
Firefox 76 - kalimatas
https://www.mozilla.org/en-US/firefox/76.0/releasenotes/
======
leeoniya
i just want to say, Firefox is seriously fast now, while Chrome continues to
get slower [1].

my 10M datapoint uPlot benchmark runs in half the time, for both pure js (fake
data gen) and canvas workloads (chart rendering). check out the console in
[2].

however, i'm still waiting for the performance assessment in devtools to
improve so i can get an easy summary as i can in Chrome.

also, better default form input styling would be nice. it's so...Windows
98....but i'm on Windows 10. :\

[1] [https://github.com/krausest/js-framework-
benchmark/issues/68...](https://github.com/krausest/js-framework-
benchmark/issues/683#issuecomment-616080615)

[2]
[https://leeoniya.github.io/uPlot/bench/uPlot-10M.html](https://leeoniya.github.io/uPlot/bench/uPlot-10M.html)

~~~
skykooler
It seems that it's faster on every website I use except Gmail, Google Voice,
and Youtube. I wonder whether Google is using some sort of Chrome-specific
javascript to make those sites run faster in their own browser?

~~~
kroltan
I'm not sure if this is still the case, but Youtube used to use WebComponents
v0 which has to be emulated in JS in non-Webkit browsers, since only Google
ever implemented v0, while everyone else agreed it required a bit more work,
and other engines run v1 instead, which is not compatible.

~~~
konart
Youtube was updated to the v1 quite some time ago with a fresh Polymer version

>Polymer.version

3.4.0

Polymer uses v1 WCs since Polymer v2

~~~
kroltan
Thanks! I had no idea how to check if it was still the case.

------
amartya916
Thank you to the Firefox team, this seems like a really nice release. I am
very happy about the "If you don’t have a master password set up for Firefox,
Windows and macOS now requires a login to your operating system account before
showing your saved passwords." change. It might seem like a small change, but
it's one of those friction points (another password to remember!) that will
lead to (hopefully) more people using the built-in password autofill. Thank
you again!

Anyone with a security background or someone who has thought through this
more: what are the implications of making the OS level authentication the
default, and then only ask to make a master pwd if there are no OS level login
pwds? Is one or the other more secure?

~~~
joveian
Personally, I don't like operating systems that train users to enter login
credentials while using the system as this increases the chance of someone
capturing those credentials via spoofing.

I used to think Firefox trying to protect the entered passwords made some
sense, but I've been convinced it isn't really such a good idea. Better would
be a full profile being protected (with all files encrypted), or just rely on
an OS level lock screen for inactivity lockout.

I'm not sure if the current system actually prevents recovering the passwords.
Do they require this authorization even to use a show password option on a
website or the equivalent effect via bookmarklet-style javascript? I suspect
they don't and it doesn't try to protect from intentional theft only casual
viewing of passwords. This might still be valuable for some people, but it
would be more valuable to fully protect the profile. I worry that people will
think they are more protected than they actually are and that this effect will
be increased by the use of system login credentials.

Also, IMO the list of sites that you have passwords for should be treated as
just as sensitive as the passwords themselves. I think as is you can often see
the sites with accounts, visit them, and have the current password autofilled
into the old password field of the change password dialog.

The "generate password" option is great, even though personally I would make
it 21 characters rather than 15 (there might be an option for that?). IMO, no
one should ever choose a password.

~~~
Fnoord
If an adversary can get user access, they generally are able to also get root
access (via social engineering or a local vulnerability). They'd also be able
to read the memory of the web browser, or file contents. This is because on an
average desktop, all the programs running as user have read/write access to
each other.

On mobile OSes, capabilities are enabled by default. Even Symbian already had
such. OpenBSD utilizes pledge to minimize impact.

~~~
thayne
> all the programs running as user have read/write access to each other.

On many linux distributions this is not the case as yama ptrace_scope is
enabled by default.

------
Wowfunhappy
> The shadow around the address bar field is reduced in width when a new tab
> is opened;

I mean, at least they're trying, I guess. Still seems to me like lipstick on a
pig.

I'm still trying to figure out what UX problem the expanding bar was intended
to address.

~~~
ttctciyf
In the last update (75) I had this bizarre problem that any amazon.co.uk links
in my history weren't showing up in the "most used links" that the url bar is
usually populated with if you click the down arrow (or in this update where
the down arrow used to be)

I have a browser profile that is used almost exclusively for amazon content as
well. The most visited links in that profile are amazon.co.uk and prime video
but the only "most frequent" links it would show were on twitch and the
occasional youtube page I visited to find trailers for amazon hosted videos.

When I went to about:config and toggled the four "update1" bools to false,
amazon came back in my "most frequent" links.

Pretty strange, eh?

Edit: so I just installed 76, and switched the four "browser.urlbar.update1"
bools that enable this back to "true", and again, any amazon.co.uk links are
removed from the list I get when clicking on the empty urlbar.

I don't really care about the ugly styling, but since this is a navigation
feature I use extensively, I'm turning the whole thing off again. Hope they
fix (or document) this before the choice disappears!

~~~
ubercow13
Wow that's sad. Firefox's URL bar completion behaviour was one of its biggest
advantages over Chrome. I wonder what the logic behind changing it is, and if
it will lose that edge.

~~~
ttctciyf
Well, not strictly the completion - it's the behaviour when you click on the
urlbar before typing anything.

Normally (in my setup) it shows a list of "most visited" urls.

The new behaviour is to still show this list but omit any amazon.co.uk (and
maybe other, I have no idea) urls.

Completion works as expected as far as I know.

------
CameronNemo
>Firefox now supports Audio Worklets that will allow more complex audio
processing like VR and gaming on the web; and is being adopted by some of your
favorite software programs.

> With this change, you can now join Zoom calls on Firefox without the need
> for any additional downloads.

~~~
m_eiman
Does anyone know if this is something that will benefit Jitsi too?

~~~
padenot
Jitsi doesn't use AudioWorklet as of now (and doesn't need to).

We're continuing the work so that jitsi works well in Firefox, there are a few
things remaining, but less so than a few weeks back (I'm more on the audio
side, and those issues are mostly signaling or networking related).

------
Someone1234
In the security bug fixes:

>>> CVE-2020-12387: Use-after-free during worker shutdown

>>> Impact: critical

>>> A race condition when running shutdown code for Web Worker led to a use-
after-free vulnerability. This resulted in a potentially exploitable crash.

And:

>>> CVE-2020-12388: Sandbox escape with improperly guarded Access Tokens

>>> Impact: critical

>>> The Firefox content processes did not sufficiently lockdown access control
which could result in a sandbox escape. [On Windows]

So a sandbox escape and a way to be in a position to need a sandbox escape.

~~~
cesarb
> CVE-2020-12388: Sandbox escape with improperly guarded Access Tokens

Perhaps it's the same as the Chromium one reported here recently?
[https://news.ycombinator.com/item?id=22945630](https://news.ycombinator.com/item?id=22945630)

------
influx
Firefox made a huge mistake following in Chrome's trail with the version
numbering scheme. I just don't care about Firefox 76, is it a big change? Is
there some new feature I would want to try? Who knows, I'm sure Firefox 77
will be out soon though!

~~~
chrismorgan
I want to figure out who to talk to on both Firefox and Chrome sides to _beg_
that they adopt a scheme like YYYY.MM.minor for their version numbering. I
believe that would be superior for basically _everyone_ —web developers,
users, _& c._ (In the case of Firefox, it works especially well since they’re
releasing approximately monthly now. I could imagine people on Chrome puzzling
over why some month numbers got skipped—not that people actually look at those
numbers often.)

~~~
roca
Releases are almost always date-based, but once in a while a release is
delayed. I guess that's a bit easier if the release number is not a date.

~~~
glandium
There's also the fact that Firefox is now on a 4 weeks release cycle, which
means there will be months with two releases. (and that's ignoring chemspill
releases)

~~~
afiori
Then if not year.month they can use year.counter where counter goes from 1 to
14 = ceil(366/28)

------
nunodonato
> Firefox displays critical alerts in the Lockwise password manager when a
> website is breached;

>If one of your accounts is involved in a website breach and you've used the
same password on other websites, you will now be prompted to update your
password. A key icon identifies which accounts use that vulnerable password.

this is great! thanks :)

~~~
rasengan
How exactly does this work?

~~~
metalliqaz
They check against a database similar to
[https://haveibeenpwned.com/](https://haveibeenpwned.com/)

~~~
dblohm7
They check against the HIBP database itself.

------
dustinmoris
I love Firefox and use it as my primary browser for years but few things which
annoy me:

\- Sending tabs between devices does not work. It sometimes arrives 12
hours!!! later

\- Google Cloud Console has some UI issues on Firefox

\- Twitter input field behaves extremely strangely when you enter an emoji and
try to edit text afterwards

\- I don’t understand why some html elements have a different appearance and
default css attributes on Firefox mobile vs desktop

~~~
maps7
Sending tabs works fine for me

~~~
afiori
which systems do you use? I generally see more delay from android to linux
than from linux to android for example.

------
thomasedwards
I really want to use Firefox, but they’re just stuck with so many issues, then
suddenly out of nowhere they make the address bar massive.

My personal annoyance, on macOS:

Cmd+Click a link: \- Safari, opens in tab in background \- Chrome, opens in
tab in background \- Firefox, opens in tab in background

Shift+Cmd+Click a link: \- Safari, opens in tab in foreground \- Chrome, opens
in tab in foreground \- Firefox, opens in tab in foreground

Cmd+Click a bookmark: \- Safari, opens in tab in background \- Chrome, opens
in tab in background \- Firefox, opens in tab in foreground

Shift+Cmd+Click a link: \- Safari, opens in tab in foreground \- Chrome, opens
in tab in foreground \- Firefox, opens in tab in background

For some reason it’s different for the bookmarks. I opened an issue
[https://bugzilla.mozilla.org/show_bug.cgi?id=1597910](https://bugzilla.mozilla.org/show_bug.cgi?id=1597910),
because really there is no actual reason to make them different, but it was
closed on the basis that it might disturb the muscle memory of some users. But
changing the entire menu bar is completely fine?

------
stuzenz
Hearing good things about firefox performance vs. chrome in this thread, I
thought I would have a look at firefox use of rust - I found this informative
page which provides a lot of rationale for where rust has been used:
[https://wiki.mozilla.org/Oxidation](https://wiki.mozilla.org/Oxidation)

Here is a cut of what was introduced in Firefox 76 (copy&paste)

Integrate fluent-rs, a localization system: bug 1560038 (shipped in Firefox
76)

Why Rust? Performance and memory wins are substantial over previous JS
implementation. It brings zero-copy parsing, and memory savvy resolving of
localization strings. It also paves the way for migrating the rest of the
Fluent APIs away from JS which is required for Fission.

------
psandersen
I wish there were more options to control tab priority and UI latency in
firefox.

I have a respectable (2x8 core xeon, 164gb ram) workstation running linux and
I have many tabs/windows open with various references spread across virtual
desktops optimised for tasks (work project 1, 2, education, personal
project,... etc).

I've experimented with various extensions that pause tabs and currently use
tab wrangler to auto-close tabs but it still gets slower to respond with ~50
tabs open across all windows. Sometimes I check the firefox & system task
managers to see some basic reference tab (i.e. blog post) taking most of the
CPU...

It would be great to be able to aggressively throttle inactive tabs or even
pause them completely so only ram is used.

Some options around this use case would be much appreciated. Responsiveness
under (almost) all conditions is much more important than raw benchmark
throughput. Near instant tab resuming would be a huge help towards this goal
as well.

------
narag
Anybody using Firefox password manager that can comment on it? Is it
considered safe enough?

Are the passwords stored remotely if you have multi-device profiles?

Edit: I asked because I see that some of the updats are related.

~~~
baal80spam
Maybe it sounds silly but make sure you have access to the email associated
with your Mozilla account. I learnt the hard way after reinstalling Windows
that Mozilla sends a confirmation email to this address when you set up Sync
on a new system. It turned out that I had no access to this email anymore
since the provider went out of business. I was told it's impossible to access
my sync data. Thankfully I did not use it to store any passwords (I use
KeePass for that) because otherwise it would have been a catastrophe.

~~~
roter
There is a "Secondary email" option in Firefox Accounts. You can also set a
"Recovery Key".

------
xpressvideoz
> Audio playback is currently not working when running the 32-bit Windows
> version of Firefox from a network drive.

This is a very intriguing bug. How could it be affected by running on a
network drive?

~~~
cpearce
Smells like a sandboxing issue to me.

------
chimen
There are 2 things I miss from switching to FF:

Right click on a picture -> search google for image Right click -> Translate
page

Everything else seems smooth enough.

~~~
ConsiderCrying
I sorely miss the ability to make my homepage a layout of the sites I visit
daily. On Chrome I had this grid of most frequented sites that I set up
myself, fine-tuned so I could launch Chrome and immediately open up any mail,
read the news, check some of the blogs I read, etc. On Firefox, I've been
using bookmarks but that's not as effective.

~~~
asadotzler
I could be missing something but in case I'm not. You can enable Top Sites and
customize them to your liking by removing ones you don't want and pinning the
ones you do.

~~~
ConsiderCrying
Ohh, that's what I was missing. Thank you, this is a huge quality of life
improvement.

------
sj4nz
So far my only gripe for picture-in-picture is no closed captioning from sites
like YouTube. Otherwise, fantastic as has been usual for Firefox.

------
trashburger
Is the simulcast feature added in yet? I want to ditch Chromium that I only
ever use for Jitsi already.

------
imagetic
I have been loving Firefox for the last year. The only shortcoming for me is
that video playback and animation playback (svg/js) is highly CPU intensive in
comparison to Safari/Chrome. I basically open Chrome to watch any videos.

------
shmerl
Looking forward to WebRender starting using Vulkan instead of OpenGL on Linux.

------
ChrisRR
And yet they still haven't added the feature to globally zoom, instead of per
website. This is the only thing that keeps me using chrome

~~~
kasabali
It exists since the very first Firefox version (and probably even before)

After Firefox 3 (which introduced site specific zoom feature) you can set the
below config option for old behavior

[http://kb.mozillazine.org/Browser.zoom.siteSpecific](http://kb.mozillazine.org/Browser.zoom.siteSpecific)

~~~
ChrisRR
I've tried that in the past but it never seems to take effect. I don't know if
there's some other config overruling it

Edit: That doesn't look like the config I'm thinking of. That appears to
change to zoom for the current active tab, rather than per site. The config
I'm thinking of changes zoom for every site

------
bsdubernerd
Can I abuse an Audio Worklet to get around timeout throttling? What's stopping
me to do so?

------
jbverschoor
Scrolling is still choppy compared to safari and even chrome

------
graphqldemo
Address bar had been screwed in the version 75. I hope it has been fixed in
this one.

------
sandworm101
Lol. On first glance I read "Fallout 76".

------
antisocial
I just switched to Safari - to be able to set time limits to websites on my
mac, as I am consuming too much news these days. This is not possible with
Firefox as far as I know.

~~~
garrettr_
There are numerous Firefox add-ons that provide this feature, e.g.
[https://addons.mozilla.org/en-US/firefox/addon/leechblock-
ng...](https://addons.mozilla.org/en-US/firefox/addon/leechblock-ng/). IMHO,
the main benefit of using Safari/Screen Time for this is that it automatically
syncs the same limits across all of your iCloud-connected devices, which is
great. I know Firefox has a Sync feature but I'm not sure if any of the add-
ons leverage it to provide a similar seamless cross-device experience.

------
pmlnr
I've literally just installed 75...

------
jhymn
Whenever I start up Firefox it tells me to wait a few moments while it
updates. The browser obviously doesn't care about me. It has its own agenda.
This is why I won't use it.

~~~
rad_gruchalski
Have you heard of "Check for updates but let me choose when to install them"
option under about:preferences > Firefox Updates? I assume you did not.

~~~
guug
To be completely fair, reading every option under about:preferences is not
part of the average user's workflow.

~~~
rad_gruchalski
True, it's probably much easier to search for "disable firefox auto update"
using your fav search engine.

