Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Firefox Mozilla

Firefox 85 Isolated Supercookies, But Dropped Progressive Web App Support (thurrott.com) 72

Posted by EditorDavid from the additions-and-subtractions dept.
Tech blogger Paul Thurrott writes: Firefox 85 now protects users against supercookies, which Mozilla says is "a type of tracker that can stay hidden in your browser and track you online, even after you clear cookies. By isolating supercookies, Firefox prevents them from tracking your web browsing from one site to the next." It also includes small improvements to bookmarks and password management.

Unfortunately, Mozilla has separately — and much more quietly — stopped work on Site Specific Browser (SSB) functionality... This feature allowed users to use Firefox to create apps on the local PC from Progressive Web Apps and other web apps, similar to the functionality provided in Chrome, Microsoft Edge, and other Chromium-based web browsers. "The SSB feature has only ever been available through a hidden [preference] and has multiple known bugs," Mozilla's Dave Townsend explains in a Bugzilla issue tracker. "Additionally, user research found little to no perceived user benefit to the feature and so there is no intent to continue development on it at this time. As the feature is costing us time in terms of bug triage and keeping it around is sending the wrong signal that this is a supported feature, we are going to remove the feature from Firefox."
Thurrott's conclusion? "Mozilla is walking away from a key tenet of modern web apps and, in doing so, they are making themselves irrelevant."
This discussion has been archived. No new comments can be posted.

Firefox 85 Isolated Supercookies, But Dropped Progressive Web App Support More

Firefox 85 Isolated Supercookies, But Dropped Progressive Web App Support

Comments Filter:

  • "a key tenet of modern web apps"? (Score:5, Interesting)

    by udittmer ( 89588 ) on Sunday January 31, 2021 @07:58AM (#61011914) Homepage

    That seems hyperbole. As I understand it, Firefox is not removing support for any of the APIs that constitute PWAs, they're merely removing the option to save double-clickable app shortcuts on the desktop. You can still use the actual PWA after finding it via a bookmark instead of a shortcut, for example. Seriously, how many non-techies use the desktop shortcut feature? (But then, how many non-techies still use Firefox? And I say that as a hardcore Firefox and Mozilla user for 20 years.)

    Have I got that wrong?

    • I think the need here with the shortcut is more for mobile than desktop.

      • I think the need here with the shortcut is more for mobile than desktop.

        Yes, that's where it really makes sense. On the desktop using bookmarks is no big deal. On mobile you really want to be able to hit an icon to take you to the web app, so you don't have to squint at your browser to get there.

      • Windows 95 already had bookmark files. IE used to store its bookmarks as small files in folders. Which was the only thing I liked about it, since it made bookmark management a trivial file management task, instead of creating duplicate functionality.

        And since IE had no tabs back then, with every page being opened in a separate window already, avoiding another stupid duplication called a "tab bar", which is just a second level of a hierarchical task bar with a better layout where you don't have to click to s

      • Re: "a key tenet of modern web apps"? (Score:5, Informative)

        by roca ( 43122 ) on Sunday January 31, 2021 @02:11PM (#61012680) Homepage

        Yes, and it's still there on mobile! The removal of SSB is only for the desktop.

    • Personally this is the one feature that is great in almost every other browser, because they are based on chromium.

      Unfortunately, it's the one feature that makes using apps that are based on web technology, desktop integrated.

      Bookmarks open in a browser window, giving you a number of tabs to deal with.

      SSBs should give you individualized windows, WITH THEIR OWN ICONS, that help distinguish app from content portal.

      To me, Mozilla never even tried to make this functionality usable. So it's not a wonder why they

      • Just install Internet Explorer 4 then. ;))

        Or go all the way, and run a terminal emulator, to connect to your massa Google's mainframe. And whore all your privacy away, whole enjoying shitty interfaces that re-invented the wheel, but made it worse, by merging it with Vogue magazine page layout. Unless your connection cut out again. Or Google discontinued the service. Or they start removing features and adding price tags. But not removing the manipulative rip-off-inducing pictures ("ads").

        I just wonder why yo

        • I'm curious why you would deny my attempt to be a person. What a toxic environment this /. has become.

    • PWA seems a vague buzzword. It's good to make it easier to run & cache web-based apps locally and have access to local resources, such as phone-cams (when approved by user), but that's more about browser or HTML feature addition than a "packaged" standard.

      Perhaps Firefox should try to establish related feature standards for browsers and OS's. Otherwise the big dogs such as Google, Apple, and MS will get too much say.

      • So you're proposing they do develop PWA support but require an developers to use a totally different mechanism from Google, Microsoft and Apple?

        Why not go a step further? Screw those big controlling companies, Firefox should have its own makeup language! And its own scripting language! Websites on Firefox would be so much more free of large corporate influence if Firefox rejected all standards!

    • Re: (Score:2)

      by AmiMoJo ( 196126 )

      Site Specific Browsers is the Mozilla PWA implementation so it sounds like they are ditching support for PWAs entirely from desktop. Mobile will, apparently, still be supported.

      PWAs are most useful on browsers where they are a nice way to get around Apple's walled garden or remove the need to side-load on Android. On desktop though there isn't much benefit since there are usually no barriers to installing native apps.

      On desktop a normal website is a better option for most people. PWAs just take functionalit

    • Re: (Score:1)

      by giuntag ( 833437 )
      Yes, you have it wrong.
      "PWA" here means not only 'put a shortcut to an url on the desktop", but also: open that site in its own window instead of any currently open browser window; give it its own application icon; reduce the chrome so there is no url bar displayed or back/reload buttons, etc...
      This is quite handy for those people who keep a handful of such "pwa apps" open all time on their computers, and want to manage them separately from all the 'web pages I am looking at'. Think Slack, Mattermost, Spoti

    • Re: (Score:3)

      by roca ( 43122 )

      You're absolutely right. This just a hyperbolic attack based on a misunderstanding of what PWAs are.

  • just like web bluetooth (Score:5, Funny)

    by fanoush ( 6614990 ) on Sunday January 31, 2021 @08:12AM (#61011936)
    They also still don't suport web bluetooth and web serial (quite useful for me). But thanks to ignoring all this they save a lot of development effort which can be better invested into redesigning the UI one more time :-)

    • They also still don't suport web bluetooth and web serial (quite useful for me). But thanks to ignoring all this they save a lot of development effort which can be better invested into redesigning the UI one more time :-)

      I'm guessing 2021 is the year the address bar is removed. The justification will be that everyone just searches for everything anyway.
      If not that, then it'll be bookmarks, for the same reason.
      I figure there's a decent chance that scroll bars will be removed this year "because scroll mice".

      Those are my guesses because I figure Mozilla won't figure out how to implement their ultimate UI plan this year: removing all non-black pixels from web sites, to avoid eye-strain.

      • > removing all non-black pixels

        SJWs, I tell ya...

      • Re: (Score:2)

        by theCoder ( 23772 )

        I figure there's a decent chance that scroll bars will be removed this year "because scroll mice".

        That's been going on on Linux desktops for a few years now. Hidden scrollbars, narrow scrollbars, scrollbars without arrows at either end.

        Most apps on Android that support also have minimal or no scroll bars. At least there, screen real estate (or at least finger real estate) is at a premium, so I can kind of understand it. Doesn't make it any easier to move just a single row at a time.

  • I use Firefox as my main browser, and while I don't have technical knowledge to know what this feature is or how it's different from webapps I already use in Firefox, I wouldn't go as far as to call the whole browser irrelevant.

    • The whole point of a browser is to be similar to a generic virtual computer for web site interfaces. If "that's a problem" for sealed ecosystems that want to control what you have access to, that's a problem.

      • lol right, these are the exact sites that I won't use, because the whole rest of their stuff treats me that way, too.

    • This isn't something we use, this is shit that the appers whine that if we don't do it, we won't be cool, and so we'll be "irrelevant"... to them.

      But appers don't use desktop firefox anyway. And I don't care who else uses the same browser as me. They hear that are like, "ok boomer," and they can't imagine, literally, literally-literally, can't imagine that gen x does... not... care. They think I'm saying, "I know you are, but what am I." They literally can't imagine that I don't care. Or even that I'm not a

  • and your misleading complaints are quite irrelevant. You can now GTFO, thanks.

  • Key tenet? (Score:5, Insightful)

    by markdavis ( 642305 ) on Sunday January 31, 2021 @08:36AM (#61011976)

    >"Thurrott's conclusion? "Mozilla is walking away from a key tenet of modern web apps and, in doing so, they are making themselves irrelevant."

    That seems a bit wild, sensationalistic, and extreme. Perhaps that might be Thurrott's conclusion, but it isn't mine. I haven't ever used or needed "web apps" that are nothing but a web browser pretending it isn't a web browser.

    It does seem like a novel feature. But if it is buggy feature that is rarely used, sapping resources, and not important, I can understand dropping it. I have my issues with all browsers, including Firefox. But this would not, in any way, stop me from continuing to use and support Firefox.

    • How does this type of feature "sapping resources"? Have you considered that really SSBs are just a configuration of browser features already present by "pretending it isn't a web browser"? Lol, you comment has been up-voted to a score of 4 "insightful" when you have just contracted yourself in one sentence following another.

      The fact is, you don't use this type of feature, see no need for it, and consider it "rarely used'. What you'll probably find though, is that if Firefox actually gave this feature some

      • >"How does this type of feature "sapping resources"?[]you comment has been up-voted to a score of 4 "insightful" when you have just contracted yourself in one sentence following another."

        Those weren't MY words or assertions (that it is sapping resources), but a Mozilla developer's.

        >"But people who make the browser seem to think the same as you, "I don't use it, so it's not useful for everyone." How very insightful indeed."

        Please don't lump me in that way. I never said (nor meant to imply) any such th

      • How does this type of feature "sapping resources"?

        I think Mozilla's point is that it takes developer time that is better spent on more widely used features.

  • non-Flash supercookies (Score:4, Informative)

    by Anonymous Coward on Sunday January 31, 2021 @09:04AM (#61012012)

    Firefox now protects you from supercookies, a type of tracker that can stay hidden in your browser and track you online, even after you clear cookies. By isolating supercookies, Firefox prevents them from tracking your web browsing from one site to the next.

    Details of how supercookies work, now that Flash is gone:

        https://blog.mozilla.org/security/2021/01/26/supercookie-protections/ [mozilla.org]

    In fact, there are many different caches trackers can abuse to build supercookies. Firefox 85 partitions all of the following caches by the top-level site being visited: HTTP cache, image cache, favicon cache, HSTS cache, OCSP cache, style sheet cache, font cache, DNS cache, HTTP Authentication cache, Alt-Svc cache, and TLS certificate cache.

    To further protect users from connection-based tracking, Firefox 85 also partitions pooled connections, prefetch connections, preconnect connections, speculative connections, and TLS session identifiers.

  • I mostly surf random light reading and entertainment on my iPad but struggled for years trying to get an ad blocker that worked without hosing half the pages I open. I recently discovered Firefox can get setup as a safari content blocker. That plus ad guard with a few custom rules has worked out REALLY well for me.

    All this other stuff about this n that allegedly key web tech? Dunno, don't care, Firefox will mostly die when google decides they no longer need them around for anti-trust protection. Other t

  • I really see Progressive Web Applications (PWA) as a technology of the future as it further makes the platform increasingly irrelevant and simplifies the development and support of applications. Creating PWAs means a single application can run on different operating systems (Windows, MAC OSX, Linux, ChromeOS, Android, etc.), different platforms (desktop/laptop, thin client/Chromebook, tablet & smartphone) and different browsers without having to support each one.

    Of course, that's the goal but it's

    • Write once, run everywhere. The holy grail that never was.

      • I don't think Java applets or Flash were inherently any more leaky than browsers, it's just that people didn't rely on Flash and applets often enough to justify their security risk. If you have all 3: Flash, Java applets, HTML browser; then you have 3 leaky platforms. Since HTML browsing was/is predominant, IT departments started blocking or limiting the first two by default, resulting in just one leaky app delivery platform.

        As is common these days, it was a winner-take-all situation. If applets got a head

        • Actually, you got it backwards. Back in the nineties and early 2000, html+css+js did exist, but their feature set was largely inadequate for complex applications. So flash and java took the stage and dominated for years. They were the first to market. The standard html+js+css later won because, once they reached feature parity, they were more convenient (no need to install and update plugins) and flash and java did have their lot of additionaly security problems. Also, time to market on the web stack is low

          • Re: (Score:1)

            by Tablizer ( 95088 )

            So flash and java took the stage and dominated for years.

            But they mismanaged their advantage, and didn't have enough competition to weed out bad ideas. See "IE" below.

            no need to install and update plugins

            Browsers have to be updated also. The update process has become pretty automatic such that most users don't even notice. The same techniques could have been applied to applets and Flash.

            and flash and java did have their lot of additionaly security problems.

            But as I mentioned, I don't believe they had more l

            • Re: (Score:1)

              by Tablizer ( 95088 )

              Addendum.

              It's not really first to market, but first to the right kind of model, namely open-source and client competition.

              Similarly, z80 (embedded), x86, and ARM are pretty much the only surviving CPU architectures (outside of niches) because they had second-sourcing. Companies didn't want to rely on chips that didn't have an alternative source. Competition also reduced riff-raff. Flash and applets didn't have viable alternative suppliers.

      • I recall "Bedrock", a Symantec C system, where you wrote for a generic window system, then it could cross compile apps for Mac and Windows.

        It died before birth, I never found out why, but I imagined legal problems with the Apple/MS cartel that tried to lock up everything windowing that was beyond original Smalltalk, if even that.

    • Seriously?

      We went over this with Java, long ago. I was a supporter, by the way.

      PWAs just added the shittiest platform ever... a document layouter abomination with applocation and then OS festures grafted onto it like an upside down pyramid ... and everything being server-controlled and centralized and always-online for the sole purpose of taking away control from you, and making you a maximally milkable ad cow.

      I went the other way. All "web sites" I make, are classically compiled CLI-like programs, with an

    • Re: (Score:2)

      by Tablizer ( 95088 )

      Creating PWAs means a single application can run on different operating systems (Windows, MAC OSX, Linux, ChromeOS, Android, etc.), different platforms (desktop/laptop, thin client/Chromebook, tablet & smartphone) and different browsers without having to support each one.

      Web standards are a shitty fit for desktops and CRUD. We really need a state-ful GUI markup standard so that we can leverage desktop power and the mouse's superior ability above finger UIs. Current GUI's are too tied to specific progra

    • Why didn't Java or Flash apps take off? All the same reasons apply to PWA.

      I'll add that "write once, run anywhere" is a horrible philosophy for things with UI (desktop vs tablet vs phone vs watch) or that require external resources (files, camera, microphone).

    • I'm not a big fan of PWA,
      BUT, what I'd like to have is a way to launch a browser into UI-less display of a specific webpage. Local or otherwise. And that the icon in the taskbar would basically be the favico of the website.

      Why? A lot of tiny appliances that don't force you to use a mobile app routed through "cloud" in China seem to serve up tiny webpages. Heck, alot of industrial automation kit seems to offer this possibility too, and for such "single purpose" html interfaces it's nice to be able to have it

    • Re: (Score:2)

      by Compuser ( 14899 )

      Making the platform irrelevant is fairly easy - open the source code and set up open and robust compilation environment. The problem has been solved a long time ago in the most efficient manner. It works well too. However, if you want your code closed and you try to work around restrictions of other closed or walled garden systems then you hit a perpetual problem and no amount of technology layers will solve this. You enter an arms race between closed systems and it just never ends.

  • Have a vendor that uses a small app to sync a web vendors database to a local database that controls some rfid gates. Its not great but its worked okay since 2017. Firefox 83 broke this. Now when the people put a item on the rfid reader if it has double digits or more say 123455589 it will strip duplicate digits out and the web app receives 1234589. I had them switch to chrome which causes other problems since the vendor only support firefox. They acknowledge the bug but say its our rfid sync app caus

    • > can find nothing of course on this bug anywhere else and am stuck since this bug is too small and specific to get any attention.

      Please link your Mozilla Bugzilla issue here.

  • Thurrott has been banging the drum for PWA's for years now. He has made more noise about this than any 10 other tech commentators combined. I'm sure PWA's are useful for some folks, though I've never felt I needed or wanted that feature. But that's just me.

    In any case, when Mozilla dropped the functionality, I fully expected Thurrott to get hysterical, and he did't disappoint.

  • Mozilla just popped the delusional bubble of the WhatWG, that Google created to dominate software, so they could push ads and spyware (like GMail) in everywhere.

    WebApps are just a cancerous fad that takes a long time to heal from. Everyone knew it was a bad idea. I mean the inner-platform effect is a software design anti-pattern for a reason.

    And this is the start of their death.

    Funnily enough, helped along by Google, through apps on smartphones being used instead.

    I've always written proper software, and sta

  • Mozilla has been irrelevant for quite a while. Moving away from PWA doesn't affect that at all.

  • the whole idea of web apps sucks (Score:4, Insightful)

    by cas2000 ( 148703 ) on Sunday January 31, 2021 @10:03AM (#61012086)

    I don't want a fucking app. i want html and css.

    the more the web turns into fucking spyware and other malware apps and shitty javascript bloat, the less i want to use it.

    • It's no longer about what the Internet's users want.

      It's about what Google, Facebook, Amazon want. They shape now the internet, look at what have happened to w3c.

      Mozilla is actually responsible of how HTML standard shifted from w3c to Google/Apple/Mozilla hands. What's strange is that their arguments were aligned to the kind of concept behind PWA: Apple, Opera, and Mozilla Push For HTML5 [slashdot.org]
      So, yeah. It's a little strange that Mozilla doesn't support PWA in a straight way, it does supported it indirect
  • The only way I even know this exists is though the ever-prevalent pop-ups on Mobile that beg you to "Add this site to your home screen!!!1". I don't see that the big deal is, aside from more direct traffic generation. But as a user, I'd rather use a browser and search engine to find what I need every time. Now if only Chrome could drop this garbage, that would be great. Brave too (eh tu, Brave?)

    • Re: (Score:2)

      by Tablizer ( 95088 )

      It's a similar problem to the location tracker pop-ups. Too many sites did such that browser vendors started blocking them. It's an old problem actually as printing was dealt with. Early browsers allowed JavaScript to automatically print or prompt for printing, trying to get you to print spam. It's since been changed to reduce print request popups.

      Sites do such with the locator in the hope you'll accidentally allow it, giving them snooping meta-data. Managing how ALL applications and websites get access to

      • Re: (Score:1)

        by Tablizer ( 95088 )

        Addendum: There should probably be a "prompt" option, so that a prompt appears asking the user for permission to a resource, perhaps with a time-limit. Thus, a given line would resemble:

        Resource A: (X) Deny, (_) Active, (_) Background, (_) Prompt

        It perhaps could even distinguish between allowing to prompt during active mode and prompt during background mode. However, that could confuse newbies. Perhaps an "advanced" mode would allow the finer distinction.

        Also, check-marking "Background" would allow resource

  • I tend to have multiple browsers installed on my system fof both testing and edge cases. I perhaps incorrectly assumed most people did, at least for those edge cases. (Oh crap, this doesnt look right, maybe try it on chrome)

    Still, this is a feature I didn't know existed, so I won't loose too much sleep over it.

    Anyway, Firefox has been my primary browser since it was called Phoenix, it's had darker times over the years, but I feel like it's in a pretty decent spot right now.

  • I hardly even manage a single supercookie, not even with several cups of coffee, I'm glad they come isolated in their own packaging. One is more than enough.

    • It also helps to keep them fresh! I can't imagine someone eating a whole box of supercookies after a meal for dessert or even as-is for breakfast.

    • Damn you! Now I am thinking about a full sheet sized chocolate chip cookie.
  • Maybe we should do a Doomsday Book type of survey to get a solid estimate of how much transactions are still being performed by COBOL code and how many lines of COBOL code do we still depend upon, both in absolute terms and percentage wise.

    I believe especially percentage wise it's probably a lot smaller than most people think. OTOH those that little percentage of code could run some of the most important code in our society, such as banking / insurance and social security / government.

    We won't know un

  • Gradually, over a period of years, I got Firefox working exactly the way I wanted it to work. I tried out extensions that interested me. Some stayed, some didn't. As my needs changed, so did my customized, "me-centric" Firefox configuration.

    Then came the New And Better Firefox, with its constant, pointless interface changes and Mozilla's high-handed, "we know what's best for you" attitude. I currently have Version 37 on one computer, which I use very occasionally because it works well on a couple of sit

  • now protects users against supercookies, which Mozilla says is âoea type of tracker that can stay hidden in your browser and track you online, even after you clear cookies

    Not ISP supercookies. These reside on a server on some service provider. Not on your PC. You could use a VPN. But then you still aren't protected from the sites that you visit. Or from which your browser downloads that strange 1x1 pixel graphic.

    Want to learn more? Just click on this CAPTCHA for additional information. Yeah, right.

  • https://bugzilla.mozilla.org/s... [mozilla.org]

    I was wondering why Firefox v85 wouldn't take my SeaMonkey v2.53.6's places.sqlite. :(

Slashdot Top Deals

No spitting on the Bus! Thank you, The Mgt.

Close