync, so it appears that they added it recently.

Yes — We added it last month! (Mozilla Containers dev here.) See this blog post for more info: https://blog.mozilla.org/security/2020/02/06/multi-account-c...

Sorry to bomb you like this, but I don't have the time/energy to find where to file a ff container bug: twitter.com never opens in it's designated container for me. That is the only site I always have to "Reopen in container".

Works for me, maybe the issue is specific to the site linking to Twitter.

Same here: that's the only site that doesn't work. I wonder if it has something to do with the post-login redirects: it's impossible to say "always open this site in this container", because you've already been redirected to a different url.

Note: we have an update coming that includes a "Limit to Designated Sites" feature in the base Multi-Account Containers extension: https://github.com/mozilla/multi-account-containers/pull/165...

I also miss the option to choose in which container open a new tab by default. I try to not use at all "container-less tabs" and it breaks keyboard-only usage.

Couldn't agree more. Open default links in separate container + delete all data from this container would make the desktop experience like Focus on mobile.

I guess following a link that goes to a different container will break session cookies, and such, which for some/most is going to be annoying.

Why you keep saying "built-in containers", it's not built-in, it's an add-on.

The core functionality is and must be built in. You can't do very much with it in that state, so Multi-Account Containers is an user interface to configure and access most of the user-facing functionality. Some of that can be enabled just by toggling a couple of about:config settings, though. And as far as I know, though, it doesn't have privileged access to container APIs, so you could replace it with other addons.

So whether it's more correct to be referring to the built-in functionality (including some of the UI elements), or the add-on, depends on exactly what you're talking about. And it's hard to distinguish.

I see, thanks for the clarification. I wonder why Mozilla didn't just ship the add-on. It seems far-fetched to think it was to make the add-on replaceable by another.

Do you know if there is any way one can configure a container to disable specific extensions?

Personally, I don't want to micromanage "containers" as a user. I truly don't understand why this is considered a nice feature. Who wants to micromanage anything?

What I want is for every web page to run in its own container by default. Zero configuration.

If it wants to access anything outside of its allowed domain hiearchy (like call an external API), I'd like the browser to ask for permission on its behalf. "Github.com would like to share data with Microsoft.com. Allow/Deny?"

There could be some kind of trust standard so that Github.com can prove that they are the same legal entity as Microsoft.com and is therefore authorized to share information without asking. Or perhaps something simpler that is DNS-based, like with email.

Try umatrix you could use it a little like this.

Sadly most sites use a lot of third party javascript, css etc so it will be a clunkier experience than you are hoping for.

That just sounds like more micromanagement to me?

What is the difference to answering 10 to 20 "Allow/Deny?" question on each website? The website just won't work until you figure out which 3 of the 15 requests are needed to render the website properly. Most of these domains aren't "microsoft.com" but something like "gibberish123.net". Good luck guessing whether the request is legitime/usefull.

edit: sounds like another addon idea: find the minimal set of 3rd parties needed to render a website.

You can eliminate most of those things based on general blacklisting rules for ads and beacons of the kind that adblockers currently rely on.

> find the minimal set of 3rd parties needed to render a website.

uMatrix tries to do this already with some third party scripts, but it’s a moving target.

I don't want to sound dismissive of your proposal, it'd be great to have a more restrictive set of defaults to prevent tracking...

But just consider the automatic way a regular user clicks at any prompt that gets in their way out of habit...

I am guilty of this sometimes, even though I try to be mindful and always try to opt-out of tracking cookies, etc.

I think the system you're proposing has to have some sort of smart way to whitelist, either by granting temporary whitelisting with varying granularity (e.g. for this session, for 1 hour, forever ... Etc).

I think Privacy Badger (the add-on) has partially solved this (learning through counting how many times a tracker's domain appears on other sites), maybe this could applied in reverse: automatically whitelist after N approvals.

What do you think?

Whatever system is used, it would have to be low-noise, yes.

I use Temporary Containers for getting each web page to run in its own container: https://addons.mozilla.org/en-US/firefox/addon/temporary-con...

When I want to stay logged into anything I self-manage and create a named container. (This requires micromanaging but is at least opt-in.)

But the default of separate temp containers is great.

Is there a similar extension for Chrome/Chromium?

I don't think so.

I do the same. Have been doing it for a while now, and the internet still works but I get less creepy ads (when I do since I also block those as much as possible).

So Firefox sent me an email with a title "Get Facebook Out". I tried to unsubscribe, but that forces me to login first, for which I don't remember the password. So I had to reset the password, and then unsubscribe from their "tips" emails.

Shouldn't Firefox offer a one click unsubscribe botton?

you are supposed to use facebook login for that :D

I don't know what is up with mozilla/firefox. I'm still using firefox but not because I like it, only because the alternatives are worse. I signed up for a firefox account almost right after they were announced. At the time and multiple times since I've unsubscribed from "all" their emails because I'm not interested in them. They just either invent a new list and auto-subscribe me to it or they just ignore my preferences and spam me anyway. Today I got an email from mozilla telling me to "Get the 'F' out." So I did, I reset my password, logged into their service, unsubscribed (again!!) from all their lists, and then deleted my account. Yes, I was forced to reset my password and log in just to unsubscribe.

Not mentioned in the changelog for this release is that in the URL bar, when I start typing and the suggestion list drops down, the first result is now highlighted in an eye-destroying bright green (even in dark mode, which I'm using).

I used to be a fan of FF until chrome. I understand it's bad - but how about chromium?

Btw, I'm not against looking at FF again, but looking at this changelog and recent product direction, they honestly feel lost.

How is chromium better than chrome? It's the same program, minus some blobs.

Some users may not like the blobs.

I mean, sure, but chromium is still happy to spy on you, integrate with Google services, and contributes to the Blink monoculture. I'm just surprised that there are people who would object to Chrome on principle and not to chromium.

Mozilla is currently in a state of disarray. Diving revenues, layoffs, etc. Don’t expect anything major from them until the number of users start growing again.

They deliver a new version every month, why do they feel lost and what sort of changes do you expect?

I've been using Firefox since they announced their major overhaul whenever that was, and got a Firefox account to sync with when that became available -- I don't remember getting any email from them at all.

Same for me

Maybe the are being sorted into your spam folder?

I've also signed up for a Firefox sync account ever since it was launched, and the only emails I get are the security notifications about new sign-ins.

The Firefox Account has no communication options and does not send promotional emails: https://accounts.firefox.com/settings

Not sure what lists you're subscribed to, but they aren't part of this account. What mailing lists have you subscribed to or what service are you talking about?

They absolutely do send "promotional" emails and in the communication preferences there was a huge list of different newsletters (which always seems to change). I'm not the only one getting this spam email:

https://old.reddit.com/r/firefox/comments/fggla9/get_the_f_o...

From that site: https://i.imgur.com/tHTSKXL.png

Check the bottom. When you clickthrough the Email preferences link, you're presented with a list of several email lists you can subscribe/unsubscribe from.

Edit: I was subscribed to a couple lists I never directly opted-in to receive, though I never received any emails from those lists.

Ah, the problem is that I don't have that option — must be a regional thing:

https://imgur.com/a/BR1ILDe

Just happened to catch this, thanks for the response. That's interesting that it's possibly regional, and I'm unsure why. They weren't sales emails, it was just newsletters about various Mozilla bits.

Forcing a login to unsubscribe from a marketing email is a serious dark pattern and a quick way to get me to flag that email as spam.

I'd love to hear if they made any progress in tracking down the 'interesting WebRender bug' from https://news.ycombinator.com/item?id=22359574

I think it's tracked under https://bugzilla.mozilla.org/show_bug.cgi?id=1604492 It's still open, but it seems people haven't been able to hit the bug on the last few nightlies (this is also my experience), so it's possible the bug was quietly fixed as a side effect of some other patch.

Programming can be so easy: "Oh hey, it fixed itself!"

Programming can be so hard: "So then what was the bug?"

Something something Schrodinger's Bug...

You can bisect to try and figure out where exactly the bug "fixed" itself. Not easy with a bug that can't be triggered reliably, of course.

And the awful thing if you can’t pinpoint what caused and fixed it is that it can more easily regress later.

They have, it's suspected to be caused by a race condition with memory pressure events [0][1]. It looks like the patch is not included in Firefox 74 though.

[0] https://mozillagfx.wordpress.com/2020/03/02/moz-gfx-newslett...

[1] https://bugzilla.mozilla.org/show_bug.cgi?id=1617083

yeah our potential fix is on Firefox Beta right now, if people want to try it out!

The largest change is disabling TLS 1.0 and 1.1 by default.

Chrome following when 81 gets released (currently in beta).

Yes, all the major browsers are on board with this plan.

An IETF Best Common Practice document saying to stop using TLS 1.0 (and TLS 1.1 which was rarely used in practice) will probably be published later this year. I liked this document's original name better but alas it's more important for people to act on correct advice than for the advice to make me smile.

https://datatracker.ietf.org/doc/draft-moriarty-tls-oldversi...

The 74 release says "New: Facebook container..."

Do they mean the facebook container addon will come as standard, pre-installed with 74 or do they only mean they updated the addon? Little bit confused, feels a bit strange if they meant the later (under the new firefox release), but a at the same time when I updated 73 to 74 I could not see any traces of the "facebook container" in 74, no added addon. Is it meant fb container should should be like an pre-installed addon?

> Do they mean the facebook container addon will come as standard, pre-installed with 74 or do they only mean they updated the addon?

The latter.

Why is that being mentioned in the main application's release notes? Isn't it more appropriate on the addon's main page? This confused me too. I thought they were including Facebook Container by default like they did with Pocket, then could find no trace of it after updating.

There is nothing else major in this release, so it probably made sense to Use this opportunity to mention it.

I don't watch mozilla closely other than I run firefox in a couple of places [including typing this message], and it does seem to me that they often promo existing features as "new" assuming that people are unfamiliar with them, which in fairness, a lot of people are probably unfamiliar..

For example when they recently updated their android app, it was phrased as "our new android app" with the possible implication that it was written from scratch more recently [I was already using it]. And probably to a lot of potential users, it might as well be new, because most people are not on it.

Seems a tad slimy/deceptive/over-hyping. But I understand that the public at large is unaware of the feature set and they wish to make a good impression.

Pretty sure the "new" part is the following:

> But when we need an exception, you can now create one by adding custom sites to the Facebook Container.

It's interesting that the patch notes seem to have references to a specific site. Did they really make changes to Firefox that only target Instagram?

> Facebook Container prevents Facebook...

Considering that Mozilla is already protecting their users from specific target sites, it is only logical to assume that they are also improving user experience for a website which has 1B+ users.

Edit: I still cannot overcome the fact that both products are owned by the same company.

Note that Facebook Container is an external add-on, not included with the default browser.

I'm really wondering about that too.

> When a video is uploaded with a batch of photos on Instagram, the Picture-in-Picture toggle would sit atop of the “next” button. The toggle is now moved allowing you to flip through to the next image of the batch.

Probably because the changes relate to Picture-in-Picture, which is not a standard web feature. Making sure heavily used websites work well seems logical and Firefox doesn't seem to be messing with web standard here, so it doesn't create any kind of technical debt going forward.

Yes: https://hg.mozilla.org/mozilla-central/rev/55aa8b3e0f6a

(via https://bugzilla.mozilla.org/show_bug.cgi?id=1610993, via Google)

Yep[0], but if you check the revision that fixed it [1] this seems to be a standard QoL change that Firefox already had the mechanism to perform per-site.

[0]: https://bugzilla.mozilla.org/show_bug.cgi?id=1610993 [1]: https://hg.mozilla.org/mozilla-central/rev/55aa8b3e0f6a

I'd just prefer it to be draggable. I have started using the feature frequently, but the button is often overlaid the next button on other sites as well.

They made a change in 73.0.1[0] only targeting one bank website[1].

[0] https://www.mozilla.org/en-US/firefox/73.0.1/releasenotes/ [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1613943

I was recently reading through the input handling code for firefox on windows. Turns out that some input method editors insert a special character that facebook then deletes, breaking input handling. So they have a special case fix for facebook where they turn that character into a different one.

I guess when you don't have enough market share to force extremely popular websites to fix themselves, you're forced to fix them yourself.

Either that or they're working around anti competitive features.

Eagerly awaiting a Firefox release that improves power consumption on Mac to a point where it is at least close to competitive with Safari. That, plus the rumors that iOS will soon allow 3rd party default browsers and I'm all in Firefox for sure.

I'm on a 2019 Macbook Pro and my battery lasts for hours. Then again, I haven't run Safari for an extended period of time.

Well of course it lasts "for hours", what would the alternative be? A brand new laptop dying in minutes?

My 2019 Lenovo E485 with Ryzen 7 was lasting about 90 minutes on Ubuntu due to a microcode bug that was recently fixed.

restricting all browsers to use safari is the single killer feature that made me stick with ios.

If I blacklisted a website in control center it is respected in all browsers even in private mode.

Requiring all third party browsers to honor those settings is something I could see Apple doing.

> restricting all browsers to use safari is the single killer feature

"killer" is right, "feature" is not. It's very anti-competitive and for those who don't want to use Safari it means iOS is just not an option.

> If I blacklisted a website in control center it is respected in all browsers even in private mode.

This is useful if you're using multiple browsers, but why bother if they're all Safari?

Apple could simply, you know, provide an API so browsers could query this option and do something useful instead of being anti competitive.

There have been improvements, so perhaps you should try it again...

> "Highlighted by developer Henrik Skupin, users of Firefox Nightly on macOS will see a "huge decrease of its power usage by a factor of about 3x" when loading webpages. The change, which revolves around using CoreAnimation for rendering, cuts down on the amount of power required for the process."

https://appleinsider.com/articles/19/09/03/firefox-macos-tes...

> Firefox has added support for the new JavaScript optional chaining operator (?.)

Cool! This sounds like something all programming languages should have had decades ago.

https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...

This is only a recent addition to Typescript as well.

I'm working on a project built on Angular7 at the moment, and the version of Typescript we use is too old for this operator.

What happens when the browser supports an operator the version of Typescript you are using doesn't?

> What happens when the browser supports an operator the version of Typescript you are using doesn't?

Well I'm certain that it won't compile. Your .ts file must go through tsc after all before you get .js

> What happens when the browser supports an operator the version of Typescript you are using doesn't?

Nothing, because the compiled TypeScript won't contain it. TypeScript is deliberately conservative about the language features it supports to ensure it never gets out of sync with JS.

I like it, but idiomatic symbols are tough. When I look at some functional languages they seem so dense with operators that I have to use some inference (which I probably get at least partially wrong) to glean the meaning. This is a good operator that, in my opinion, should be in a dynamically-typed object-oriented language. But it is not as universally understood as most of JavaScript.

There is a place for languages that use more keywords and fewer operators as a design choice. Of course there also need to be languages that don’t have the undefined/null value and don’t need this.

I am surprised that browsing experience looks mostly the same as it did in the beginning of web browsing. Browsers are almost operating systems, yet they look like, well.. content readers. Nowadays I tend to work on several "projects" or tasks in paralel and for each project I open multiple tabs. I am opening multiple windows but it's easy to get lost in what each of these windows belongs to, difficult to switch between them, browser windows all look the same. Containers are not exactly good for this as they have their own cookies/local storage (different use case). It seems to me that browsers are not evolving in the actual end user usability that much. Also, more generally, why can't we have electron built-in in the browser, integrated with OS (so windows would look like a native app with it's own icon, title, etc)? Why does there need to be a separate Electron "browser" for every webapp instead of reusing already running browser with extra, per-app elevated API access? Why are browsers using vague version numbering instead of semver as it used to be? I don't know if FF 74 is the massive upgrade from 73 or if it is similar to the change from 72 to 73 or 71 to 72. And will it still take 2 seconds to get visual feedback after clicking the button in that fancy marerial SPA on my cutting-edge desktop machine?

I wish they’d fix Lockwise on iOS. Not really working. In my case takes ages to open when set as default, and never auto suggests login for the active site, either from Firefox or any other app.

Yes, it's a shame, it feels like none of the developers is actually using it. It also took them several months to fix a blatantly obvious UI issue with iOS 13. I would love to like Lockwise, it fits the bill perfectly for me, but its current state on iOS is just painfully bad.

Why use lock wise over say. 1password or LastPass ?

Because I trust Mozilla with my data. Would love it to support alternative backends, like NextCloud, though.

Trust a small portion of a web browser company instead of an entire company dedicated to the security application?

Absolutely zero trust in for-profits, especially ones who only care about an exit or getting bought by Microsoft, Google, Facebook, etc. It'll be too late to get your data out of their hands at that stage. Regardless, so far we've seen that no software/company is 100% reliable, no matter what their expertise...

Mozilla Corporation is technically a for-profit company.

I would suggest bitwarden, it's fully open source. I switched to it from Mozilla, mostly because of the sharing.

I use Bitwarden, but don't really like the UX. It being a one person endeavor seems to make the rate of improvement quite slow.

The app itself is quite slow to open on the platforms I've used it on. Searching for items is also slow. It doesn't allow for custom types (like WiFi, software licenses and other things), like the commercial ones do.

Agreed! It's painfully slow.

Lockwise takes ages to open on desktop Firefox.

It was probably deprioritized after the recent layoffs and reorg. They need to focus on their core product which is Firefox.

After updating Firefox opens this page (using Google trackers) https://www.mozilla.org/en-US/firefox/74.0/whatsnew/all/ with a huge banner for Facebook container. Notably Mozilla hasn't made or advertises a Google container (probably has nothing to do with their heavy use of Google analytics or the search deal they have with Google).

Please just fix the macOS CoreAnimation patch. It was introduced with so much fanfare ~6 months ago but it doesn't do anything, in terms of power use, for a large contingent of Firefox users. Firefox still nukes batteries, especially with video playing.

"Going forward, only users can install add-ons; they cannot be installed by an application."

Surely that depends on how hard the application wants to try? I suppose they might mean that installing add-ons externally is now unsupported.

Windows and macOS both have application-tied sandboxing systems. Maybe they plan to use that?

It says a lot that there's a new feature bullet for Facebook alone. I wonder if at some point Firefox is going to be so effective at hampering FB's goals that FB decides it needs to be crushed

Firefox has (unfortunately) such an insignificant share that it doesn't make any difference. Also many companies don't even bother officially supporting it any more.

Google services are extremely slow on Firefox too.

I wish Firefox had a good multi-account support like Chrome has. That, and the fact that iOS 14 might allow to set your default browser would make me move to use Firefox everywhere.

Multi-account works great with containers, far superior to chrome.

What you mean is probably multi-profile. I have never used that with chrome, but with FF I can go to about:profiles to open a new one or (according to a quick search) have a shortcut to the profile switcher or to a specific profile. What does Chrome do better?

> What does Chrome do better?

I haven't used Chrome in a long time, but this is the primary major thing I miss from it (possibly the only thing).

E.g. we have a family computer that my spouse and I use. I have set up separate profiles for us and forced Firefox to ask which profile to use on launch. But this means that if she has the browser open and has stepped away, I can't just open a new window, switch to my profile, and do things under it. I have to fully quit the browser and restart it.

If I remember correctly, with Chrome the profile was essentially tied to the logged in account and it was possible to have multiple windows open to different accounts. With Firefox you need to sign out of a Sync account before logging in to another.

With the new(ish) Containers feature, you can have different accounts in different tabs. They are color-coded so you can tell which container each tab is in. Just long-press or right-click the New Tab button to choose which container the new tab opens under. So e.g. you could log in to Twitter in your container, open a new tab in her container, and log in to a different Twitter account there.

> I have to fully quit the browser and restart it.

You can use about:profiles and click the "Launch profile in new browser" button for the relevant profile. The UI is not amazing, and I would not recommend it to a non-techie given all the noise in it, but it does work....

You can just make a shortcut to run `firefox --no-remote" --profile foo`. Poor UX, but the feature works.

Interesting. What exactly does the `--no-remote` command do? I couldn't find any real detailed info about from a quick search.

https://developer.mozilla.org/en-US/docs/Mozilla/Command_Lin...

By default if the browser is running, the command you run will use RPC to pass your instructions to this browser. This maybe isn't what a seasoned Unix person would expect software to do but it matches expectations from many GUI users.

The --no-remote flag tells Firefox that no, you really want another Firefox.

Here's a longer explanation. https://www.brycevandyk.com/dissecting-firefoxs-no-remote-op... By default, Firefox looks for an already running instance and attaches to it, opening a new window in the existing session. --no-remote disables that connecting behavior.

Out of curiosity, why not have another user account on the computer? Windows is pretty simple to move between user accounts as is Linux and, although I haven't use macOS recently enough to comment, it was pretty easy the last time I did.

I'm sure our use cases are different but I'd like to understand yours better.

Ya know, this never even crossed my mind. Hah. Good point.

Obligatory "Firefox on iOS isn't really Firefox, as iOS App Store rules ban browser engines" reply. ALL iOS browsers are basically just skins on top of Safari's WebKit.

See 2.5.6 here - https://developer.apple.com/app-store/review/guidelines/

An off topic question, but I would appreciate feedback: I have tried the DuckDuckGo browser on my iPad, and it seems like it provides good privacy features even though it is layered on WebKit. Any opinions of DuckDuckGo vs. Firefox on iOS?

Read the top comment regarding Containers. I think FF has the BEST multi-account support. Just login to different accounts using different containers. Your cookies/logins in one are isolated from the others. Currently have three Gmail accounts open and pinned in multiple containers.

Containers are a vastly superior experience to profiles, at least for my use. I still have all my history, bookmarks etc., just different cookies&stuff for the things I open in the various containers I use.

I wish Firefox on iOS had ad-blocker - that's the only thing preventing me from switching on my iPhone.

On iOS, all the browsers share the Content Blockers you install and enable in Settings (system wide). Install Firefox Focus (a single tab browser), which comes with its own Content Blocker.

Any way to get rid of this "Your browser is being managed by your organization" tomfoolery without nuking the relevant code in EnterprisePolicies.js[1] and rebuilding Firefox?

[1]: https://dxr.mozilla.org/mozilla-central/source/toolkit/compo...

+1, would love to circumvent this !

If you could then enterprises would use the same mechanism to turn it off too.

Can't you ask your organization to get rid of its policies?

If it were only that easy.

Even if Facebook is containerized, if you make a purchase on <site>.com they might just tell Facebook (without the browser involved)

Apparently this can be done in a brick-and-mortar (Home Depot, Pavillions, so on) too. And I mean even without ID, members card, ewallet, etc...

There's nothing Mozilla can do about that too.

But that site would have to know what your Facebook profile is. And with FB domains blocked outside of the FB container, they're going to have a harder time putting that info together.

Could they just use your email address?

psst ... check out https://monitor.firefox.com/protect-my-email

That helps only for breaches involving specific email addresses. What the GP is hinting at is Facebook having your email address and you using the same email address on a site for a purchase. Sellers usually upload their customers' email addresses on to Facebook and other social media platforms so that they can target these users better. So if you use the same email address everywhere, then linking all your interactions and transactions is a certainty.

But that site would have to know what your Facebook profile is. And with FB domains blocked outside of the FB container, they're going to have a harder time putting that info together.

Nope. I didn't find a lot of activity here (most was wrong), but Albertsons and Home Depot had hits. I've never given either my Facebook info.

https://facebook.com/off_facebook_activity/

Switched to Firefox nightly and preview recently; it's great once you enable webrender and mess with a few other about:config options. Lockwise on Android is the only issue, it doesn't always suggest my saved passwords.

Same for me on iOS. Commented above. It’s also annoyingly slow.

Which about:config options specifically would you recommend?

I have a blog post in my drafts folder that documents it.

Hoping you post to HN when you publish.

https://www.mozilla.org/security/advisories/mfsa2020-08/

Link seems broken.

This release really seems broken to me. Tree Style Tabs broke completely, and i have problems with non-responsive windows

Ugh that makes me worry, what happened to TST for you?

I can only close tabs with Ctrl+W. Clicking on the 'x' button does nothing.

Something's weird, then, given the number of Mozilla devs who use TST. Try in safe mode / try in a different profile / file a bug.

(I am running Nightly and am happily clicking away TST tabs with the 'x'.)

Thanks. Reinstalling the extension fixed it.

Did that lose your existing tree structure and flatten everything?

Nope. I did the following steps: (1) uninstall TST (2) restart browser (3) install TST (4) restart browser.

All the tabs were as is. But I also purposefully did not open or close any tabs between (2) and (3). Not sure what the impact of that would be.

I still find it somewhat surprising that the FreeBSD pkg is already there, just hours after release.

Just note that Firefox (any version) won't be in the quarterly repository for a few days due to a dependency problem, at least for 12.1-RELEASE:

https://lists.freebsd.org/pipermail/freebsd-ports/2020-March...

First item listed under New:

> Your login management has improved with the ability to reverse alpha sort (Name Z-A)

Cool!

Is it me or the security fixes link points to a nonexisting page?

It might be under embargo. Links up until MFSA2020-07 work.

I wish disabling extension will not reset all the settings.

The desktop version should be a lower-level priority in the mobile driven world. The Android version of the browser is still annoyingly slow and too complex to be a daily default.

Brave, with it's dead easy setup should be an example to follow.

Did you try FF preview 4? It's quite good.

The browser is unusable on Twitch or YouTube. It is so slow. It also starts lagging my 2700x CPU, which is insane. As always performance is an issue with Firefox and always will be

I guess this means that containers still don't work in private mode.

does it still come with google tracking on the welcome screen and a ton of unapproved communication to mozilla servers?

Yes it does.

Until Firefox allows Tampermonkey scripts to be loaded from local files, I'm not switching.

> When a video is uploaded with a batch of photos on Instagram ...

Features just for insta? I thought this was a web browser not an instagram browser. I guess same goes for the facebook container... what's up with building browser features for facebook? Why no reddit container, or google container, or amazon container?

It's possible this was a layout bug whose most common and visible consequence was on instagram?

Or does FireFox's picture in picture code have special casing for some sites?

Good question

FF has some special cases for specific sites. A bug linked above shows it for Insta and another for a bank.

The Instagram thing is because a feature in Firefox broke a website

> When a video is uploaded with a batch of photos on Instagram ...

They fixed a site-specific bug. It takes some creativity (and a strategically short quote) to get outraged over a browser update improving how the browser renders websites.

Firefox stopped being a neutral browser long ago. See [1] and [2][3].

[1] https://blog.mozilla.org/blog/2019/08/21/mozilla-takes-actio...

[2] https://discourse.mozilla.org/t/the-removal-of-the-dissenter... [3] https://hub.packtpub.com/mozilla-and-google-chrome-refuse-to...

A new Firefox release, a new reminder that Firefox hasn't implemented native context menus in macOS for 20 years.

I suggest withholding payment until they fix the problem.

It is open source. If you want that feature so badly you've had 20 years to implement it and submit a patch.

I reckon it's the only thing I use on macOS that even has a context menu. What's wrong with it? Or is it just that it doesn't look like those in... whatever you're using that also has them (Numbers.app et al. maybe?)?

Literally every other application on my Mac. I don't know of any Mac applications that don't have a useful context menu.

Even if you ignore Firefox's weird horizontal menu items, it looks wrong, and it acts wrong.

The dividers have a non-standard color. Some menu items have tooltips. One item has an icon, and it doesn't highlight correctly. When dismissed, the menu disappears sharply instead of fading out.

(To add insult to injury, the menu doesn't even use the system language. There's some internal setting that nobody can find which causes it to use Japanese even though my system and Firefox prefs are all set to English.)

The position is wrong, too. I'm used to dragging one pixel to the right, but that's not far enough to highlight the first item in Firefox. Many keyboard shortcuts are missing, e.g., the common ways to jump to the top/bottom item (home/end, cmd-up/down) don't work.

Try MaterialFox (https://github.com/muckSponge/MaterialFox). It smooths out many of the rough edges that make Firefox feel a bit clunky on macOS.

Reply on news.ycombinator.com