Firefox 85
mozilla.org
mozilla.org
- impossible to put an image into a clipboard (so that user can e.g. paste it outside a browser)
- no PWA mode (impossible to put an icon of a website to your homescreen, which will open the website without a browser UI)
- impossible to have keyboard shortcuts with Alt https://bugzilla.mozilla.org/show_bug.cgi?id=1568130
I literally implemented support for the navigator.clipboard.write API, with image/png support included, in today's Firefox Nightly version: https://bugzilla.mozilla.org/show_bug.cgi?id=1619947
Enabling it on release might take a bit longer though. The specification is currently not in a good shape. And there are some open questions around permissions etc.
There are other use cases though that aren't supported by PNG, such as vector images and animated images. Or more niche use cases like RAW images.
Animated images could definitely be somewhat useful though, albeit much more niche than static raster images. In most cases where I want an animated image on my clipboard, a link will suffice. What I want may not map to the majority of course, but at least PNG support is a start!
Yes, but I don't think you can set the MIME type. So whatever you paste in would have to be smart enough to look at a text/plain clipboard data and figure out if it looks like an SVG (or whatever).
text/plain
text/uri-list
text/csv
text/html
image/svg+xml
application/xml, text/xml
application/json
Raster image support should also be able to support stuff drawn on a canvas element, so I think it is a great place to start.
I beg you, do not let websites put things into my clipboard.
Reading/writing clipboards is a problem for sandboxing since they act as a bridge to another layer that otherwise has no contract or understanding of the application. So are many other features not just on browsers but on any application that for some reason needs to handle a gazillion tings (on Linux subscribing to system/user dbus messages is a big issue and out of the box totally unmitigated).
[1] If a monolith like chrome/firefox needs to understand/parse hundreds of protocols, technology-standards, etc, is a challenge to sandbox, maybe it isn't the sandboxing but the application that is the wrong tool for the users threat-model? Note, there is also Tor/Tails/QubesOS if isolation between user-space applications is a serious concern.
But there are extensions that do a similar thing, eg Brief. https://addons.mozilla.org/en-US/firefox/addon/brief/ And once you've got past the pain of the move, they do a much better job.
If Brief synced what you've read between Firefox instances (desktop / mobile in particular for me), it would be heaven. It might even be enough to turn induce me to create an account and turn on Firefox sync. However that is a forlorn wish given it hasn't been updated in 2 years now.
Firefox for Android has this. Are you referring to Firefox for desktop?
I tried the keyboard shortcut fiddle with FF86 and it works just fine after clicking in the white part once.
That's news to me. I do that almost on a daily basis with Firefox.
I can do without the clipboard or PWA mode. Performance and responsiveness are what converted me and plenty others from Firefox when Chrome first appeared. If Firefox performance is at least close to Chrome/Chromium it'd make switching back much more appealing.
I also switched to Chrome rims ago when it came out due to how buttery smooth it was, but switched back after it starter to get slow.
Chrome's a memory hog and it runs slow and clunky on older devices, in my experience.
Chrome seem to struggle when there are tens of tabs.
Google web applications still not great, but still usable I find. Facebook performance isn't great either.
Sadly Google will typically "accidentally sabotage" performance of their key apps on Firefox.
I suggest to try Firefox as side browser for your light browsing need. Maybe like when reading news, social media browser, or anything make sense for you.
This worked for me, in my case, now chrome is my side browser.
Wait, why should web pages be able to usurp keyboard shortcuts traditionally reserved for the browser itself?
When I was playing a Counter Strike web app example posted here a few months ago, it was endlessly frustrating to have Control and W mapped to actions that you may want to perform simultaneously while also not being able to suppress default behavior. I kept accidentally closing the tab as a result...
I personally think that the ability to override default shortcuts isn't necessarily a bad thing, but I definitely think it should be opt-in, like capturing the mouse cursor is. There should be strict separation between "app" features and what a default website should be able to do. Overriding shortcuts should be one of the "app-only" features imo.
So play the native version - problem solved.
This drive to accomodate people misusing the web for apps just bloats browsers (making it prohibitively expensive to develop alternative implementations) while adding tons of privacy leaks and attack surface for exploits.
Normally, the fact that practically nobody actually uses Firefox would mean it's not a huge problem. But the only standalone VR headsets with a Chromium-based browser are the Facebook headsets. If Firefox were better, I could be running twice as many of the not-Facebook-encumbered Pico Neo headsets for the same price. As it stands, Oculus for Business headsets are almost the same price as a Valve Index, once you add in the mandatory "support" yearly licensing fee.
I assume you mean "practically nobody without an adblocker". I dread the day we could have to live without Firefox. Don't dismiss it like that, please.
Mozilla has never been a competitive company. They've always leaned heavily on the illusion of being a non-profit. They've always sold the "eat your vegetables" version of web browsing, without actually offering anything compelling over the competition. We're just expected to use Firefox because "it's made by not-Google".
You were clearly the issue in the other thread.
With Chrome, Edge, Opera, and Brave all running on Chrome, we're getting awfuly close to a browser monoculture - one controlled by Google.
Supporting FF might be a pain in some cases, but failing to do so drives users away from FF in the long run, and drives away FF users from your site.
I know web devs have limited resources, but look at it this way: supporting FF and Chrome is a lot less of a pain than it used to be supporting IE.
My job is not to drive users to Firefox. My job is to create a product that people can use. And in my particular case, my job involves creating a product that doesn't physically harm people.
I agree that browser monoculture is a problem. But there is another problem that Mozilla is not the company that is helping with the problem.
EDIT: to go a little further on this, it's not physically possible to create a good WebXR experience in Firefox, at this time. Despite their announcements of focusing on Hubs as one of the few projects they kept around after the most recent purge, there are key technologies that are fundamentally missing from Firefox that have no replacement. And then they have the termerity to user-agent sniff Chromium browsers on desktop PCs and tell you that they supposedly don't support WebXR, that you need to download Firefox to use Hubs. So it seems even Mozilla doesn't really give a shit about the Open Web.
Why shouldn't the browser have VR APIs? WebXR allows us to iterate faster, across more devices, and more easily integrate with other services than building in a framework like Unity can do for us. I've spent the last 6 years doing nothing but WebXR and Unity work and WebXR is hands down far easier to develop the sort of application we're building.
No, you're not going to build MS Flight Simulator in WebXR, but you probably weren't going to do that in Unity, either, and ain't nobody got the budget for AAA++ graphics anyway. The folks who do graphically intensive work in Unity have stripped large parts of Unity away to make it possible.
I don't understand your last question.
As a user I create separate Firefox profiles for every site I want to use as a PWA, add a desktop short-cut and some custom userChrome.css, but while the result is okay, it sucks to set it up.
The only positive seems to be, that I can disable the buggy Spotify service-workers while keeping them enabled for other pages.
It would be awesome, if the PWA implementation would even support the system tray (similar to kdocker), but just the basic functionality would be better than the status quo.
No idea what you mean. I can use any image. Right click - "Copy Image". Then paste it anywhere like in image editor. Works without any problems.
Firefox 86.0b1, Debian testing / KDE Plasma 5.20.5.
Isn't it possible with the convenient "Capture screeenshot" feature in Firefox (the 3 dots next to the address bar)?
That's a feature. Websites should not have access to my clipboard.
> - no PWA mode (impossible to put an icon of a website to your homescreen, which will open the website without a browser UI)
That's a feature. Icons on my home screen should only ever be native applications. Use bookmarks for websites instead.
> - impossible to have keyboard shortcuts with Alt https://bugzilla.mozilla.org/show_bug.cgi?id=1568130
Just build a native app. It's literally what you want.
Being able to take an image from the web page and place it on the clipboard is not 'the website having access to my clipboard'. It's the _browser_ having access.
Going in the reverse direction, placing data from the clipboard into the web page, is more tricky, but Firefox already does a good job of blocking clipboard accesses unless they're the direct result of user action (keyboard shortcut or button press).
The question is whether the website should be able to push images to the clipboard by itself, which it shouldn't. Firefox already supports doing what you're talking about.
I don't like the way clipboard access is handled in browsers either, but the fact remains that if I'm using an in-browser image editor, select a part of the image and press CTRL+C, I want that portion of the image in my clipboard. How it gets there is an implementation detail that the average user doesn't and, if it doesn't affect security/privacy, shouldn't have to care about. And since it's write-only, there's no security/privacy concern.
Having a feature that breaks user's security is not a feature.
Anyways, this is far more time than I'm willing to spend talking to someone who thinks their PoV is the only correct one (I just now recognize your username from a few other threads under this post). Cheeers!
You can be right, but the market has a final word.
Today, many people enjoy using advanced apps, that can be "installed" and "uninstalled" in one second (by opening and closing a website), without leaving any track (mess) in your computer.
Why shouldn’t I be allowed to put a bookmark as an icon? That’s essentially what a PWA is anyways. A fancy bookmark that behaves like a native app. Why are you the arbitrator of what I can do?
What happened to giving users control?
What if "literally what I want" is to edit a photo without installing any software?
https://blog.mozilla.org/security/2021/01/26/supercookie-pro...
For example: Looking at a site and want to open your "hacker news" top site in a new tab?
1) Scroll up until you trigger the top bar reveal
2) Tap the boxed number button next to the address bar
3) Way at the bottom of the display, tap (+) to open a new tab
4) At this point the keyboard appears with the address bar focused. I don't want that, so tap in the tab home screen background where Top Sites can be seen
5) Tap on hacker news "top site"
That's 5 gestures, each in a new area of the screen, just to open a web site. Palm Pilot famously put nearly every common feature in the entire OS within 3 taps of the home screen.
I really hope Mozilla can do better than this!
I updated my tablet and my old phone to check the UI. I'm staying on the old Firefox on my main phone, partly because of the UI and 90% because of the add-ons I'm using. Not all of them are available on the new Firefox.
Mozilla self sabotages every few years, then fixes things. Unfortunately they lose users along the way.
Here's what I do on FF:
- When visiting a site, on the hamburger menu, there is a "add to main sites" icon, which adds the site to the home screen of Firefox.
- In the global prefs, I changed back to always displaying the location bar at the top, and always present (the scrolling was annoying me).
- We can long-press the tab icon, to open a new tab.
So if I'm on a site, and want to open HN:
- Long press "New Tab"
- Tap "HN" icon on the screen.
It's still annoying that it opens the keyboard by default. It sometimes adds a few milliseconds of lag, but I guess then search-heavy users would complain about the extra tap.
You can disable "Scroll to hide toolbar" in Customize to remove step 1. Steps 2 and 3 are still required but moving the address bar to the bottom keeps your taps closer together (The plus actually ends up right over the boxed number so you can double tap pretty quickly). You can also get rid of step 4 by disabling "Show search engines" in search settings. Now when you tap (+) the address/search bar will still be focused but the top sites are still accessible.
I wish Edge or FF could just look identical to Chrome sans being controlled by Google, which already knows far too much about me.
But the feature I miss the most from chrome is scroll to refresh, which I was told would be available soon.
(1) scroll down a tiny bit to reveal bottom bar
(2) tap the box with the tab count
(3) tap “+”
(4) tap HN
Both (2) and (3) are at the bottom of the screen, and (1) can be done near the bottom. (4) is the only one with a reach up to the top.
Which leaves the question: why are the UIs between the two platforms different?
In and of itself, I don't find it strange that the UI is different between platforms. That's called being a good citizen on a platform. In fact I wish they'd do it more. For instance, on macOS I'd expect close buttons for tabs in the top left.
I think there's been greater emphasis on conforming to the HID guidance and conventions on different platforms rather than consistency in the same app on different platforms.
https://support.mozilla.org/en-US/kb/customize-firefox-home-...
In this kind of interface usually the edit functionality is on the tiles itself. It confused me until just now.
https://blog.mozilla.org/security/2021/01/26/supercookie-pro...
It's too bad that we'll have to trade off browser efficiency for privacy.
This is also why I think Sparkle [https://sparkle-project.org/] is one of the best things about the Mac application ecosystem.
Edit: Should mention why, because it presents a consistent, and clear, UI for users and it encourages developers to write release notes.
Particularly the security fixes. Easy to find case numbers, impact levels and clear descriptions. All with decent spacing that makes the page feel clear and legible.
In the past you could look up changes here [1], but updates there stopped a while ago.
it's terrible, js shouldn't be aware of stuff like this.
Tracking/detecting/fingerprinting/etc. is an arms race. Every feature a browser has (or could have and lacks), can be used as a variable to compile a tracking profile that identifies you and/or your general browser configuration (including but not limited to private mode).
The biggest one of these though is something private mode can't control: IP. For that you need something like Tor or a VPN.
- browser ships a feature X
- they decide that X shouldn't be allowed in incognito (or that incognito mode returns fewer values, has lower quotas, uses different implementation that is slower/faster etc.)
- inadvertently, this becomes incognito detection vector
- people report the issue; the feature X is fixed
- another thing is shipped which accidentally allows detecting incognito
- ad infinitum
Which is exactly why Firefox needs to push back on adding more and more of those features, especially those that are not needed for websites (rather than applications).
> (or could have and lacks)
Absence of features can also be used for detection. Any differentiator.
For example, requests for software update have to go to Mozilla, but don't have any personal information, and are legitimately necessary.
¹ except of course any updates and binaries that firefox downloads and gobbles up behind the users back.
I'd argue updates are legitimately necessary for 99% of users (automatic updates are a huge reason why 90% of home PCs aren't in a botnet, and were a big reason why Chrome more secure in the old days vs IE/Firefox), and if you want to disable them it's very easy to do (about:config -> app.update.auto = false). But I don't know why you would, if the browser is changing too much for you you can change to ESR which is security updates only to older versions of Firefox.
Yes, automatic updates are pretty much necessary for about 90-99+% of users, but many lot of them are using system packages (which again, should not be able to update isself), and it is still not a reason why there shouldn't be a way to disable random background connections.
One could argue a silent browser is legitimately necessary for security research/operations, or just severely data-constrained networks, but I have yet to find a way to make firefox quiet.
Will app.update.auto disable all updates (browser, search engines, safe-browsing, user-test, blacklists.. there was at least a dozen features)? Last time I tried disabling almost everything suspicious, yet firefox wouldn't respect half of the settings.
Having an option to disable them would be a footgun. Such "radio silence" serves no useful purpose to normal users, but can make the browser appear buggy, e.g. if tracking protection broke a site, and you wouldn't get a fixed blacklist in a timely manner.
Someone has to host these dynamic components, and the browser has to get them somehow. IMHO it's way better if they're fetched straight from Mozilla that has strong privacy policy and a good reputation to uphold, rather than from some rando free distro mirror.
It might be done without bad intentions, but do Mozilla ask consent before asking their users data about when they are using Firefox, and so that they are (possibly) in front of their screen.
Consent only required for personal data. Absence of visible settings suggests those who trade browser silence for safety is a minority, not target audience. It is open source, you can make own build.
No it isn't.
2) track IP address
Risk: very high because they rely on user trust to survive and they could get sued into oblivion under the GDPR.
Reward: they now have a list of IP addresses with Firefox users behind them. Any big website has that so it's not valuable to third parties and it's not valuable to Mozilla because they don't do any targeted advertising or anything similar.
A list of IP addresses is about the least useful thing to log if you want to track people.
First of all, all of these things can be turned off; second, checking if you are using an outdated, potentially insecure browser is essential - if there is a vulnerability, the least of your problem will be that one goddamn ping to a mozilla domain...
They cannot. Reporting off, telemetry off, automatic updates off, every related setting in about:config off -- Firefox still transacts data with not one but several Mozilla domains upon launching.
Mozilla can't ethically constantly talk about privacy out of one side of its mouth while collecting data that can be used to track users who have explicitly requested them not to do that out of the other side.
1. They can if they're an order of magnitude better than everyone else, just like electric car makers can talk about being environmentally friendly despite the fact lithium isn't renewable
2. Are you sure it's tracking? What data is actually sent? Crash reports, update checks, network tests, motd fetching, cache preloading... don't count as "tracking users". Hell, even reporting on statistics (version, OS, platform, region...) isn't actually tracking users, but FF lets you disable that regardless because they know some people don't like it.
That said, I downloaded Pale Moon yesterday and tested it briefly: installed TST and one or two other extensions, visited a few ordinary sites.
Even after all those years it still feel good. It is snappy and the lack of a noisy tab bar on the top in addition to TST is actually a huge deal!
So my question for anyone from Mozilla who steps in here:
when will you start fixing the extension API? I get it the new API is more secure, but there is nothing that prevents making tab positions configurable in a safe way.
Also, could someone please fix that nasty UX bug that some UX designer introduced a decade or so ago where - if you select the tiniest thing on the page - the navigation buttons disappear from the context menus. After a decade or more this inconsistency still annoys me.
Report it via https://support.mozilla.org/en-US/kb/file-bug-report-or-feat...
The tabs expand on mouse-over:
And IIRC they have expressed intent to remove this possibility completely.
It took half a decade, but it's finally done.
https://blog.archive.org/2020/11/19/flash-animations-live-fo...
A little time tinge of disappointment though, is that the new Firefox for Android doesn't work at all with Lastpass' autofill. I've tried to find bug reports (https://github.com/mozilla-mobile/fenix/issues/9773) but they don't give me a clear indication as to whether it's being worked on or not. Unfortunately degrades my experience to the point of using other browsers. It doesn't seem like the old Firefox is available via the Play store in the meantime either?
It's probably inevitable when you release a completely new version of something, but the small, missing features immediately become obvious/upsetting!
https://support.mozilla.org/en-US/products/firefox-enterpris...
I don't see a lot of use of Bookmarks toolbar, bookmarks menu, and other bookmarks when there can be simply bookmarks and other bookmarks like Chrome. Bookmark toolbar makes menu utterly useless. I would rather have toolbar and an extension that displays those bookmarks toolbar in a similar way as menu to avoid added cognitive load.
https://new.reddit.com/r/FirefoxCSS/comments/l5ikzu/extensio...
> – The excessive width might be caused by dead space that's intended for the Other Bookmarks button, which I will not use. …
I have to use federation to login to slack. When Slack opens a page in the browser, that works fine, but then once I'm signed in it takes me to the web interface rather than opening the native client back up.
This isn't a tech support forum obviously but if someone had a hint of where to look, that'd be really helpful. I'm on ubuntu running i3.
Preferences -> General -> Applications
Content Type: slack
Action: Use Slack
Do you have that setting?
I use slack as pinned tab on Firefox, and it runs OK. It's easier for me when doing context switching since most of my works are on the browser.
Is there a way to switch from beta to stable without losing my profile?
How to create a new profile. https://support.mozilla.org/en-US/kb/profile-manager-create-...
Install the stable version but don't run it yet. Then follow the instructions to start the Profile Manager when Firefox is closed. If you need to recover data from your old profile, the link above has instructions too.
https://support.mozilla.org/en-US/kb/containers#w_what-you-c.... (item #7)
I believe there's a beta switch in the general settings menu.
Sorry I'm not on macOS any longer, I don't remember what I changed exactly.
According to xkcd this is a productivity win-win!
Relevant xkcd: https://xkcd.com/1205/
I'm glad they're continuing to improve the browser, maybe this update will be the one that convinces me to switch!
So, yes, great, another version i probably won't be using.
Not sure what do you mean by "field edits", I can edit the username/password just fine...?
A lot of websites confuse the field auto detect system, you go back to the page after saving password at login and FF can't find the fields, usually cause it didn't save the field names properly (you can see this in PasswordFox). The old password manager you could edit the field names as well as the U:P and URL fixing this problem. The new Lockwise basically turned 5 minutes of logging in to 25 minutes of copy and pasting for me..
https://www.askwoody.com/forums/topic/waterfox-has-been-sold...
That's a really dangerous thing to do for a piece of software that's made to run untrusted code on your system!
But since browser JavaScript engines are some of the best sandboxes in existence due to being constantly tested and updated, not using NoScript really isn't dangerous. Sure, disabling JS reduces the amount of risk, but that amount is already low enough to be tolerable for most people.
Sounds like just a nuisance, and it is, but i use quick-keys with my mouse and it really messes with my workflow.
Anything like that on Firefox?
If not, I'm not sure Firefox is currently the best option for any usecase - even on Linux.
If you really want to do this without extensions, you could try applying a global CSS filter using one of the CSS files in the profile folder (I don't remember which, but I think it's userStyles or globalStyle.css - should be easy to look up). The filter to apply is first an invert(1), then a hueRotate(180deg) on top of it.
It's not perfect, and it will have the opposite effect on pages that are already dark, but it's the best you can do without an extension.
>Anything like that on Firefox?
Themes? I use the dark one
No browser support for dark mode= no dark mode for me.
Firefox Developer Edition is a first party version of the software from Mozilla. It runs slightly ahead of the standard Firefox version I think.
FWIW, Waterfox also uses dark browser chrome by default, although if you're worried about security risks in installing extensions, a third-party fork of Firefox may not sit well with you either.
Regardless, I've used both pieces of software and had very positive experiences.
If you insist, go download Dark Reader from GitHub, look at the code (it's not particularly complex) and install it into Firefox locally.
No, I'd rather use higher quality free software: as it's chromium based it's open source.
Nothing prevents debian from compiling a de-microsofted edgium, like they do with a de-googled chromium.
As for sideloading darkreader, that's a decent idea!
But I'm not sure I want a worse user experience (firefox firing its devs may not have been the brightest idea!) and be forced to sideload extensions for things that are already included in another free software browser.
I use FF daily and it uses darkmode in sites that respect my system settings, because I have my system set to darkmode.
I use a Mac. Darkmode is a native feature.
I know, but I don't want to rely on their goodwill.
I want the browser to provide a dark mode that work in all cases, therefore:
- if webpages advertise a support of dark mode, oblige them
- if they don't, invert colors and use any other tricks as required
On Linux, Edge is the safest and the simplest way to always have a dark mode everywhere.
Of course, it may display dark mode in sites that respect the system theme - it's the easy part.
I don't mean that, because I don't want darkmode to be restricted to the few websites that respect my system settings: I want my browser to be "always dark", regardless of how cooperative or well (or badly) done the website is.
Dark mode on Edge is forced on the website: if it doesn't support it, the colors are inverted - with no theme or CSS tweaking required.
That's not rocket science, but still far better than anything I've seen on Firefox
Try it: the invert is intelligent enough to work in most cases. I think it substracts the background, which is often white/whitish, so you get the normal image but on a black background.
Also, there's an option to not invert pictures if you prefer.
https://reports.exodus-privacy.eu.org/en/reports/org.mozilla...
Something like that.
Mozilla: we've made sure people can't do any of that, but we collect anonymous statistics about how our own software is used. Oh, and we tell you about it and let you turn it off if you want.
People: Mozilla is evil and doesn't actually respect privacy.
Like it or not, there isn't a privacy issue here. I wouldn't mind a "silent mode", sure, but ultimately, that's a missing feature, not a critical bug.
As Jamie mentioned above Firefox is trying to launch a new process and is unable to find a matching binary. Before Mozilla detected the in-between update state there it was common to see spikes of crashes that were related to process spawning.
The choice Mozilla has is to allow the user randomly crash with a chance of profile corruption or alerting the user about the state and asking the user to trigger an orderly shutdown.
Power users can disable it. For the less advanced users, impose that as default behavior as its pros and cons.
There must be some additional context here. I've never observed this behavior on Windows or on Linux (although on Linux I'm using an LTS release, which could be a confounding factor).
I do applaud firefox for supporting so much customization, as in this case. If I weren't able to disable this behavior I would have stopped using firefox immediately.
Obviously this is only a problem on Linux, because on other platforms Firefox's own autoupdater will only apply the update when Firefox is restarting.
In my experience, running software updates while using the system is a pretty bad idea in general. It works well most of the time, but there's a reason Linux* is the only system that allows that (every other OS defers applying updates to a reboot).
It happens because Firefox closes and re-opens libraries and permits an in-place update (and thus, breaking itself).
While I understand that it is very annoying if you hit this issue, it is not done as some kind of trick to try to get you to update. The issue is that Firefox is trying to start a new content process to load your page, but the old executable no longer exists so it is impossible.
I don't use Windows much these days, but I'd love to know which setting it is that turns this off as I tend to hoard tabs and this sounds extremely annoying.