totally different experience, FF ESR decided to update itself just the other day and break a bunch of stuff out of the blue, because of course moz://a knows better what I need and when I need it. It is very sad people like me need to put up with this abusive behaviour because the alternatives are worse
I support plenty of end users on Chrome and Edge at work and will happily oblige my wife by installing and configuring Chrome on all her devices. Firefox is what works for me and what I am comfortable using at this time. Unusable was certainly a hyperbole on my part.
I've never used Linux full-time, but from my understanding, neither GNOME Web nor Konqueror are Blink-based. Are they missing critical power user features?
> Despite being a component of GNOME, Web has no dependency on GNOME components, so it can be potentially installed on any system supporting GTK and WebKitGTK.
If not, your only way of fighting back is using Firefox and Safari, so that people still make websites that work in something else than Chrome and Google's monopoly isn't complete.
Then I have no way of fighting back, because I don't use Apple machines and Firefox no longer meets my needs and I have significant performance problems with it.
Over years I've found it really useful to accurately test web-page developments for Apple device compatibility on Linux distros without needing an Apple device or emulator.
That is not to imply the surrounding browser 'chrome' and UI is equivalent - but rendering certainly is close enough that most of the time pixel-accurate comparisons are valid.
Even Debian keeps up-to-date with latest webkit upstream. E.g. right now (Jul 5th 2023) Debian's libwebkit2gtk 2.40.2-1~deb12u1 (on Debian 12 Bookworm) shows this Changelog:
webkit2gtk (2.40.2-1~deb12u1) bookworm-security; urgency=medium
* Rebuild for bookworm-security.
* The WebKitGTK security advisory WSA-2023-0004 lists the following
security fixes in the latest versions of WebKitGTK:
- CVE-2023-28204 and CVE-2023-32373 (fixed in 2.40.2).
-- Alberto Garcia <[email protected]> Wed, 14 Jun 2023 11:00:05 +0200
webkit2gtk (2.40.2-1) unstable; urgency=high
* New upstream release.
* debian/rules:
- Pass -VNone to dh_makeshlibs for javascriptcore to keep the behavior
of the debhelper compat level 11 and earlier.
-- Alberto Garcia <[email protected]> Tue, 30 May 2023 10:19:01 +0200They disabled the setting to enable XUL extensions.
They disabled a bunch of extensions I had installed on firefox android.
As long as FF doesn't buy into Manifest v3.
Which it will.
Because it will.
I would have been OK with it if it didn't come with the loss of functionality.
Good times figuring out why users couldn't access certain sites after ignoring the vague opt-out message, good times.
As for telemetry, I’m talking about this particular incident, where the “user studies” feature was used to force an unrelated update:
Because they've been doing the exact same thing to that, packing it away more and more, slowly killing off the parts that made it a great power user and developer browser by just making them a little bit harder to use or get to every time.
The reason this feature is there is that many extensions play poorly with or should not have access at all to specific sites. For example, Grammarly has no business accessing a corporate billing system and IT might want to disable access. In other cases an extension slows a site massively and a user might want to say, "not that site" to an extension. This could be the start of a big end-user improvement, especially if it can be managed by users and installers.
And "it's confidential" is the worst possible answer but it's still the one they gave us.
> The best faith interpretation I can come up with, is in fact for security purposes. It creates restrictions on (at least from Mozilla’s perspective) untrusted extensions. I mean how many extensions are there that do act maliciously? It probably isn’t trivial.
My best interpretation of that is it allows organizations to more easily allow some extensions while disallowing others.
This is of course, complete speculation and if it was for enterprise management reasons, Mozilla should have clearly communicated it.
I say this because I already have had to modify a text file in my profile to get firefox to do what I want (tree style tabs without dupe tab-bar on top).
also, by "firefox 225" I wonder how easy it will be to arbitrarily modify a 'protected' app/system text file (this is already difficult on smartphones)
What security problem would be addressed by this? Why would Mozilla need to disable "untrusted" extensions for only certain websites? Why would a website need to be quarentined from an extension, instead of the other way around?
I would think that the remote kill switch for a specific extension addresses the actual security concerns, or Mozilla just not allow 'untrusted extensions' by default on any website.
I don't think Mozilla is evil for doing this, but I do find the motivation for this confusing.
Come to think of it, even better would be to attach this feature to whole containers...
This type of telemetry can go die in a fire for all I'm concerned, but these trackers are particularly devious with their constantly changing domains and URLs. Addons that allow for things like regex matching are the only solution that seems to work because the Pihole blacklist doesn't seem to block them sufficiently.
Mozilla has already killed off malicious addons by enforcing their signature requirements. I'm not sure what this adds, I doubt Mozilla will hire someone to monitor the changes to banking URLs around the world (a necessity if this is indeed intended to make banking safer).
Which is why I'd leave uBlock whitelisted. I never said I want to block all extensions!
> I doubt Mozilla will hire someone to monitor the changes to banking URLs around the world
uBlock effectively does this for advertising domains. Why is that any different?
uBlock was just an example, of course. There are other addons that do more complex auto detection.
I’ve specifically used Greasemonkey to fix bank breaking pasting into fields and blocking password managers by splitting login form into deliberately broken pieces.
What would just limiting the "fix" of blocking it to inevitably only some set of US banks (as I doubht they get the all URLs to every bank in the world) achieve?
Are you really not understanding this threat model?
Also - if you want to blacklist certain extensions from certain sites, you abso-freaking-lutely can already... see: https://github.com/mozilla/policy-templates/blob/master/READ...
you want the `restricted_domains` field.
It gets worse - Mozilla is the fucking worst at checking submitted extensions. They tried to the play into the whole "app store" thing that Google/Apple were doing, but those are justifiable cost centers at those two companies in a way that just doesn't work for a player like Mozilla.
Mozilla's store checks for extensions are fairly pathetic. You can submit a near empty shell with excessive permissions, get approved the first time, then auto-update to a new release (which will deploy to users immediately thanks to auto-updates). That new version has to pass a battery of useless automatic SAST checks, which will happily highlight all sorts of things it doesn't like (it flags words like "hello" because it contains a curse word) but which won't do shit to check if you're hoovering up credentials, browsing data, tracking users, etc.
If you're unlucky, at some point in the next 24 months you'll trigger a real review from Mozilla and get caught.
To be blunt - I have 15 years experience writing extensions. I don't like Google. If you think Mozilla is better you're wrong.
If an extension is known and trusted, why does there need to be a Mozilla-controlled kill switch for it?
In my case I'd put uBlock on my "yes I trust this extension" list and when I visit my banking website only that extension would be active.
It's also not "Mozilla-controlled". It's a feature that will, in the future, come with sensible defaults, just as uBlock does with their default blocklists, but in 116 the user will be able to more fully configure the feature. Meanwhile, in 115 the feature isn't active by default because the extension whitelist and domain list are empty.
How do they establish trust for an extension?
How many dollars do you want to wager that they are building this feature with the intent to get sued so that they can be forced by the courts to turn it on for sites like youtube?
Good god, the conspiracy theories are next level with this one...
> It's also not "Mozilla-controlled".
It's not? The bugzilla entry at https://bugzilla.mozilla.org/show_bug.cgi?id=1832791 says
We need to have ability to set the list of
quarantined domains remotely.
> ...for various reasons, including security concerns.
Security is just a red herring.
Who wins with this move? The cynic in me (who is usually annoyingly right) says Google. Mozilla loses even more trust from its users and Firefox now has a tool to disable ad blockers on websites of their biggest competitor^Wsponsor if they reach a suitable mutual agreement (read: G pays enough for it). Win-win for all the parties that have a say in this. Not users of course, but that's life.
Yes, this is what got my spidey-sense tingling, too.
This replaces the Gnome Extensions app and the browser extension.
If only Xfce supported wayland.
In the release notes which 95% of users don't read, and in a text label hidden in a toolbar menu. No informed consent or prompt to opt-in. And Mozilla hasn't disclosed their criteria for inclusion of websites, and what they plan to use it for.
I agree with you that Mozilla has certainly dropped the ball regarding this change. Much like pocket, the Mr Robot ARG, the Quantum update, DoH with Cloudflare as the default provider, and so on. But again all but the Quantum update have been user configurable, and in my experience, have not been reverted unlike my browser preferences on Windows, where Edge hijacks anything and everything with very little recourse.
that's... not a valid argument for this discussion? market share and user conservatism has no connection to concerns about basic safety affecting everyone
judgement should be applied equally, every user and every product
I believe the intention was to argue against the notion that 95% of users don't read release notes. The contention seems to be that, because Firefox users are more technical (or enthusiast, perhaps), more than 5% of Firefox users would read be aware of this change.
Now I agree that this change is not being communicated properly but to claim that the Firefox user is similar to the average computer user is not something I would agree with.
Is Mozilla content with that market share? If not, it must act with the assumption that its users are average.
Likewise... who's to blame if a rogue addon isn't responded too?
Same arguments get bundled about stuff for iOS and it's absolutely responsible for companies to be proactive about issues with stuff like automatic updates because failure to do is, in aggregate, is worse because of stuff like zero days.
I don't know their exact argument, but I would assume a better place for a notice like this would be a popup or some kind of tiny tooltip window when you update to Firefox 115 that says "hey, we can disable an extension at any time if we find reason to believe they're acting untrustworthy and misbehaving, you can disable that behavior by going here."
I cannot fathom how someone would disagree with this user experience suggestion around this new feature.
I guess I need to read every line of the source code, too. After all, they publish the code, so that's fair warning.
> Likewise... who's to blame if a rogue addon isn't responded too?
The person who chose to install it.
Given that Firefox auto-updates, and most of the time doesn't put up a "What's New" type page after the update installs, I don't think it's reasonable to expect that most users would even know that there's a separate release notes page, let alone that they should read it.
Are users giving informed consent for Google's ability to remotely disable Android apps or Apple's ability to do the same on iOS?
The ability to disable malware as it is discovered seems to be a very common pattern.
If you include the bundled malware scanners on MacOS and Windows, it's taking place on them as well.
No, but we expect Google to be user-hostile. We expect the opposite of Mozilla.
This feature does seem like it's designed to help defend against bad plugins, but in other hands it could be a source of worry.
This why Brave has far surpassed Firefox at this point.
- Good privacy defaults
- Adblocking
- The iOS browser actually has ad-blocking (this alone is why I shy every layman away from Firefox, fuck Mozilla for specifically locking those users out in the cold)
- Choose your own blocklists
- Anti-fingerprinting
- Soon cookie auto-delete
- Soon port scan blocking
- WebRTC protection
- HTTPS upgrading (less relevant these days but hey)
- IPFS
- Tor
They also have a viable business model beyond “pay me off, Google”. And that is not to mention how Mozilla has chosen to soak their entire culture in ultra-progressive nonsense instead of rooting it in tech.
Yes, Brave appending affiliate links was scummy (although not particularly harmful to their users). But that is quite some time ago now.
I was a Mozilla / Firefox stan for a very very very long time. I still love Thunderbird, especially the progress they’re making now. But Firefox (and to a lesser point Mozilla) has completely lost its way.
I keep forgetting Mozilla is a political action organization that occasionally distributes web browsers. Or at least that's how they envision themselves. Maybe if they focused more on the bug-fixing and the browser-making and less on trivial updates they wouldn't be at < 5% market share right now.
Two things coming in the (near?) future:
- vertical tabs get a number or background color when collapsed, helping visual differentiation and memorization
- tab ‘+’ button moved to more convenient location
Bookmarks don’t have tags, and I haven’t heard much noise about planned improvement (or users needing improvement) there.
Key words "at this time". In a few versions maybe they take that away and you can't block ads ok YouTube because Google threatened them.
Building the capability and hiding the options in the about config is opening the door to a lot of bad decisions later on.
https://www.ghacks.net/2023/04/20/mozilla-removes-bypass-pay...
But they still have to sign it, even if you're offering your extension somewhere else.
https://blog.mozilla.org/addons/2015/02/10/extension-signing...
And since they already built the requisite system needed to fulfill Google's demand, they won't be able to claim it would be too much work to implement. They're setting themselves up to readily comply with the demand when it comes.
Given the number of extensions silently purchased by people seeking to spy and push malware, I've minimized the use of extensions that aren't vetted in advance by Firefox.
> Recommended extensions undergo full code review by staff security experts to provide a strong additional security check.
https://blog.mozilla.org/en/products/firefox/firefox-recomme...
Though this kind of thing will generally be removed by the extension block list, not merely blocked from working on some domains.
It's up to another layer of security to help the user not install extensions (or any other software) that they do not want on their machine.
This security is a farce anyway. Firefox is installed in the user profile so any sufficiently advanced malware can just patch the firefox binary and embed itself in there or disable this nonsense. The extension shenanigans is just done to take away user control, with the excuse being to protect users from malware.
That makes zero sense from security perspective.
It would be like asking antivirus to only let virus access D:\ drive...
But even in the very best case, it's yet another custom "premium support" feature either way, like the Public Suffix List. They should push for standards instead, these kinds of things are always leaky and sometimes dangerous.
Anyway. I just meant that extensions are not trustworthy just because they're installed. Malicious vectors exist, and protecting people from themselves / them understandably not being an up-to-date expert in all things tech by the millions-to-billions is largely a good thing.
For now.
You used to be able to install any extension in firefox mobile, but they blocked that without any option to override it.
> However this feature can be disabled, or otherwise overridden at this time by the end user when following the documentation[0].
Nefarious features 'enabled by default' is the standard of Firefox. What else have they switched on behind the user's back then?
> I highly recommend you use a minimum amount of extensions anyway. The OP’s extension is a good one from what I can tell but I really only use uBlock Origin, Bitwarden, and tab containers at this point. I guess whenever I use Gnome I end up having to use their extension too which is frustrating but a different story.
You might as well use Brave Browser at this point.
All the fixups, for five: browser.fixup.alternate.* (multiple) browser.fixup.dns_first_for_single_words browser.fixup.fallback-to-https (If I type something in the url bar I damn well mean it! It'd be fine if it tried others, but it tries them and then stays on them, meaning I have to retype urls to get it to load the actual thing I want.) There's a few others that I don't _need_ but do use that I'm not including here.
System-provided custom CAs, for another, and removing the CAs I don't trust and am not likely to be impacted by removing. I don't need or want trust in a Turkish CA, for example. Cert stuff in particular gets worse every year, and here's another specific example of that: security.certerrors.permanentOverride. Enough said, I hope. At least they give me the option to make it temporary again.
There's no GPSD support in any easily available Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=1250922#c24 and they're going to remove it (again) because they didn't maintain it: https://bugzilla.mozilla.org/show_bug.cgi?id=1803234. Now I need dbus and geoclue, I guess. Where are the docs on how? I think it's clear enough that Firefox is not being made for the _users_ with this topic.
There are more, but I hope this is enough to show that they exist. These are the most egregious, for me - if they were removed I would stop using the web entirely the same way I've stopped using my cell phone for everything except work.
findbar.highlightall is essential for me
extensions.pocket.enabled
hide "are you sure" dialog when opening about:config
browser.urlbar.clickselectsall (now defunct)
extensions.checkCompatibility & friends (not sure if still necessary since I can't recall why I'm using it in the first place)
browser.backspace_action (might be platform dependent?)
browser.tabs.tabMinWidth
browser.compactmode.show
user.js customization because when I use tree style tabs there's redundant UI elements
What domains are in this "new quarantined domain list"?
> I really only use uBlock Origin, Bitwarden, and tab containers at this point.
Stylus, Privacy, Bypass Paywalls, and OneTab are up there in "essential" extensions.
However this feature can be disabled, or otherwise overridden at this time by the end user when following the documentation[0].
I can understand the concern here, but this change is being communicated, can be user managed, and the best faith interpretation I can come up with, is in fact for security purposes. It creates restrictions on (at least from Mozilla’s perspective) untrusted extensions. I mean how many extensions are there that do act maliciously? It probably isn’t trivial.
I highly recommend you use a minimum amount of extensions anyway. The OP’s extension is a good one from what I can tell but I really only use uBlock Origin, Bitwarden, and tab containers at this point. I guess whenever I use Gnome I end up having to use their extension too which is frustrating but a different story.
Will have to pay attention to this feature. Thanks for sharing the link.
[0]: https://support.mozilla.org/en-US/kb/quarantined-domains