Things will break in unexpected ways, while web developers are the ones expected to spend their time offering support for a browser that has been rendered broken.
They need to be very careful about how these features are presented, and evaluate how they affect the entire web ecosystem.
It's hidden behind an about:config option (rather than being in the settings page), and the linked article literally says "It is likely that it may degrade your Web experience so we recommend it only for those willing to test experimental features". What more do you want?
2. The linked blog posts already lists the things it does (although it's non-exhaustive)
I just noticed there is a "Show only modified preferences" which is wonderful. It shows me uhh.. a few hundred things I haven't changed myself.
I really can't remember what I've changed.
(5 minutes later)
I remembered, last time I've looked the about:config right click context menu was replaced with the rather useless default webpage menu. Kinda funny as I was looking to disable dom.event.contextmenu.enabled
Putting "enabled" and "disabled" behind the preferences feels kinda silly. It would make more sense if the gui replaced true/false with disabled/enabled.
Inform users when they silently pass garbage through web APIs such as HTMLCanvasElement.toDataURL(), when it happens. And the UX of that should also be very carefully considered.
Otherwise you might end up with some critical document scans on a government website being uploaded as striped nonsense images without your knowledge, and the "may degrade your Web experience" that you glanced over a year before when you enabled the option may not cut it when your Visa application is delayed or rejected.
>[...] when your Visa application is delayed or rejected.
Isn't that what the prompt (pictured in the article[1]) is for? It doesn't always show up, but AFAIK it only does that when the page tries to grab canvas data before the user has interacted with the page. For a page where you're uploading documents, that seems unlikely.
[1] https://user-media-prod-cdn.itsre-sumo.mozilla.net/uploads/g...
Right, it can auto-decline it in certain circumstances. As the name suggests, it auto-declines it when there there isn't any user input. That seems fairly reasonable to me, and is unlikely to cause issues with you uploading documents for a visa application (you need to interact with the site to upload the document in the first place). That said, I was playing around with it using various codepen demos and discovered that even if you interacted with the page, if the page was in an iframe it would always not show the popup. That might cause issues in certain circumstances and I do hope it will get fixed.
>and even then they shouldn't serve fake data when the user declines the request, but throw an error for the API call.
Whether that's the best approach is debatable. For the use case of uploading a document, I agree that would be the best behavior, but for other cases (ie. it's trying to display something), an exception would likely crash the app. In many cases (eg. google maps), the garbage data doesn't interfere with my use of the app, and crashing the app would be far more disruptive.
This would prevent problems but I don't think it can cope with the number of requests in the normal flow of web browsing.
I'm presuming you want the browser to somehow detect whether the garbage image data ends up in a POST request? I don't see how you can implement that in a reliable way, considering there are dozens of ways to go from canvas data to a POST request.
I use a different (from my regular privacy optimized) unmodified browser for such websites and use cases.
While this is clearly not a perfect solution, I also subscribe to the adage[0], that “perfect is the enemy of the good”[1]
[0] https://www.thefreedictionary.com/adage
[1] https://en.wikipedia.org/wiki/Perfect_is_the_enemy_of_good
Like the webgl max texture size dropping to 2048. I wish they'd give that one a bump.