I use FF on windows and in WSL2 Ubuntu and on FF Nightly on android. I do watch YouTube/Twitch a lot, of there's a problem with those sites in FF I'm not aware of it.
Maybe most people just aren't encountering these issues and they're prioritizing bugs that affect more devices?
Sad about the negativity in this thread. I hope FF stays around since TreeStyleTabs are like my most valued bit of software at the moment and it would be a pain to have to replace them.
My guess is it has more to do with browser development being an arms race. And Mozilla cannot just bank on its search ads, web ads, OS sales, office apps, or hardware to pay to keep up. And the biggest services all have and push their own browsers.
Think how much better Firefox had to be to unseat IE6. It was way better for years and still took a long time to gain market share. And it arose when the oligopolies were waning, often without their own browsers. Now most markets are cornered. And each big player has their own browser. (All largely based on WebKit.)
Give me the $500m a year and I'll give it a punt.
Mozilla has to ship its own cert store to have any sort of political power over CAs (which has almost always been a good thing).
This was super frustrating for me. I filed a related bug when loading the CACKey module stopped working.
While that bug didn't get fixed, I found out about two settings to do what you want.
Set security.enterprise_roots.enabled and security.osclientcerts.autoload to true in about:config and restart Firefox.
Doing that plus loading and trusting the appropriate certs in Keychain Access makes my CAC/PIV work.
Notice the word "roots" in "security.enterprise_roots.enabled"?
The PKI hierarchy is more than just "roots". A tree is more than just a stump.[1]
No amount of begging or pleading with the Mozilla dev team ever succeeded in convincing them to read the Microsoft documentation for how PKI works in Windows.
There's a set of constants in the Win32 headers that defines the various certificate trust stores in Windows. You know, "machine", "machine policy", "user", and "user policy" multiplied out to make combinations with "root", "intermediate", "crl", etc...
Over 20 years they have slowly, one at a time added a random subset of them. RANDOM. Just... one... at... a time... in some unfathomable order. It was mind-blowing to watch this unfold.
The simplest thing they could have done was simply support all of the stores by copy-pasting the whole block of constants and writing a for loop across all of them. Done. Fixed. Close ticket.
But noooo... got to keep those tickets open for decades and decades by making sure that whatever is there remains permanently incomplete.
It boggles the mind.
[1] As a random example of how this can be broken in Firefox is that it is unable to use LDAP to load an intermediate CA certificate. The use of LDAP is common on large Windows-based enterprise networks, because it's the default. It's trivial to "push" these intermediate CA certs into the local trust store of every machine using policy, at which point the protocol support no longer matters. Firefox could have simply picked up the certificate from the local store. It already has the code for doing this for Root certs, but refuses to use identical code for Intermediate certs.
How can you have an intermediate certificate in a trust store mean anything? Wouldn't its trust be based on the root that signed it? It seems to me either the intermediate cert is signed by a trusted root (in which case mission accomplished) or it isn't, in which case it's the root (not intermediate) that needs to get added?
Again, not anywhere near my area of expertise. Assuming my understanding is wrong, it would be helpful for me to learn how, and id appreciate the guidance.
Firefox supports only HTTP for retrieving an intermediate CA certificate, and can only do this "live".
Say you have a "leaf" certificate, and you already trust its Root CA, but there is no copy locally of the intermediate CA certificate. What now? Firefox will look for a HTTP URL in the leaf certificate pointing at the intermediate CA's certificate endpoint. It'll download and cache it on the fly.
This is fine... on the public internet with public CAs.
It's not generally robust on internal networks. For example, many "secure desktops" deployed in the military, security agencies, parliament, etc... don't have unfettered outbound access. They may need to talk to internal HTTPS endpoints but have no access to Internet-hosted CA endpoints publishing the intermediate certificate!
Windows solves this by allowing a single machine to download the CA certificates and the associated CRL files, and pushing this out to the workstations via policy. Firefox solves this by timing out and failing.
Similarly, HTTPS is the new-kid-on-the-block for PKI infrastructure! Its original use-case was for things like Smart Cards. Windows started out deploying certificates via LDAP, not HTTP! Firefox just does... nothing... if it sees only an LDAP URL in the certificate and you get an error.
Last but not least, truly paranoid admins don't just trust every public CA for every purpose. It's possible for a Windows network to deploy updated trust lists that restrict CA purposes. Similarly, it's possible to push out certificates you distrust and have anything using them rejected, whether or not the parent CA has published a CRL entry to revoke the certificate.
Right now, there's a lot of admins in Ukraine adding Russian CAs to such rejection lists. Get it?
Firefox has it's own unique and special way of managing all of this, and just ignores whatever the operating system tells it... except for a random subset here and there. That's not documented. You have to go read (and understand!) the C++ code to figure out what it does or does not do.
Oh, and to add injury to insult, the method for managing the Firefox certificate trust list changes semi-regularly, so most of the URLs in the docs are now 404s.
I've given up, and so have millions of other admins.
Firefox had a philosophical opposition to supporting enterprise customers on Windows, and they've paid the price for that philosophy with increasing irrelevance of their core product.
PS: Chrome / Chromium / Edge have their own issues, but nowhere near as bad. One major concern is that for non-public CAs used at a large scale, it's basically impossible to revoke certificates for any Chromium-based browser on unmanaged networks. It's still very difficult on managed networks. An example would be a University with tens of thousands of unmanaged workstations using an internal CA for things like VPN or WiFi access.
https://techcrunch.com/2021/12/13/mozilla-expects-to-generat...
But it's still the same BS.
HDR on Youtube is not 'the basics'. Don't be silly. And you listed it twice because you had nothing better to add.
If you want to attack the lone remaining independant browser maker because of some political disagreement you have with them, then fine. That is also stupid, but at least it's honest.
Don't lie to us or yourself by scraping together this frankly absurd list of minor gripes and passing it off as a serious technical complaint about how Firefox is managed and developed.
HDR on YouTube -- or anywhere for that matter -- is table stakes these days, and I don't think it's silly to say so. Would you buy a television that can't handle HDR in 2022? A phone that can't handle HDR in 2022?
Two points:
1. There used to be a time when Firefox was way behind, and their big "come back push" marketing argument was that they had essentially 100% compatibility on something like the top 1 million web sites. Now? Major features are missing on the number one video streaming site. That's not a small regression!
2. Browsers are essentially operating systems now. Applications are written for web browsers, not for Linux, Mac, or Windows. There's a reason even Microsoft is using Electron for most of their new applications. Essentially we now have Google-Web-OS and Apple-Web-OS, and even Microsoft has failed to deliver their own Web-OS (Edge). Mozilla's attempt is like the Linux Desktop compared to MacOS. It fails on the basics in the same way Linux can't get sound right or HDR video playback working. Meanwhile MacOS (and Safari!) has calibrated wide-gamut colour that Just Works.
We only interact with computers through two senses: sight and hearing. Mozilla can't get one of those two working consistently, correctly, or with the full capabilities of displays available for a decade. (I bet Firefox has languished in its sound capabilities also, but I'm not an audiophile, so I don't know the specific issues.)
I have a HDR laptop, a HDR TV, and a HDR phone. All three run browsers. Firefox is missing this key feature on all three platforms, making it a no-go for manufacturers, or anyone who wants to use the #1 video streaming site in the world... with their web browser.
This is my point: Mozilla has wasted time on vanity projects while they fired to Servo team.
The top comment on a similar post 10 months ago agrees with me: https://news.ycombinator.com/item?id=28813250
Maybe that commenter is irrational too?
You're doubling down on this HDR thing it seems. Vimeo only added HDR, and only for Apple platforms recently:
https://vimeo.zendesk.com/hc/en-us/articles/115015301027-Wat...
What rational basis do you have for believing that Firefox's lack of HDR support is a prime concern, and that they are not addressing it sufficiently, other than the fact that it mildly inconveniences you?
I'll probably have to stop soon. Firefox is just too buggy and incomplete.
The attitude of the developers on Bugzilla is just horrendous. Users take their time to submit detailed reports, with repro steps, explanations, references, and screenshots of how other browsers behave.
These tickets will sit in the queue for decades, sometimes with thousands or even tens of thousands of "me too!" and "is this fixed yet?" comments.
The only response you will see from anyone at Mozilla is internal paper-pushing. Assigning of categories, merging bugs, assigning to a team, or whatever. Almost never will you see an actual developer fix the issue.
Currently, Firefox the only major browser that:
- Doesn't consistently support colour management.
- Doesn't support HDR on sites like YouTube.
- Doesn't pick up the operating system PKI trust store.
- Doesn't play nice with Enterprise deployment and configuration management.
... etc ...
The core team has lost its way and is too busy playing with stupid pet projects with no business value.
The CPO should really start knocking some heads together and start asking tough questions like:
- Why are there open bug tickets old enough to drink and have little bugs of their own?
- Why is Firefox unable to correctly view content on the #1 video site in the world?
Etc...
Fix the basics!