Firefox 88.0 | Hacker News Reader

Firefox 88.0

mozilla.org

317 pointseaston202 comments

> PDF forms now support JavaScript embedded in PDF files. Some PDF forms use JavaScript for validation and other interactive features.

The amount of complexity that one can put into a PDF is both surprising and a tad frightening.

Note that this is a new feature for Firefox's PDF reader, but not a new feature of PDFs in general.

Adobe had to update reader back in like... 2008?... to prompt before loading external resources. Because companies were embedding Google Analytics into PDFs.

> Because companies were embedding Google Analytics into PDFs.

Wow! This is daft. Thank the FLOSS gods for things like Pi-Hole because I never realised this. And if I hadn't blocked Google Analytics there, this would have been a sad state of affairs.

> Thank the FLOSS gods for things like Pi-Hole

Can't edit my comment any more, but I realise this is quite dismissive of the work the real maintainers have put in. So I'll thank them instead!

That's not dismissive, you just called them gods!

I bet the real reason for that was because it could then compete with adobes own analytics built into the reader.

I have an idea. Why not allow embedding a full browser engine inside of a PDF, complete with tabs and extensions? I hate having to leave Adobe Acrobat in order to read my Gmail, so I think this feature could be really useful. Anyone who builds a PDF can include their own custom browser that their users will love.

Well if you can run interactive javascript then you're mostly there, PDF is pretty much Turing complete so you can just crosscompile a browser into it using javascript to take care of the interactive parts, though you might need to rewrite the rendering logic.

PDFs are definitely not Turing complete. [0]

[0] https://www.cs.odu.edu/~zeil/cs390/latest/Public/turing-comp...

Ah I see I may have been thinking of Postscript.

Though I'm not entirely convinced they haven't accidentally added Turing completeness back in at some point.

I mean you don't really need all that much to write a basic lisp interpreter.

Well, now that you mention it..... It's likely that PDFs in Firefox are Turing Complete, since JS is Turing Complete.

JS embedding isn't unique to Firefox. This is Firefox catching up with an old feature from Adobe Acrobat. PDFs with embedded JS have been Turing complete for years, in readers that run the JS. Just like PDFs with embedded Flash content.

The PDF layout language isn't Turing complete on its own.

I'm assuming that predates the addition of JavaScript support, though.

Depends on your PDF viewer... https://github.com/osnr/horrifying-pdf-experiments

Just run Emacs :)

Back when I started playing D&D again, some friends stumbled across a PDF of "MPMB's character sheet" or something.

Basically, it was a PDF full of scripting and options and such, that let you:

* Choose which content you wanted to use (i.e. content from which sources) * Choose which rules you wanted to use (in case you wanted to use optional rules) * Choose your class, race, and background, and handle them appropriately * Level up your character, prompting you to choose spells, feats, abilities, etc. from every option available to you based on your current character options * Manage your inventory * Import and export your character data * Import and export source data

It was pretty insane. Granted, it was also insanely slow (presumably due to limitations of what data you can store in a PDF and how), but for a bunch of tech-savvy newbies to 5th edition D&D, it was vastly better than the other options and helped us discover a lot of character features that we'd missed when overwhelmed at first.

I still wish they'd put it into literally anything more performant, like an electron app or something. Yes, it was that bad.

The same capability is on the web at D&D Beyond: https://www.dndbeyond.com/

One thing to be aware of is that just the super-basic stuff is included in a free account. For example a 3rd level Rogue can choose a specialty subclass, and only Thief is available for free, other subclasses like Arcane Trickster you have to pay a couple bucks for.

Good point, but if you're in a group setting only one person needs to "purchase" access to sources to make them available to the group.

Yes, that's the best way to go. Everyone chips in and the DM gets the subscription.

It isn't expensive, it is just something to be aware of.

Or at roll20.

Is this using the browser's own JS engine? Do things like NoScript allow one to turn off PDF JS?

On the flip side, are there any examples of PDF JS being actually useful and not a vector for tracking/exploits?

> Is this using the browser's own JS engine?

This issue makes it seem that Components.utils.Sandbox is used when included in firefox, which would be the browser's own JS engine (but confined to a sandbox), and quickjs in other settings (say a website). https://github.com/mozilla/pdf.js/issues/12487

But I can't find Components.utils.Sandbox being referenced in the code on github. So maybe they decided to use quickjs for all use cases? The issue with quickjs is that it's written in C which is an unsafe language. wasm has bad binary security [0] so exploits are easier to create given some memory safety violation. The environment that calls the wasm is extremely privileged compared to random websites, so if a wasm exploit could convince the environment to do something, it would be major trouble.

[0]: https://www.usenix.org/conference/usenixsecurity20/presentat...

You can't use plugins like NoScript with PDFs on Firefox:

https://bugzilla.mozilla.org/show_bug.cgi?id=1454760

interesting, could you embed a pdf into a webpage that has some JS which triggers automatically? Even if you have noscript?

I don't want to say so authoritatively, but I don't believe so.

This desperately needs an option to disable PDF js.

You can create a Policy File on Linux named "/etc/firefox/policies/policies.json" to disable pdf through out the system, here is a snippet for just pdf:

{ "policies": { "PDFjs": { "Enabled": false }, "DisableBuiltinPDFViewer": true } }

See:

https://support.mozilla.org/en-US/kb/managing-policies-linux...

I see pdfjs.enableScripting in about:config options. Have to check whether that option disables this scripting after I get the new version.

NY state tax forms have all sorts of verifications and automatic calculations that I assume are implemented using PDF JS. Previously you had to use Adobe Reader, hopefully this means I can use Firefox now.

It does get used for interactive forms. The native PDF form handling is more simplistic.

True, but I don't see how it would be any worse than running JS on any other web page. Assuming it is implemented in a safe way, that is.

pdf documents are usually not created by web developers but by other people and then uploaded to the website. all it takes is a way to have someones computer infect a pdf with malicious js code, which, (if such an infection is possible) is way more likely to slip through than an attacker embedding malicious js into the website itself.

It's horrible for security but it can be really useful. This guy made an entire Dungeons & Dragons character sheet generator embedded into a PDF and I probably wouldn't have ever played D&D without it: https://www.flapkan.com/

I looked at the source code briefly and it's on the order of 10K lines of Javascript.

I'm still waiting to see a port of Doom in one. PDFs natively support 3D models!

https://js-dos.com/DOOM/

Just add a couple of lines of js for DOOM in the browser, now in js in a pdf in a browser!

Firefox opens PDF via pdf.js. From security perspective it's merely yet another bloated web page.

I instantly thought to myself .. "what could possibly go wrong?"

> The amount of complexity that one can put into a PDF is both surprising and a tad frightening.

off-topic, but fwiw: the pocorgtfo16.pdf[1] is a polyglot that is valid PDF, a ZIP archive, and a Bash script that runs a Python webserver which hosts Kaitai Struct’s WebIDE which, allows you to view the file’s own annotated bytes.

[1] https://www.alchemistowl.org/pocorgtfo/pocorgtfo16.pdf

Can't find the video but there was a sec talk where the host would demonstrate a few horrendous ones.

maybe that one?

https://media.ccc.de/v/36c3-10832-how_to_break_pdfs

> PDF forms now support JavaScript

I thought they always required JS to be enabled. I have JS disabled by default in uBlock Origin, and the inbuilt Firefox PDF viewer doesn't work unless I whitelist and enable JS temporarily for the page. Only then can I read my PDF.

Mozilla's PDF viewer is written in JS – it's literally called PDF.js: https://mozilla.github.io/pdf.js/.

This new feature means you can run JS embedded in PDF… in PDF.js.

The firefox PDF reader is based on JS.

Here goes me opening PDFs in Firefox.

Two age-old attack vectors united in perfect harmony.

Certainly nothing will go wrong here.

anyone figured out how to disable this?

Disabled by default, right? Why would you open up such a stupid security hole?

Let me bring some news: all websites already use javascript. Loading javascript from PDFs will be just another source of javascript vulnerabilities.

You're both condescending and incorrect. Bad combination!

Zero websites automatically get JavaScript access from me, and many other savvy web users.

If PDFs are not subject to these same controls in Firefox, then this could be a security and privacy vulnerability.

> Zero websites automatically get JavaScript access from me, and many other savvy web users.

Even if this weren't true, it would still be false that "all websites already use JavaScript".

PDF is required for JS to run due to code generation in the PDF rendering pipeline facility.

Right, so the question becomes: "What controls are in place?"

Does the JS run in a true sandbox? Inside, outside, or beside the usual browser sandbox? Are network requests allowed? Filesystem access? Are granular permissions required/available?

You can just block PDFs. It is easier than blocking js in web pages.

I don't want to block PDFs.

I want to block JS in PDFs, by default, like I do in web pages.

I'd also be happy to hear that the JS runtime in PDFs is run in a tight document sandbox, operates only on a highly constrained DOM-equivalent, and has zero network or filesystem access. Seems reasonable.

>The ‘Take a Screenshot’ feature was removed from the Page Actions menu in the url bar.

Odd, this is the only place I accessed it from. Not a big deal as it's still on the context menu and also can be added as a tool bar item but I am curious the rationalization behind this change. That seemed like a great place to have it to me.

When I first tried to use it, I knew of the feature but couldn't find it. They probably have metrics on it being underutilized so they want to bring it forward a bit or so.

But I think the whole "page actions" button is too hidden. I think screenshot belongs there, and the issue is that most people don't know without being told that "page actions" is something that even exists.

It's great btw to take screenshot of loooong web pages smoothly.

> the issue is that most people don't know without being told that "page actions" is something that even exists.

I'm a daily Firefox user for quite a while now... thanks for telling me this exists! Never really looked into what those 3 dots were.

(That being said, I always right click to trigger the screenshot option from the context menu.)

the right click screenshot is one of the most useful features i didn't know i need; it's super convenient to not have to precisely draw the rectangle to share a meme or report a bug.

Choosing to screenshot the entire page seems to be cropping off most of the right side on every site I've tried so far. Is that a known bug? It would be really useful otherwise.

I typically use Ctrl+Shift+S for this

I likely would as well if I remembered it. I have always had a problem recalling key combinations across all the applications I use which is why I rely on context menus and tool bars heavily. I've called out VSCode on this a few times as well as it is a memorization fest to work efficiently in there without proper toolbars. It's not just this but I have memory issues in general which have only gotten worse as I've aged. Easy discoverability / access in UI design is a big focus for me.

when I discover a new key-combo I write it on a postit at the bottom of my monitor, lives there for a while until it sticks in my brain.

In VSCode, use Ctrl+Shift+P to bring out the command palette and type in your wish. The corresponding shortcut is also displayed.

Yep, but I find it to be a really poor paradigm for efficient work if you don't remember them. Having to search the command palette is much slower than being able to set up a toolbar of often used functions. Don't get me wrong, the command palette is great to have but if you can't memorize all those functions then it's a really poor replacement.

For efficiency Key combo > toolbar > command palette. I just hate to be forced into #3 because #2 doesn't exist. (not to mention that the developers make crazy arguments in the forums about why they refuse to impliment it... but that's all off topic)

If you use Windows, newer versions (v1809 and newer) have win+shift+s as a neat region-select screenshot tool that sends the image to your clipboard.

There is still a "Take Screenshot" menu item in the context menu when you right-click on a web page.

Unless the context menu is not available, that is.

When is the context menu not be available? If the website is overriding the right click action, keep shift pressed while clicking to gain back control.

There are several pages on AWS that do not show it. For example, most CloudWatch pages.

I think it has to do with iframes.

You can shift+right click if a page (like the ones on AWS) block right clicks.

You can shift+right click normally too, even when a page doesn't block right click.

It's not about blocking or hijacking right-clicks. The menu option simply isn't there when the right-click happens in an iframe.

Google pays Mozilla to make Firefox worse to use. An bring more people to Chrome.

I can see why they are doing it but I'll really miss FTP support. A lot of public data continuous to be distributed through FTPs and for a long time Firefox has been the easiest way to browse them.

Agreed, I was on a public FTP site about a month ago browsing through old support files. Now I'll have to configure a client for it.

Edit: this might be a small opportunity for some of the native FTP apps to jump in and handle the links. Click an FTP link in the browser and launch my FTP client with the details passed through.

Your native file manager probably works fine with FTP.

And if you use Emacs then Tramp covers it.

You can use cURL to access FTP sites fyi.

You can also use assembler to make a video game.

That was a good one :)

and you can use chrome to access http sites, perhaps they should remove http support.

> The ‘Take a Screenshot’ feature was removed from the Page Actions menu in the url bar. To take a screenshot, right-click to open the context menu. You can also add a screenshots shortcut directly to your toolbar via the Customize menu. Open the Firefox menu and select Customize…

...why. Obviously it's easy to add it to the overflow bar, but it was handy having it there. Especially on pages that block right-clicking (including for good reasons, like games).

> Especially on pages that block right-clicking

Note that, in Firefox, you can always get to the context menu using shift-right click.

Thanks! This always bugs me. Maybe not disabling right-click has legitimate uses in things like games, but I only ever seen to see it used spitefully.

> I only ever seen to see it used spitefully.

God I hate it when sites do that. There's a service that I pay for which disables right click, spams copyright notice modals every single time I try to copy any text and replaces the text I copied with useless copyright messages. It's so incredibly obnoxious it makes me want to scrape their content off their website out of pure spite.

It's more 'override right click' and is useful for eg. Google Docs to use application-specific context actions. Unfortunately I agree that most sites override it just to disable it, though.

Here[1]'s the why: With the removal of the meatball menu in the proton work, we'd like to move the Take a Screenshot button to the toolbar to allow users to hide it or put it in the overflow menu rather than being visible all the time.

???

Edit: Also great to see how they brush over existing users who have pinned the screenshot action to the toolbar, which is something you can do with all page actions (who knew?!).

We had discussed it before as a possibility, but I just confirmed with Romain that it's out of scope.

For reference, ~15k users have screenshots pinned to the URL bar and engaged with it within a 1 month period.

So apparently 15k people did know and now have to manually fix the regression, assuming they know how to do it. I still find it creepy that they gather data this specific, and of course users who disable "telemetry" mean nothing to them, they don't exist.

[1] https://bugzilla.mozilla.org/show_bug.cgi?id=1691464

> I still find it creepy that they gather data this specific

I'd be super happy if gathering such specific data by any application meant to the developers "15k users are using this feature, there is no way we can break their workflow" instead of "there's only 15k users out of [x], that's just 0.x%, we can ignore them".

> I still find it creepy that they gather data this specific

I personally have never cared—there is nothing that can be learned about me (aside from being a power user, which I don't care about being public knowledge) from technical features I use. I absolutely block everything personal using uBlock Origin + Privacy Badger + FF's built in stuff, but I definitely see the value in tracking feature use.

> Firefox will not prompt for access to your microphone or camera if you’ve already granted access to the same device on the same site in the same tab within the past 50 seconds. This new grace period reduces the number of times you’re prompted to grant device access.

This is a super nice little QoL improvement, but I'd love to be able to configure this to be even longer (optimally by domain, but I'd love a global setting too).

According to the commit [0], you may be able to configure the period using the 'privacy.webrtc.deviceGracePeriodTimeoutMs' option in about:config

[0] https://phabricator.services.mozilla.com/rMOZILLACENTRAL1513...

Is there a substantial gap here between this new thing, your suggestion, and "remember this choice"? Trying to imagine the use case.

True, there's not a huge difference. I just tend to prefer to reaffirm my permissions on occasion than permanently allow them. Similar to how I appreciate that most website occasionally require you to re-login.

>Smooth pinch-zooming using a touchpad is now supported on Linux

Glad that they're still looking after Linux users.

On the one hand yes that's great. On the other hand it's not an exaggeration to say that a decade ago would have been too late for this feature.

I don't know if this is a good thing or a bad thing, but it was only added to Mac fairly recently too, maybe around a year ago. And for a while it was behind an about:config setting as well.

This doesn't work for me; found something that seems to suggest it's gated behind an about:config option and only works on Wayland anyway[0]. Oh well.

[0] https://www.linuxadictos.com/en/firefox-88-will-activate-the...

They're not treating X11 as first class citizen because it's a insecure history compared to Wayland.

Unfortunately they still don't provide a PPA for their developer build, so I have to update it manually which is extremely annoying.

edit: I gotta say, why the fuck would someone downvote this comment?

Manually? I downloaded their .tar.gz, have unpacked it in a location my user can write to, and rely on the built-in auto-update mechanism. Works fine.

PPAs are specific to one commercial distribution. Shouldn't they offer a flatpak or something similarly cross distro?

I have this and Safari both open to github.com on my macos box. This site has an animation showing recent github activity on a globe. It's coded in javascript, AFAIK.

Firefox is using 55% of my CPU, whilst Safari is using 3%.

As someone who used Firefox exclusively back in the day (and mozilla before that), I will continue to try tests like this every time a new Firefox is released. Maybe, someday, the energy contrast will be less dramatically in Safari's favour, and I'll switch back to Firefox.

I did the same test on my M1 Air. Safari is using 40% CPU while Firefox is 55%. Not sure why there's such a large difference between your results and mine.

My guess is that the OP doesn't have hardware acceleration for Firefox on his GPU configuration. You probably don't either with your numbers. I have about 3-4% CPU usage on GitHub.com using Firefox, and my GPU is at about 20% load from the 3D being drawn.

after reading your comment I checked again and realized that activity monitor has a column for %GPU as well under the CPU tab. So here's the eyeball average after watching the GitHub page for about a minute.

Firefox 88 (no extensions, private mode):

CPU% 55 (avg) 61 (peak)

GPU% 65 (avg) 77 (peak)

Safari (no extensions):

CPU% 33 (avg) 40 (peak)

GPU% 33 (avg) 40 (peak) <- same numbers for both CPU and GPU in safari.

Maybe it's running on a low power core?

Another M1 datapoint,

Chrome: ~20% Safari: ~35% Firefox: ~45%

I remember creating a moderately large spreadsheet in Google Docs last year. Safari unloaded the page and forced a refresh every time I switched away. Firefox would hang recomputing formulas and only Chrome scaled well.

I'm looking to move to Safari by default. I just need to get over some UI differences. It drives me nuts that Firefox doesn't use the native context menus (I use "Look Up" constantly) and Text Shortcuts don't work. There's a bug for this filed literally 20 years ago.

Each browser has different trade offs and those may not change over time. I'm glad Safari fits your needs.

With Google services specifically, it might be Google shenanigans at play rather than the other two browsers being genuinely inferior.

I just recently found out, you can use "Look Up" on Firefox for Macs, by tapping a word (or highlighted text) with three fingers on the trackpad.

I found it! It's the "Look up & data detectors" setting under System Preferences > Trackpad. For whatever reason mine was set to "Force Click with one finger" which I never use and had trouble consistently activating. The other option is "Tap with three fingers."

⌘-^-D the keyboard shortcut also works.

Firefox has had some bugs around this.

https://superuser.com/questions/1138014/how-to-use-three-fin...

Any docs or more info on this? Its not working for me.

Windows 10 here.

Chrome ~2.5% https://streamable.com/flb8rh

Firefox ~3.5% https://streamable.com/dkrp0w

Manjaro Linux, XFCE on an (old!!) i7-4770 at github.com:

- Chrome 5-8%

- Firefox 6-7%

This is a nice simple test.

But note for others: you need to be logged out of GitHub to see the animation. Or open GitHub in a private window.

Small bullet point, but an important one. This release also combats tracking with `window.name`. Discussion here:

https://news.ycombinator.com/item?id=26863109

Side note: I don't know how often this happens but it's kinda cool that Firefox went straight from 87.0 to 88.0 without any sub-versions. They didn't seem to have any security/bug patches, they just got it right on the first try.

I'm sure a few of these could have been backported but weren't severe enough to warrant an immediate push when 88 was right around the corner: https://www.mozilla.org/en-US/security/advisories/mfsa2021-1...

And this apparently happens quite a lot [no security patches in between versions]: https://www.mozilla.org/en-US/security/known-vulnerabilities...

I definitely noticed like "huh, it's weird we haven't had a new Firefox version to deploy yet this month". I'm used to seeing a point release nearly as soon as I deploy the previous Firefox version, lol. It isn't the first time, but it's infrequent enough to be kinda notable when they go an entire cycle without a point release.

<cranky>Perhaps in the olden days when various releases were somewhat fundamental in nature - not sure it's quite so impressive when we've had 3 'major' releases this year already</cranky>

Not that I much care - FF4Lyfe here!

Somewhat related is how libraries like three.js don't follow semver and only use a single incrementing version number. Reading the changelogs, it also looks like they never make any mistakes. It seems that there has never been a point in three.js's history where there's been a critical security flaw or bug severe enough to justify incrementing the version number solely for a bugfix. I have no idea how they do it.

Personally I would prefer to keep things as simple as possible, but unlike the maintainers of those projects, when it comes to making releases, I'm not perfect.

Does anyone know if there is an RSS feed for release notes? I couldn't find one, and the usual adding feed.xml to the URL trick didn't work in any of the instances I tried.

I have been using the Google Group RSS view from the mozilla.announce mailing list:

https://groups.google.com/forum/feed/mozilla.announce/msgs/r...

... which has been awesome, but I note I didn't get an item for this new version - looks like as of a couple weeks ago they have moved to a new mailing list system so this feed is gone.

The new Google Group is https://groups.google.com/a/mozilla.org/g/announce but after a few minutes of guessing I haven't figured out how to get an RSS view.

There’s a feed for Nightly: https://www.mozilla.org/en-US/firefox/nightly/notes/feed/

Exactly what I wanted, thank you!

I suspect if they cared about RSS they wouldn't have removed support for it from the browser...

Disappointed. There is so much low hanging fruit in the GUI department:

- have bookmarks/history stay on the page you open it on (and no other)

- have bookmarks and history occupy a full page, instead of shoveled into a GUI element, dialog style

- option to collapse tabs into a page (tab)

- make the "tabs window" (the downward arrow after +) a tab, so the tabs can be sorted, searched in, or copied from, as html, to a file (I now get a rather useless list of 100 tabs)

- have navigation to all of these pages, along with recent Downloads and options like Help and New Private Tab, right from the New Tab page, and leave the hamburger menu for page specific actions.

And more. But even without Firefox is a great browser.

Yes, I can't believe Firefox is still using a 15 years old bookmark/history dialog with atrocious UI. Completely unusable for anything but the most superficial inspection of your browsing history.

What do you dislike about it? Specifically, what about it makes it "unusable" for bookmark management, and what UI changes would constitute an improvement?

I strongly prefer it to the apparent alternative, which seems to be an HTML-native interface in a tab. In fact I think doing that to preferences (about:preferences) was a step in the wrong direction. Not only is the result rather ugly (IMHO), I'm constantly losing my preferences tab among my other tabs, whereas a separate window with a native UI has a single instance (more appropriate for preferences) and doesn't get commingled with web pages.

They recently removed bookmark descriptions and the justification I read was that it was old code and hard to maintain, so maybe we're lucky and they'll improve that UI next.

> - have bookmarks and history occupy a full page, instead of shoveled into a GUI element, dialog style

These are accessible at:

- chrome://browser/content/places/places.xhtml

- chrome://browser/content/places/historySidebar.xhtml

- chrome://browser/content/places/bookmarksSidebar.xhtml

Not sure why they're not shown as tabs by default like the rest of Firefox's menus.

> have bookmarks and history occupy a full page

Ctrl+Shift+O and Ctrl+Shift+H respectively.

And vertical tabs ... I can't install plugins on my work managed machine like Tab Trees or whatever.

They also need some tab grouping thing like Chrome, which ironically they pioneered but abandoned.

> have bookmarks and history occupy a full page, instead of shoveled into a GUI element, dialog style

I would hate that very much because I don't see the necessity for a whole page.

> - make the "tabs window" (the downward arrow after +) a tab, so the tabs can be sorted, searched in, or copied from, as html, to a file (I now get a rather useless list of 100 tabs)

If you go to about:performance, you can double-click on a Tab entry, and it will jump you to that tab.

I'm not looking forward to Firefox 89 with Proton and its redesigned tabs.

edit: I'm surprised people like them:

https://mk0ghacksnety2pjrgh8.kinstacdn.com/wp-content/upload...

You might be able to revert them using userchrome.css (https://www.userchrome.org/megabar-styling-firefox-address-b...). And as "megabar" update has shown, this new "tab" style will probably be reverted in future redesign.

> And as "megabar" update has shown, this new "tab" style will probably be reverted in future redesign.

Did they really revert the megabar? I can't find anything about that with searches. (I fixed it to look exactly like the old design with usercss, so I can't easily check myself.)

As a side note, anyone using TreeStyleTab is probably immune from Mozilla's awful tab style revamp, as the tabs in TST are styled using CSS by the extension.

There was this comment about removing large Urlbar: https://bugzilla.mozilla.org/show_bug.cgi?id=1698656#c2

That's extremely funny, thanks. Kinda reminds me of what people have been saying about Google for a decade now - starting projects and sunsetting them with no coherent story or end goal. This case seems particularly ironic because they insisted on keeping the change despite widespread dislike.

Looking at latest Firefox Developer Edition, where new tabs and menus has landed, sadly the megabar is still the same. Sorry, if I misunderstood initial message and gave false hope. But hey, at least context menu is back to text back/forward actions instead of icons. Everything keeps going in circle.

That's what this is? Wow, the new tabs are ... really big. Lots of wasted space it feels... and the inactive ones have no border between them..?

Mozilla, can we have bookmarks back for new tabs in Android?

Collections seemingly reinvent the wheel but limit the number of bookmarks, and force me to swipe left to view them.

Also can you let me go back to the New tab page without opening a new tab? You know, the same way every other page works? The way it used to work?

Agreed. Let them cover the whole screen instead of 2x4 with lots of free space below.

And it would be great if selecting url bar would also allow me to choose one of my collections. Now I have to open a new empty tab first.

Edit: basically what a sibling comment wrote I see

> PDF forms now support JavaScript embedded in PDF files. Some PDF forms use JavaScript for validation and other interactive features.

That's the first item listed under Features, yet I wouldn't classify that as a feature! That's a vulnerability waiting for an exploit.

Too bad AVIF images are still not supported (only behind a feature flag). Hopefully they will be able to solve the last bugs [1] that prevent this feature from being shipped.

[1] https://bugzilla.mozilla.org/show_bug.cgi?id=1443863

Still no fix for the horrible battery use on MacOS?

Every streaming video call I do through Firefox turns my MBP into a toaster.

According to Apple's Energy usage tool, Firefox bloats up to 70, while Safari is around 4 for the same Zoom call. Oof.

I really want to love Firefox, but it destroys my battery life. Faster than 1% per minute while on a streaming video call.

Does Firefox not import profiles from old versions? I upgraded 85->88 and got the message "this installation has a new profile" and am missing all my history, bookmarks and addons.

Is this update why I got the 'Refresh or safe mode' dialog? I foolishly clicked and now I'm trying to restore stuff from the 'Old Firefox data' directory. This was not nice, I started thinking I was getting hacked. Esp. when it asked me for the master password five times in a row. Man is this browser rough.

It should import from the previous release, so try reverting to 85 and upgrading through the intermediate versions.

I fixed it by making my old profile the default in about:profiles

It's weird that a new profile was created in the first place.

> PDF forms now support JavaScript embedded in PDF files. Some PDF forms use JavaScript for validation and other interactive features.

As far as I can tell I still can't play breakout in a PDF in Firefox though (and I think that's for the better)

[0] https://rawgit.com/osnr/horrifying-pdf-experiments/master/br...

[1] https://www.youtube.com/watch?v=6rbJu10Telc

Maybe the form is doing a browser check instead of a feature check and just needs to be updated?

Icons on macOS Big Sur are still the old ones. So far, only the Mozilla products (firefox/thunderbird) haven't updated macOS icons.

not sure why at this point.

The native support for macOS overall is terrible. It took them 21 years to finally support native context menus: https://bugzilla.mozilla.org/show_bug.cgi?id=34572

And you still have to manually configure Firefox to use the native full-screen-api so you can use the macOS menubar to chance your volume. Horrible, just horrible ...

But I'm currently on Firefox Nightly and pretty happy about the recent UX/UI changes.

Still no update on super-high CPU usage of Twitch on Firefox, an issue that has been open for at least 4 years [1][2].

I really want to like Firefox and I want there to be viable alternatives to Chrome but when playing video back at 360p (not joking) grinds my 1.5 year old Macbook Pro to a halt on a popular website... I just can't use it.

I don't know if this is a video codec issue, a CSS/JS issue that Twitch manages to trigger or what but it's a problem.

[1]: https://bugzilla.mozilla.org/show_bug.cgi?id=1403823

[2]: https://www.reddit.com/r/firefox/comments/917hyv/twitch_in_f...

A good way to get traction on a Firefox performance bug is to provide a profile. You don't need to install any new software. Instructions for recording a Firefox performance profile:

https://profiler.firefox.com/

Is it multi-user video chat? Firefox can't do this efficiently and it's also a problem with other tools like Jitsi.

Well, that's worse because it's a bigger issue. If you look through some of the bugs (there are several) you'll see suggestions of turning off chat to mitigate the issue but this raises even more questions:

1. Why don't users have to do that with Chrome?

2. While it does help, the video-without-chat CPU+GPU usage is still higher than Chrome's CPU+GPU usage for video-with-chat.

If that also applies to Youtube or other services and has been open for 4+ years then... yeah, big problem.

Isn’t this something that Twitch could/should fix?

Non-solution, but have you seen https://github.com/streamlink/streamlink-twitch-gui? It runs natively using streamlink, and streamlink can use e.g. mpv and use minimal CPU, instead using hardware acceleration (or not run whatever JavaScript Twitch decides to run, at least).

Workaround, but I use mpv with youtube-dl. Offers rewinding, pausing (buffering for minutes), frame-by-frame stepping, slow motion.. You can just type `mpv http://twitch.tv/user_name`

Ctrl-F Per process site isolation No results Ctrl-Q

Holy Moly! JavaScript in PDF?!

What were they thinking? It’ll just get disabled in a few months because it makes for one awesome vector attack.

How so? Will JS in web pages get disabled too?

Hopefully

sooner than later, desperately.

Have they give up on dev tools?

Why? There's been small but consistent improvements in each release, including this one.

I thought FTP support had been removed a long time ago for some reason! I have very fond memories of FTP but I guess its time has come. I probably haven't used it for 10 years at this point.

I used it yesterday. I regularly use FTP at work, well preferably SFTP but it does happen.

While we have a automatic deployment pipeline for our own projects, lots of our customers that host externally still use good old FTP.

I don't think FTP is ever going to fully die. It is still a typical way to deploy your files when using a shared web hosting that does not offer SSH.

FTP is still pretty much alive in research as well (well, until now). I also used it in the past week. I understand it has flaws, but... I don't know, this seems yet another nail in the Old Web coffin.

"Has flaws" is an understatement. FTP does not play well with the current way the web is set up. Any firewalling or NAT is a pain unless you have the firewall introspect the FTP commands, which is easy for plain FTP because it's plain text and unencrypted, but once you start encrypting the transport it gets more complex, and you need to add support for that in the firewall. There's also often two connection channels, one for control and one for data.

Just be aware that any FTP upload capability offered is likely a serious pain for the admins on the other side. Even if they finally get it configured well enough to mostly forget about, they'll have to dive back in every time they upgrade any infrastructure along the path to it. It's much easier to just pass a TCP port though, which is what scp/sftp (the SSH variant, not the misnamed ftp/s variants some clients used to advertise as it) is much easier, and if you use rsync, includes easy recovery.

> FTP does not play well with the current way the web is set up. Any firewalling or NAT is a pain unless you have the firewall introspect the FTP commands,

That is true only for active mode FTP. Firefox (and many other clients) already used passive mode FTP by default, which passes through NATs and firewalls just fine without need for special help.

Active FTP is a problem if the client is firewalled or behind NAT. Passive mode is a problem if the server is firewalled or behind NAT. The client makes both connections to the server, but still using a second arranged port, so any firewalling on the server has to either be aware of the specific port requested, or a wide range of ports needs to be directly passed through. This is what I was talking about with FTP aware firewalls.

This is what the ip_conntrack_ftp and ip_nat_ftp Linux kernel modules are, a way to make iptables more FTP aware by supplementing iptables at the kernel level.

This is also what OpenBSD's ftp-proxy utility is for, a way to deal with this without resorting to privileged specialty packet processing code, and a way to bypass not being able to see into encrypted traffic.

The fact that these workarounds exist is a testament to how hard FTP has been to deal with in the modern era of the web.

1: https://man.openbsd.org/ftp-proxy.8

> I don't think FTP is ever going to fully die. It is still a typical way to deploy your files when using a shared web hosting that does not offer SSH.

Surely those abominations are almost dead now though, in the age of the low-overhead VMs?

Some parts of the tech world seem quick to forget that smaller (and sometimes bigger) non-tech companies do exist. Sometimes non professional people create and deploy websites either as hobbyists or simply because there is no budget to hire a proper tech guy.

Wordpress is still a huge part of the Web and is running fine on shared hosting. And yes it can be an appropriate and cost effective choice for smaller sites even in 2021.

Also adding to that, the one time I did migrate a project from shared hosting to a dockerized VM solution was when the hoster was not supporting the needed PHP version anymore. Meaning hopelessly too old to ever update.

SFTP is not only just preferable but so unrelated to FTP that it frustrates me that it's often brought up in the same sentence... why did they call it that.. uhg.

Well, it is a Secure File Transfer Protocol after all. That's the trouble with descriptive names.

We’re kind of crazy and use WebDAV. Big upsides besides upload support were built in support in Windows Explorer, running over a single port / http, and https support.

Chrome 76 (July 2019) dropped FTP support.

I would have been happier if it had just be locked down to secure connections only. I have used FTP to quickly share files to colleagues at times and this will be broken now. I'm sure I was in a very minimal percentage but it was handy to just send someone an FTP link. Now if I don't want to have to upload it to an external service I will have to share it through my web server which brings up all kinds of MIME type issues, etc. I know, edge use case.

Try this to quickly share files with colleagues:

python -m http.server [port]

This will share the current directory using HTTP on port 80 by default unless you provide an alternative with [port].

JavaScript in PDF? Have people learned nothing? This is so incredibly stupid. They're just looking for bullshit "features" to implement.

> Print updates: Margin units are now localized.

Print in firefox is totally broken. The change to Chromium was the last nail in the coffin for printing. The new web does not care.

> The change to Chromium was the last nail in the coffin for printing.

I don’t think that Firefox uses code from Chromium for printing, does it? I believe that the print interface merely resembles that of Chromium.

??? I print through Firefox all the time with no issues. What exactly were you experiencing?

I wouldn't say that Firefox specifically is worse at it than other browsers though, but I kind of agree with parent comment that the "new web" doesn't care about printing.

On more and more pages I encounter issues like the printer only printing out the cookie warning window, or just the left navigation bar, etc. and none of the actual page content that I wanted to print. Or content goes up to the first in-line advertisement and then cuts of there with just blank pages coming out of the printer after that. Or weird pagination issues where there's text on page 1 and text on page 2, but there's a bunch of text missing in between that is otherwise visible fine on the screen.

I'm talking about web pages that don't specifically have a "print" button on them. If it looks like the page is using a fancy layout I typically now just do a screenshot and print the resulting .png.

I just switched from FF to Brave. Despite the unnecessarily built-in adblocking (I prefer blocking on router level + 2nd layer via ublock) and the BAT stuff, it is a good browser. It feels so fast and snappy. I wished FF was as fast.

Macbook Air M1

The best I ever did for performance was switching away from macOS. Sure, Safari and Chrome is really fast on Mac hardware/macOS, but nothing beats the performance of Firefox on Linux.

Sure, and FF for Linux was always second to FF for Windows, where the experience was better than both platforms.

On Linux hardware accel is still iffy, on macOS they implemented support for CoreAnimation one or two years ago, and still looks out of place with the rest of the OS.

> Sure, and FF for Linux was always second to FF for Windows, where the experience was better than both platforms.

Not for me on desktop with a pretty well specced machine, Firefox still runs better on Linux than Windows and I constantly boot into the other during one day.

Good or bad specced machine, it's fun seeing the Firefox process use 150% CPU when playing a 4K video with no hardware acceleration. Meanwhile it uses 15% CPU on Windows.

Might be my underpowered 10900K or $1500 GPU.

> nothing beats the performance of Firefox on Linux

Firefox on Windows does.

Yeah I moved away from FF as well after they got too political, very happy with Brave.

That sounds like an “out of the frying pan into the fire” kind of thing.

Yeah, what on Earth does he even mean by "too political". I've never seen Mozilla make "political" statements beyond their user privacy rhetoric, which Brave is far more aggressive about.

I'm almost certain they are referring to this blog post https://blog.mozilla.org/blog/2021/01/08/we-need-more-than-d...

That blog post can also be interpreted very differently:

https://news.ycombinator.com/item?id=26646748#26647158

Since when has Firefox ever been "political"?

Mozilla has increasingly become more of a political organization than a technology one. Where it used to focus on stewardship of the Mozilla code, its scope has now shifted to broadly "building a better internet".

The Mozilla mission 2005:

"Established in July, 2003, with start-up support from America Online's Netscape division, the Mozilla Foundation exists to provide organizational, legal, and financial support for the Mozilla open-source software project."

The Mozilla mission 2021:

"Our mission is to ensure the Internet is a global public resource, open and accessible to all. An Internet that truly puts people first, where individuals can shape their own experience and are empowered, safe and independent."

This shift has manifested itself in different ways which broadly align with American left politics. The homepage and blog are speckled with articles promoting diversity initiatives, endorsing BLM, calling for systemic change, endorsing net neutrality, and fighting misinformation.

Mozilla is also one of the organizations at the forefront of sanitizing language it deems problematic in any way:

* Removing "meritocracy" from the governance docs - https://blog.mozilla.org/careers/words-matter-moving-beyond-...

* Changing "master password" to "primary password" - https://support.mozilla.org/en-US/kb/primary-password-replac...

* Removing "crazy" from the codebase - https://bugzilla.mozilla.org/show_bug.cgi?id=1675987

* Removing words deemed as reference to mental illness - https://bugzilla.mozilla.org/show_bug.cgi?id=1675986

Some like this sort of thing and see it as positive, to other it's alienating.

Reply on news.ycombinator.com