Firefox 57: an overview of what's new (with resources)

One difference is, Smart HTTPS checks if a HTTP-website supports HTTPS. If yes, it is switching to HTTPS automatically else (if an error occurs) it reverts back to the HTTP address.

 

Yes, I know. I was actually interested in the advantages of HTTPS Everywhere. If there are any I fail to see them.

 

Me too - I switched to Smart HTTPS some time ago as, apart from anything else, it is a lot less memory intensive than HTTPS Everywhere.

On the wider point of this thread, I am really looking forward to FF 57 despite the issue with web extensions. In advance I have found suitable replacements for the few that were not compatible and for the only extension that I now need that will not be upgraded, I am using it in Waterfox which will act as an ESR release based on FF56 in due course.

Using Waterfox as an additional browser was mentioned a few weeks ago by someone on this forum and I can't recollect who - but thanks for the suggestion as I am finding this the ideal solution to my problem.

 

And some important add-ons like Noscript and Lastpass will be ready when FF57 final will be rleased according to their developers. It seems that more APIs will be added in the future which will satisfy the requirements necessary for add-ons which are not yet possible. So FF57 is not the end of the story.

I'm not saying that Waterfox is bad, quite the opposite. But I have several concerns about it:

1. That legacy add-ons will be still supported undermines the increased security of the new webextensions archtitecture which was a major rationale for its introduction (see post 1 of this thread).
2. Firefox ESR 52 will be the last version that supports legacy add-ons until June 2018. What will happen thereafter? Will there still be enough developers who offer legacy add-ons? Will the existing legacy add-ons still receive updates? Will there be enough people to vet those legacy add-ons in order to avoid (security/privacy) problems? I'm afraid that this problem will worsen over time.
3. As far as I know there is only one developer for Waterfox. Even if 99% of the code is still identical with FF - will he be able to maintain 150,000 - 200,000 code lines for various platforms in the long run? I doubt that unless he gets a large number of fellow soldiers.

 

Maybe this?

https://www.wilderssecurity.com/threads/waterfox.395479/page-2#post-2708905

https://www.wilderssecurity.com/threads/waterfox.395479/page-2#post-2711568

 

The LastPass WE beta is working fine on one of my machines

https://blog.lastpass.com/2017/10/lastpass-beta-firefox-57.html/

 

Yes those were the posts - many thanks paulderdash!

 

Have you read this?
https://www.waterfoxproject.org/blog/waterfox-55.0-release-download

I think it answers a few of your concerns.

 

But I do agree with @summerheat, #154.

I am also looking forward to FF 57 (except for absence of FaviconiseTab add-on in my case, which apparently can't be ported), and have been running WE-only profile for some time.

Waterfox just there to 'soften the blow' in the short term, if necessary.

 

Yes, thanks, I had read that. I'm not using it anymore, though, as I've switched to KeePass.

 

Hm, not really. I think this ...

... is even more problematic for a one-man (or very small) development team to accomplish.

 

Recently Mozilla changed their add-ons review system. Webextensions are automatically reviewed before they appear on AMO, and a manual review is done afterwards: "Human reviewers will look at these pre-approved add-ons, prioritized on various risk factors that are calculated from the add-on’s codebase and other metadata." The rationale for this move is that webextensions are much more secure than legacy add-ons.

While that is true, I'm sceptical about this change - and I'm not alone. Anyway, this should be a reason to think twice before adding an unknown add-on. A great help is the add-on Extension source viewer (homepage) written by Rob Wu who is a long time respected programmer who also adds to the Firefox code. This add-on shows a button at the right site of the location bar once you're on an AMO site. If you click it you have the option to download the respective add-on as a zip file or to directly view the source code in the browser (this is how I use it). I'm not a coder but looking in the *.js files if there any bogus links to 3rd-party websites should make you nervous.

 

I wonder if there's any way to tell when an add-on has had a manual review?

 

Thanks! That's most useful!

 

FWIW, the documentation for the API which makes it possible for add-ons to clear localstorage is available. Note that from FF58 it will be possible for add-ons like Cookie AutoDelete to clear localstorage by host which is something not offered by other browsers. Note also that it is already possible to remove localstorage whenever FF closes by selecting to clear offline website data in "about: preferences#privacy".

 

I've never used Smart HTTPS before so I'm not sure either.
Theoretically I can make a short comparison based on the info on their AMO page.
HTTPS Everywhere benefits:
-Rules have to be created first for websites, so you don't get problems with sites that are available over HTTPS but only work properly on HTTP.
-Doesn't need to try HTTPS version first so can be faster loading a HTTP page.(Of course this only goes for the first visit).
-It has a HTTP nowhere mode
-Trustworthy devs behind it(EFF).
-SSL Observatory(seems to be gone)
Smart HTTPS benefits:
-Lighter because it doesn't come with a huge ruleset
-It can force HTTPS on any site, as it doesn't need to be added to a ruleset first.

I remain with 2 questions:
-S-HTTPS caches the visited sites so it can remember if it supports HTTPS or not to make subsequent visits faster. Is this stored indefinitely and if not how long? If you visit a HTTP only site and it adds HTTPS later, S-HTTPS will still remember it as HTTP only while HTTPS-E might let you visit it over HTTPS a lot sooner due to new rules updates depending on the answer of this question.
-Does S-HTTPS also try to connect over HTTPS for 3rd party domains or just the main domain?

 

I will name a few:

- Bookmarks, history and downloads need to be tab-based (like in Opera 12 and Vivaldi)
- Double click to close tab (remove close button on tabs)
- Close tab to left or right
- Play audio only in active tab
- Paste and Go opens in a new tab
- Open new tab next to active tab

- One click bookmarking via favorite button
- Tab bar on bottom
- Mouse gestures

Must have extensions (not yet available):

- Download YouTube Videos as MP4
- I don't care about cookies
- Toggle HTML5 Video
- Image Autosizer
- Stylish

 

It seems that it's stored indefinitely. However, in its settings is a table that lists all whitelisted and blacklisted domains, and the default table size is 50 entries (you can adjust that). So I guess that older entries are removed (i.e are no longer cached) when new ones are added and that number is exceeded. There is also an optional setting to disable whitelisting HTTP protocols (only for domains added automatically). But this makes site loading a bit slower, of course.

Also 3rd party domains. There is also an optional setting to add upgrade-insecure-requests via a CSP directive:

 

BTW, to clarify, some of the features that I mentioned are provided by the Tab Mix Plus and Classic Theme Restorer extensions, but I much rather have them as standard features. And to answer your question, tab-based is not the same as the sidebar. Perhaps you should install Vivaldi to see what I mean. Upon startup you get to see speed-dial but you can also switch to bookmarks or history, very handy.

 

Okay, I see now what you mean. However, accessing bookmarks or history via the sidebar in FF (or directly accessing them with Ctrl-B and Ctrl-H) is nearly as handy, IMO. Or you can add the respective buttons to the toolbar as mentioned earlier. So this is no big deal for me. But each to his own.

EDIT: And regarding tabs management: I don't really care if it's built-in or offered by add-ons which might even be more flexible.

 

Actually, to me it's berserk that they have never bothered to offer a tab-based bookmarks and history manager. I suggest you check it out in Vivaldi to see what I mean. Also, I like to limit the amount of installed extensions, you shouldn't need extensions for stuff that is basic to me. For example, why not integrate the Lockbox password manager, see first link. BTW, don't know if this has been already posted, but seems like FF 58 will warn about Canvas fingerprinting.

https://www.ghacks.net/2017/10/27/mozilla-plans-four-new-firefox-test-pilot-experiments/
https://www.ghacks.net/2017/10/28/firefox-58-warns-you-if-sites-use-canvas-image-data/

 

Actually I did! And I really don't see it as a big advantage: It's only available when you start Vivaldi or when you open a new tab. While in FF the buttons in the toolbar and the shortcuts are always available.

 

I guess it depends on how you're using the browser. I basically start up Vivaldi/Opera 12, switch to bookmarks and leave the tab open. It makes it very easy to manage bookmarks. You can't really compare it with the sidebar or bookmarks button. I have checked out certain bookmarking extensions for FF and sadly enough none of them could provide this functionality.

 

I'm not yet sure that I understand. I tried it in Vivaldi and still can't see the benefits. Let's see: You keep one tab open that contains your bookmarks. So in order to open another bookmarked site you have to switch to that tab (first click) and click the selected bookmark - which means that the new site will open in that tab which previously contained your bookmarks. Those are gone unless you remember to middle-click it which would open the new site in a new tab - now you have 3 tabs open. In any case you need 2 clicks to open a new bookmarked site. Why is that an advantage over FF where you have the bookmark button readily available in the toolbar? I don't get it.

But hey - everyone has his/her own preferences how to handle those things. For me it's much more important the FF is considerably more configurable via about:config security/privacy-wise and that it's getting the Tor browser patches.