I don’t have a need to efficiently write an article in a browser - or code within a browser which is more my thing. I have a dedicated IDE for that, and leave browsing to browsing.
Browsers imo should just be browsers and leave the end user applications to the web app developers, plugin developers, etc. So in that sense I’m happy with where they are, and very happy they are doing their own stuff rather than being another Chrome-based browser.
Also I didn't say I should write in the browser, I said the browser should let me collect information from the internet in such a way to make my job easier
Firefox have also the "Browser Toolbox"[2], homologous to the web development tools, that one can use for to explore the css of the UI, select elements, etc, and modify them for to see how would look the modifications before to put them within the userChrome.css
The tabs I think that are under the id=TabsToolbar, so an #TabsToolbar{ display: none !important; } or similar should work, in addition to correct with other css params the space that it leaves.
Note: What happens is they change things from time to time, and after an update one have to correct the css again, I warn.
[1] https://github.com/Aris-t2/CustomCSSforFx
[2] https://firefox-source-docs.mozilla.org/devtools-user/browse...
Hiding it in usercss isn’t supported and is liable to disappear at any point (say, the developers decide they’re tired of maintaining some part of the code that makes the custom usercss flag work). It serves the purpose for now, but cannot be relied upon in the long term and as such is a hack.
Unless there's something I'm missing re: Mozilla's history/market-positioning?
Aside from that I just think it’s a good idea to push for implementation of basic functionality like hiding bars that don’t pair nicely with popular vertical tab extensions. I shouldn’t need to resort to usercss mods to do something that simple.
The problem here, though, is that the core browser becomes the lowest common denominator. When I set up a computer, I don't want to have to spend all day getting my browser into a usable state. I don't want to have to recommend Firefox with the asterisk that you need half a dozen plugins to make it good. I don't want to wake up and find that the tab management plugin I like has been bought out by a sketchy company that's now using my browser as a proxy server for scrapers.
And having a browser that's not minimalist is known to work. We have tabs today, for instance, because of the fine folks at Opera pushing the boundaries of what the browser can be. Not every browser needs every feature, but some things are just good quality of life improvements that plugins should be able to disable (versus requiring plugins to add all nonessential features).
You want a browser that can preload plugins on install with a config.
It's also funny how you bring up innovation. The thing is plugins enable much more innovation because a plugin can be made by a single person with a great idea and relatively little knowledge. Just imagine everyone who wanted to try out some innovative new feature would have to build their own browser first.
Performance has always been a metric that drove people to/away from browsers (at least for those of us who know what browsers are, know that alternatives exist, and are willing to try them). Add-ons can provide whatever weird workflow empowering gimmicks people want to set up for themselves rather than being limited to what the browser itself provides. Every OS I've used a browser on provides things like note/screenshot taking, and not everyone wants vertical tabs, ARC doesn't give you any choice. It's ARC's way or nothing. Firefox is still the browser that gives people the most control over how they work. Firefox truly empowers users.
And as for customisation, that’s actually been eroded over the past 3-5 years in FF compared to, say, 10 or 15 years ago. For example, I can remember a time when the interface itself had the option (a checkbox) that miniaturised the icons of the entire search bar UI - this has been gone for years and there is now no way to change that without installing an entire theme. Now every user is stuck with the same general interface/UI spacing.
I’ve used FF since maybe 2008 and in my experience it’s never been worse than it is now in terms of performance, its interface customisability, and its benefits vs its largest competitor. If I end up using it as my primary browser it will be because of Google’s insanity with adblockers, not because FF itself is a good alternative (indeed it’s just that FF is the ONLY alternative).
Privacy with Firefox out of the box isn't that much better than Chrome’s either, but what sets Firefox apart is that it can be very effectively hardened. At work I deal with all kinds of compromised and malicious websites and nothing beats Firefox once you've got it locked down.
> I’ve used FF since maybe 2008 and in my experience it’s never been worse than it is now in terms of performance, its interface customisability, and its benefits vs its largest competitor.
It's gotten more difficult to customize firefox over the years for sure, but what competitor offers better interface customizability? What can you customize in Chrome that you can't in firefox? What's chrome's equivalent to userChrome.css?
The idea is to reduce attack surface as much as possible, and disable features like searching/calculating from the address bar, service workers, wasm, prefetch, webgl, redirects, the PDF reader (no files ever just auto-download or open in anything by default), Firefox View, webrtc, network prediction, the social API, reader mode, there's some stuff about certificates, TLS and SSL etc.
There's also a section for preventing fingerprinting, disabling telemetry/reporting/safebrowsing, all the stuff here: https://support.mozilla.org/en-US/kb/how-stop-firefox-making... and to keep changes from being made so no auto-updates, and experiments/normandy/shield studies are disabled.
There are a bunch of guides to harden firefox online, and ours seems to be some combination of several of them. The Tor browser guys do some great work keeping an eye on some of the changes that get made.
In the end basically no active content of any kind is allowed by default. Some sites don't work at all with this stuff turned off or removed and it's a bit too locked down for day to day use but I'm surprised and how often things work well enough to get what you need at least. For example, an article might load just fine, but site navigation will be broken which isn't really an issue if you just wanted to read the article.
Most of the sites that will get you infected just by visiting them require JS, so disabling that alone helps a ton. For something you know is really evil it's often best to just download and analyze the site offline, but for poking around even in highly questionable places it's pretty nice.
I'd rather stick with Safari or Firefox.
[1]: https://caniuse.com/webusb
Clearly we’re talking about browser exploits in this particular line of comments, not privacy, and with exploits so defined Chrome is far superior to FF.
Most people here who use a Chrome based browser would almost certainly use a Chromium derivative anyway, like Brave.
You could've re-read the thread before posting such an obviously false comment.
Here's the first mention of privacy and security in this thread:
> I think firefox focusing on performance, customization, and security/privacy is smart.
I also heavily disagree with your view that spyware has nothing to do with security, and your extremely narrow view of what counts as security exploits. The Chromium specific APIs are riddled with security issues as I mentioned in my other reply.
Security and privacy are not the same thing, nor are they directly related. Lack of privacy can literally be designed into a secure system, which is one way of describing how Chrome works. It doesn't really matter how you choose to esoterically define the words if everybody else's meaning is different.
When people talk about Chrome being secure, they're talking about the browser's resistance to being compromised by a third party. It's that simple. Nobody cares that you have some esoteric view whereby Google's inherent lack of privacy protections, wherein Google is able to collect information about the user through their browsing habits, is also part of the browser. That is a matter of privacy, not security, and Google very clearly sets out all the ways it collects information about the user in its various policies. Security relates to whether third parties - using the browser architecture itself as a conduit - are able to compromise the browser in such a way as to obtain or manipulate user information, data, or elements of how the user interacts with the system, in a way that is not approved by the user and about which he is likely unaware. Every user of Chrome agrees to Google's collection and use of certain data, and ergo such data collection does not involve security issues whatsoever. That you might disagree with Google's privacy policies is not to the point. Note that if the aggregated user data were to be surreptitiously accessed by a third party, this WOULD be a security issue - but that isn't what we're talking about, is it?
If talking about security, Chromium has been the most secure browser for at least a decade. Safari and Firefox are significantly worse at security than Chromium browsers are. That's not really debatable - just go look at results of the various hacking contests, look at the number of active exploits and how long they are in the wild and unpatched, etc.
On privacy, Firefox is undoubtedly better, although Mozilla has had snafus over the years. Mozilla also literally makes something like 99% of its revenues through agreements it has with Google search, so go figure.
One final note - as has been the case for at least 15 years now, Firefox with uBlock Origin and NoScript and a few other addons are probably the most secure you can get, albeit at significant cost to usability and convenience. When discussing security I think it's inherent that people are discussing the vanilla, out of the box install of a browser. Having said that, I currently use Brave and find it to be the best mix of features of Chrome without the rest of the Google privacy problems; despite being a very long time Firefox user, it just isn't good enough these days, although if Google succeeds in killing adblockers in Chrome I'll have to move to Firefox regardless.
Good day.
> Note that if the aggregated user data were to be surreptitiously accessed by a third party, this WOULD be a security issue - but that isn't what we're talking about, is it?
But we are talking about third parties gaining access? The mentioned Web APIs are intended for use by third parties. It's not even aggregated user data, but individual ones.
WebUSB made it possible to work around Yubikey phishing protection [1]. WebMIDI allows websites to overwrite device firmware, which is a dangerous capability that could result in a sandbox escape [2]. Granting a website WebNFC permissions makes it possible to read TOTP tokens stored on Yubikeys at any point later on [3], which is worrying because ordinary users can't possibly deduce that from permission prompts. Battery Status API was heavily abused for fingerprinting when by the time it was removed from Firefox [4]. I'm amazed that you dismissed that as a "hypothetical" concern, because if anything, it's the legitimate uses of the API that was hypothetical [5]. Uber used it to "inflate Uber prices for desperate users with low batteries." [5] [6].
But one don't even need theses examples to see how bad theses APIs are. Hardware are mostly designed to work with local applications. To expose them to websites is a fundamentally flawed idea. Google justifies them by adding permission prompts each time a problem emerges, but users can't possibly be expected to be fully aware of the consequences of allowing raw hardware access to websites with mere dialogs that they blindly click through.
And oh I wish there were only 3 bad APIs like you hinted. There are more than that. WebMIDI, WebNFC, WebSerial, WebHID, Generic Sensor API, File System Access, Low-level Sockets API, Network Information API, and the list goes on.
These aren't isolated examples. It's part of a broader pattern where Google ships an anti-feature, asks for "feedback" which means nothing because "devs already depend on it," and "standardizes" it despite opposition from the remaining browser vendors [7] [8].
I’ll judge browser security based on a broad set of examples rather than a cherry-picked one every time.
[1]: https://www.wired.com/story/chrome-yubikey-phishing-webusb/
[2]: https://github.com/mozilla/standards-positions/issues/58
[3]: https://github.com/mozilla/standards-positions/issues/238
[4]: https://www.cs.princeton.edu/~arvindn/publications/battery-s...
[5]: https://groups.google.com/g/mozilla.dev.platform/c/5U8NHoUY-...
[6]: http://www.forbes.com/sites/amitchowdhry/2016/05/25/uber-low...
[7]: https://github.com/mozilla/standards-positions/issues/459
[8]: https://twitter.com/rich_harris/status/1220412711768666114
At this point I can only assume that your conflating of security and privacy is pathological, and I very much doubt that we can have a fruitful discussion about this.
example.com wants to
Control and reprogram your MIDI devices (SysEx)
[Block] [Allow]
I am so glad both Apple and Mozilla doesn't subscribe to you or Google's definition of "security." These gaping security holes can cause so much damage, and to see these as "features working as intended" shows how disconnected you are with actual users. A browser should never ever include capabilities for full system compromise as one of its features. No permission prompt should ever let that happen.
You also need to consider the inherent danger of exposing hardware to websites when considering whether permission prompts are adequate. Again, hardware aren't designed with the expectation that they'll be exposed to websites. Browser vendors can't possibly be aware of the security implications of doing so for every device out there either. That was one of the core arguments of my previous reply and I wish you hadn't omitted that. Unfortunately, my point about the permission prompt was taken out of context and spun into a "pathological" view that "everybody in the world besides myself" would laugh at.
Lastly, you might want to actually look at the examples I posted. Some of them don't involve permission prompts and enables attack by third parties. Which I believe to be a security issue even under your terms.
They don't want to settle for a niche for academics, their mission is to be a popular mainstream browser (even if they're failing at that ATM).
I usually go to the url box to copy the url. one day, it suggested me to use a keyboard shortcut instead based on how often I did it. Little things like this that are built-in to the experience without having to install plugins and make sure they work together is a breath of fresh air.
See ARC browser. It's developed by a minuscule team but what they do is turn the experience of browsing the web into pure smooth pleasure. They will never in a million years gather enough talent to outcompete the V8 engine, but what they can do is develop better user workflows to empower them.
Firefox could be such a workhorse of a browser. They could add so many features to make the lives of academics, researchers, journalists and professionals in general better. Who cares if it's a bit slower than Chrome if it allows to efficently write my article or keep together the sources for my thesis?