Hacker News Reader

If you click through the learn more link, you can see an example of the new warning. Instead of starting the download, it shows a dialog with a warning and there are two buttons, one of which is "Allow download".

The second part of this feature is that for <iframe sandbox="..."> elements, regardless of HTTP/S origin, Firefox will no longer allow the iframe to initiate downloads unless the sandbox attribute explicitly includes allow-downloads

It appears that there are a pair of preferences in about:config to govern these: dom.block_download_insecure and dom.block_download_in_sandboxed_iframes

Isn't it still unsafe, because someone can intercept the downloaded file in transit?

That doesn't matter though, they will still download it either way.

This is my hope, too. Two additional clicks that give me zero benefits.