Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
Firefox 37 Release Notes (mozilla.org)
159 points by footpath on March 31, 2015 | hide | past | favorite | 94 comments


> Implemented a subset of the Media Source Extensions (MSE) API to allow native HTML5 playback on YouTube

This is great! Actually just today I was wondering why Firefox was still using the Flash player for Youtube. Now it isn't anymore :)


As far as I can tell, HTML5 playback has worked just fine in Firefox for a while (including HD), for any video that doesn't have ads. MSE just allows additional features in HTML5 playback, such as DASH (which dynamically adjusts bitrate to match available connection bandwidth/quality).

(Personally, whenever it fails, or sometimes even when it doesn't, I use youtube-dl.)


No, it didn't work for anything higher than 720p. For those Youtube requires using DASH + MSE.


I read this everywhere, but I am able to watch 1080p Youtube videos with html5 just fine since, yeahh... always, at least it feels like that. I tried it just a second ago. So it works definitively with Firefox 36 on Gentoo Linux.

What am I doing "wrong"? What am I missing here?


> I am able to watch 1080p Youtube videos with html5 just fine since, yeahh... always

Did you enable media.mediasource.enabled in about:config? Check it for Firefox 36, and if it's true, see if it's highlighted or not. If yes (and you are using the stock Mozilla build and not Gentoo custom one) it means you don't have the default.

Sure, you could enable it already for a while there, but it was buggy. For me the default was false. Strangely, it's false even in Firefox 37, which contradicts the release notes. But at least it works well now in actual videos when enabled.


You are correct. This is a screenshot taken on Firefox 36.0.4 on Ubuntu 14.04.2: http://i.imgur.com/XMIgQfi.png

As you can see, media.mediasource.enabled is disabled by default.


It's only enabled on Windows in this release. If you're on Linux or Mac that will probably why you are seeing the setting is defaulting to false.


This is correct. I haven't had flash on my computer for nearly a year and I've been able to watch hd youtube videos in firefox.


Youtube has supported HTML5 playback for about 4-5 years, though some videos do not.

There's a few plugins (eg: youtube-center) that let you play any video via the HTML5 player.

Personally, I got rid of flash sometime around 2011. The only side effect is firefox not crashing ever.

As a bonus, I noticed that a few months ago youtube added video ads that you can't skip to lots of videos (noticed it on my gf's iPad). You'll never have to deal with those with the HTML5 player (or maybe it's just adblock).


iPad uses HTML5 since there's no flash on iOS, might be your adblock.


Hm, I am still getting the flash player.

It does work if I disable Flash in the browser, but if it is enabled the videos are always played via the Flash plugin.

Is there some setting I have to turn on/off?


MSE support is Windows only for this release. You can turn it on for other platforms manually via an about:config setting but it is less tested.



Ever since YouTube switched to serving HTML5 video by default a few months ago, I've been unable to watch HD videos in full-screen mode at a decent framerate using Firefox on my Mac. Where by "decent", I mean > 0.5 FPS. As a result, I've started switching to Safari whenever I want to watch a video.

Firefox 37 seems to have fixed this issue for me.


You could disable Flash, but HTML5 without MSE only gave 720p max on Youtube.


Firefox was stuck on 360p html5 video before, I'm going to try this asap


So now Twitch is the only HTML5 holdout that I use on a regular basis... and the only reason I still use Chrome for anything.


Opportunistic encryption's really the big news. Will make the NSA's job harder.

Edit: Unfortunately, you must be using SPDY or HTTP/2 to use it. That's a real shame. I already had self-signed TLS and added the header, but then discovered it doesn't work with HTTP/1.1 (and with no good reason, either).


>(and with no good reason, either).

From their site:

OE is not available with HTTP/1 servers because that protocol does not carry the scheme as part of each transaction which is a necessary ingredient for the Alt-Svc approach.


Ah, alright. That's a shame. I hope they can come up with some way to do it.


The new Security Panel on the Network Monitor display seems helpful.

Even better, it seems that Firefox has finally stopped erroneously reporting that some pages with multimedia content served properly over HTTPS were only partially encrypted. This had been a long-standing issue and the early comments from developers were not promising, so kudos and my personal thanks to whoever has fixed this one.


It's frankly ridiculous how you guys criticize Mozilla for all these things, when they are practically the only organization in the whole internet which continues to value privacy.


Who is "you guys"? I personally applaud Mozilla for their stance on many things. Especially for allowing/enabling things like NoScript. However, I must admit that this has a practical limit, at least for me. Without per-process tabs (or similar) Firefox will start to lag more and more behind modern browsers and at some point the deficit will become insurmountable. (I realize the difficulty of achvieving this, but as a practical matter, it must happen, otherwise...)

EDIT: I should say that I usually keep Firefox open for days (with only ~30-40 tabs) and at some point it starts consuming unreasonable amounts of CPU just... idling (apparently).


> Without per-process tabs (or similar) Firefox will start to lag more and more behind modern browsers and at some point the deficit will become insurmountable. (I realize the difficulty of achvieving this, but as a practical matter, it must happen, otherwise...)

Why? Setting aside that, as the sibling comment points out, Electrolysis is on the roadmap, why? I use Firefox every day with dozens to hundreds of tabs in 1-2 windows and the fact it's not process-per-tab has never bothered me or even been something I noticed. Sure, it's nice to have theoretically; if the browser crashed all the time then sure, I'd like to have just one tab go away instead of session-restoring the whole thing, but that's a minor convenience, and according to about:crashes, it's only happen about two dozen times in two years anyway. On the other hand, it's nice that, despite having 32 tabs open right now, Firefox is only using 210MB of memory.

There are advantages (stability, sandboxing) and disadvantages (memory usage) to the process-per-tab model. I think there's a fair argument that Mozilla should implement it in Firefox, but I don't understand in what sense Firefox would be lagging behind other browsers if they didn't implement it. The Ideal Browser does not necessarily require process-per-tab nor is there some Ideal Browser all the browsers are converging to that Firefox is further behind on.


It's not the "process-per-tab" thing per se that's important. It's just that (as I believe I mentioned in my OP) Firefox starts to just constantly consume non-trivial amounts of CPU after some amount of time[1]. Not sure why it does this, but process-per-tab would at least mitigate the problem by offloading the whole "free resources" problem to the OS (which must be able to do these things reliably).

(I have oodles of memory and CPU, so it's not just a lack-of-resources problem.)

[1] EDIT: I'm talking about something like 30-50% of a single CPU. In extreme cases it would use 100% of one CPU, but those are admittedly outliers.


While it would be nice for Firefox to have something in-place like per-process tabs that could mitigate the problem, I think what really needs to happen in this case is that they fix the underlying issue - which, true enough, might be a while; it doesn't happen for me, even though I leave Firefox open for about a month at a time (rebooting on patch Tuesday), so I assume it isn't easily reproducible and therefore might go some time without being fixed. Even if you had per-process tabs, I'd expect that one tab would still be using 30-50% of the CPU and thus be a major nuisance, even though it might make the rest of the browser more usable.


It's completely trivial to write a "consumes-100%-CPU" JS script. I'm sure people usually don't do it intentionally, but I happened to encounter two such scripts on two separate domains today[1]. The surprising thing is Firefox managed to kill the first one, but not the second one -- after being completely unresponsive for 30s, mind you. It just hung when I pressed the "Stop script" (or whatever the button was labeled). Had to kill the whole FF process and restart it, being quick to close the two tabs that were causing trouble.

This is absurd. Apart from anything else FF needs to be better at protecting its users, and that includes separate-process-per-tab. (Ideally, it should be sandboxes, but honestly I'd settle for "separate processes" at this point in time.)

[1] One of them was http://www.xojane.com/


Mozilla's per process project is called 'Electrolysis'. It's been in the works for years, but Mozilla is saying that it's going to be released (in not beta form) later this year. https://wiki.mozilla.org/Electrolysis


Yes, I'm familiar with it. (Should probably have mentioned it explicitly, sorry about that.)


>Yandex set as default search provider for the Turkish locale

Interesting. Looks like Putin's relationship with Erdogan gets cozier all the time. Yandex has a very strong connection to Russian intelligence services:

http://www.bbc.com/news/business-13274443


Hum, never though of it this way. It also make business sence since Yandex strength is probably the handling of complex language in information retrieval. I always though the angle was to then address middle-east market with better indexing/search of Arabic content. Now, it's not impossible there is a political angle to it.


This may be, but what has it to do with Firefox?

Doesn't Mozilla decides for itself, which default it sets?


Is Yandex paying Mozilla to be the default for Turkey?


That's usually how these deals come about. No figures were revealed in the press release, but it should eventually become public in their yearly IRS filing.


Well, probably. Yandex has been active in the market here in Turkey, offering its services including a map with street views. They also put up ads on TV and billboards.


Doesn't DuckDuckGo use Yandex's search results?


So, Mozilla wants to change the ad industry, while preserving user privacy?

https://careers.mozilla.org/en-US/position/oXqA0fwH

I am extremely curious to find out what exactly do they have in mind here?


Perhaps relates to sponsored tiles,

https://www.mozilla.org/en-US/firefox/tiles/

I believe those allow advertising without tracking of users.


Don't forget to check the Firefox 37 for developers [0] page which has more detailed info (it's linked from the sidebar of the public release notes).

[0] https://developer.mozilla.org/en-US/Firefox/Releases/37


I understand that the Heartbeat user rating system can be disabled, but I'm still very much against it and think it will drive a lot of less technically-savvy users mad. I honestly thought it was an April Fools joke at first through reading it.


I wondered what that `Hearbeat` thing was so for once I checked the release notes and https://wiki.mozilla.org/Advocacy/heartbeat#Experience_Flow

> Every day a random subset of users are offered a rating widget

> After rating Firefox, an ENGAGEMENT page may open in a background tab.

That's... not the phoenix I signed up for.


Even when it was Phoenix, the branding or whatever you want to call it was to focus on users. Compared to Mozilla/Navigator that meant stripping out a whole lot of stuff, but an effort to find out what their broader set of users want is not incompatible with the original mission.

(I'm sure I'll toggle this off)



Just wondering, what do you find so problematic about it? These kinds of rating prompts are extremely common in the mobile app space. They work there, presumably, or they wouldn't be so common. Why don't you think the idea will work here?

I'm a big fan of Firefox, and I would find being prompted to provide them with useful feedback a positive experience.


There are a lot of things that work in the mobile space that are use-hostile. The only reason they work is due to limited choice (or at least the perception of limited choice). Ads popping up in between games is common, let's support Firefox by randomly disabling the pop-up blocker. IAP is common, let's give users the ability to view static sites, but CSS is ten sites for 99c, Javascript is five sites for $1.99, or you can get it all for $99! Subscribers get SSL added on for only $15/mo.


The check-in URL for heartbeat seems to be HTTP ("http://self-repair.mozilla.org/%LOCALE%/repair"). Will Firefox 37.0 automatically convert that to HTTPS (HSTS preload, etc) or is there an insecure redirect lurking?



Is the 'mozilla-release' branch for the current 37.0 release? It shows 'http' instead of 'https': https://mxr.mozilla.org/mozilla-release/source/browser/app/p...


You're right. It was changed to https in https://bugzilla.mozilla.org/show_bug.cgi?id=1138323 and will only end up in Firefox 39


Ah, I see. Thanks! Too bad it didn't land for 37.0 but glad to see it fixed for the future


And sigh, yet something else I'll have to disable (or remember to disable) on new installs and upgrades. I wonder if non-savvy people will be able to figure out how to disable it so it doesn't interrupt their time on the internet.


Yikes. At what point will people start backporting security fixes to an older version of Firefox, to avoid the forced bundling of unwanted browser "features"?


I realize that you are just making a snarky dig, but probably never. It would be a huge amount of work just to backport basic security fixes, and almost impossible to backport large architectural changes that are made in the service of security. Are you going to backport multiprocess Firefox once that is working?

It is much easier to flip a preference. If you wanted to get sophisticated, you could create an addon that disables all of the preferences you dislike.


> you could create an addon that disables all of the preferences you dislike.

That's a good idea. Another option is to patch the code to remove the new features, unless Mozilla has taken steps to deter unbundling.


Mozilla is very protective of the Firefox trademark. They don't even use it for their own nightly builds, because they want people to associate "Firefox" with stability. So they make it very easy to unbundle.


Will setting the about:config option to disable be preserved across browsers with firefox sync?


It will if there's a corresponding services.sync.prefs.sync.the.pref.you.want.synced.here pref set.


There's an opportunity cost to supporting older versions. Sure, there's always going to be a small group of people who are happy with what they currently have but most people are happy moving forward.

If there's a big enough market, perhaps some company will backport the security fixes. How much are you willing to pay? Another option is that you could volunteer and start the fork.

Of course, there's that other problem where developers are only going to support the latest browser.


A functional subset would not be a fork. If users were given a choice, we would find out which version they considered best aligned with the brand.


You aren't being clear. Do you think that older code that gives older functionality doesn't ever get changed? Patches will have to be created, etc. It's not trivial work. And as I mentioned, web developers aren't going to support the older CSS/HTML/JavaScript in your older browser.


Lack of clarity was due to sibling comment. Repeating here: an option is to patch the current code to remove unwanted new features. This provides users with current features, e.g. CSS/HTML/JS and security fixes, a "minimal build" of the browser.


I just added Firefox 37 to Browserling. If you don't want to install it, you can try it live in your browser at this address:

    https://www.browserling.com/browse/firefox/37/news.ycombinator.com
We've 3 servers handling demo sessions so you may have to wait in the queue to try it.


MSE on Youtube at last.

UPDATE: Strangely, media.mediasource.enabled still remained false for me in Firefox 37 (Linux). I had to manually set it to true, and it's highlighted, meaning that default is still false... Not sure how it fits with release notes then.


MSE is only enabled by default on Windows for this release. You can enable it manually for other platforms via the about:config setting.


Was it still buggy on Linux? Release notes mention some other points as relevant to the Windows version only, so it probably made sense to mention it for MSE too to avoid confusion.


Not so much buggy as less tested. I use it on my linux laptop and have relatively few issues.


Release notes have been updated to say Windows only now.


Thanks!


On a Windows 8.1 machine with FF37, I get "An error occured, please try again later." for all videos on YouTube. Disabling media.mediasource.enabled in about:config fixes the problem. Anyone else?


Do you have any addons related to video or blocking? You may need to unblock mediasource support in noscript.


Yes, NoScript blocked it. Thank you!


There is a media.mediasource.youtubeonly which is default True for me.


Yes, it is set to true, but without media.mediasource.enabled set to true it doesn't matter, since the later switches MSE on and off generally.


"display: contents" is an interesting addition. It appears to take an element out of the tree, replacing it entirely with its children.

Anyone have any thoughts on what that could be used for?


Think a web component that you want to lay out as two table cells. The component has to be attached to an element, but there's no way to make a single element be two table cells right now. With display:contents you make the element the component is attached to display:contents, and give it two display:table-cell kids.


Sometimes I'm stuck littering the DOM with random <div> or <span> tags for conditionals and whatnot in various templating engines.

ng-switch in AngularJS, for instance, is going to leave a wrapping tag for the switch declaration.

https://docs.angularjs.org/api/ng/directive/ngSwitch


This would be useful if you were making UI components and you want a generic wrapper element to contain say a checkbox and a label. The wrapper can have display:contents, allowing the checkbox and label to have a shared parent for movement through the DOM or selection via JS, but otherwise have no styles that apply to their parent.


I imagine you can use it to ensure that elements that are added simply for semantic purposes (like, say, containers for other elements that are there just to group them logically) do not create any boxing side effects, like default padding and similar non-obvious CSS buggery.


I fear that now we will just replace it with another set of non-obvious CSS behavior. Consider, does this property nest well? How does absolute positioning work against something like this? Do they just ignore the parent box, since they are replacing it?

Undefined or Browser specific. Or just a further explosion of the spec?


All of this is defined in the spec. display:contents just means that in the box tree the box is elided and its child boxes are placed where it used to be, and then things proceed as normal.

If you have nested display:contents things, it just works: you end up with a box and what used to be its great-nephews/nieces in the same flat list is all.


My point is really that I am not even sure what I would expect to happen in such cases. To the point that I will find it hardly surprising when developers on a browser inevitably makes a mistake in implementation.

So, yes, this may all be there in the spec. But this is really just making the spec larger and larger with what seems to be nominal, if not decreasing, gains.


> My point is really that I am not even sure what I would > expect to happen in such cases.

The same thing as happens if you just delete the parent element from the source (if we ignore for the moment selector matching and inheritance).

> with what seems to be nominal, if not decreasing, gains.

display:contents was pretty commonly requested by component authors who want their component to fit into a larger layout framework (flex, grid, table) as more than one layout unit. I agree that if you're not trying to author components it's of pretty limited utility.


Possibly spec explosion but it is there:

http://dev.w3.org/csswg/css-display/#the-display-outside


It's not uncommon to want to wrap some component in a container for neatness of source/easier manipulation from JS. But this means the container won't break anything.


They disabled insecure TLS version fallback. Older versions of the Certicom TLS stack used in older versions of WebLogic are affected for example (change to JSSE).


The next release (in six weeks) will also disable RC4 fallback, except for a few sites which are on a whitelist for one release after that.


Working great on Lollipop here. Prior version was crashing quite a bit.


I'm about to give it up on Android again.

Nice browser. Better than Chrome. But the UI sucks. First they managed to have a different UI on tablets (phone: Tab button in the upper right corner, upper left on the tablet). Then they iterated and came out with a new (and soon to be if not already) mandatory tablet UI that just .. well .. it's bad.

I still regularly try to open a link in a tab and hit 'share', because at some point in the past they decided that the menu on a link should be

- share

- open in tab

- open in private tab

etc.

I'm a fan, use it on the desktop, wish that FxOS succeeds - but Fennec is a constant nuisance and complete UX failure for me.


> I still regularly try to open a link in a tab and hit 'share'

You can use this add-on to fix it (Yes, I'm author of it)

https://addons.mozilla.org/android/addon/share-to-bottom


I cannot even begin to express how great this looks. I hit that again and again and .. it's a papercut, but so damn annoying. Thank you. Very much appreciated.

(Now, is there an addon to fix the tablet UI back to 'simple'?)


Thanks for fixing my only niggle with Android Firefox!


The main problem on Android for me is that there's absolutely no way to download a file. Chrome has Save Link As option for links, but Firefox does not.

It's interesting that you can still download videos if you let them play and then hold the finger in the middle of the video until a menu pops up and you can Save it from there. So the download functionality is there, it just isn't exposed.

This is a shame, because that download function works much better than the one in Chrome (with Firefox, you can pause/continue).


> The main problem on Android for me is that there's absolutely no way to download a file.

That's really odd given that Android has a proper filesystem that applications can (and do!) access.


Yeah the ui is kind of hit and miss and performance not quite as good but it's getting there and we can have add ons!

Wish I had the time and drive to contribute to the ux - truly appreciate having the option of independent browser on mobile device.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: