uBlock Origin Maintainer on Chrome vs. Firefox WebExtensions | Hacker News Reader

uBlock Origin Maintainer on Chrome vs. Firefox WebExtensions

discourse.mozilla.org

776 pointsnachtigall324 comments

After being a Chrome user for several years, I've switched back to Firefox for the past two years or so and I'm really, really happy with it.

Latest version does multi-processing, e10s is finally here (though it might still get disabled by usage of certain add-ons, I remember I had to force it to stay enabled).

On performance, in the past it felt sluggish, but now Firefox is fast and for my usage patterns it uses less memory than Chrome.

And one thing I really love is the Awesome Bar, which is a pain point every single time I open Chrome. I have a lot of websites I need to return to and in Chrome I end up searching on Google far more than I should. I guess that's the biggest difference between Firefox and Chrome, as Mozilla does not feel obligated to shareholders to extract ads clicks from you (although I hope that whatever they do keeps them afloat).

Also, tab management. I installed "Tab Center" from the Test Pilot and it's awesome. The experiment is now over unfortunately and the code itself for Tab Center isn't compatible with WebExtensions, but there's work going on to port it and that highlights that Firefox's WebExtensions will be more flexible than Chrome, if they aren't already.

But in the end I actually care more about trusting my browser and its maker to protect my interests. I actually trust Google more than I trust other companies, but something feels very wrong for a company to have so much leverage on me. Which is why, as long as I have a choice, I'll always prefer Firefox over Chrome, or Safari, or Edge.

To me, the best feature of Firefox compared to Chromium (both out of the box, no extensions. not sure if there are extensions that could help) is the address bar. Firefox does a fuzzy search into your browsing history and if you visit the same sites often, the suggestions are quite good.

Contrast this with Chrome, where the idea behind address bar user experience seems to be maximizing the number of Google searches done.

But the one that really keeps me on Firefox is Vimperator. It's the best keyboard oriented browser UI in mainstream browsers. The extensions available for Chrome are nowhere near as good (last time I tried).

The worst part of Firefox is the terribly long startup time. It can take up to 10 seconds after a reboot and takes quite a long time even with warm caches. Chromium startup is near instantaneous.

> The worst part of Firefox is the terribly long startup time. It can take up to 10 seconds after a reboot and takes quite a long time even with warm caches.

If you're the type with a lot of tabs open, that should improve a lot in the next few releases.

https://metafluff.com/2017/07/21/i-am-a-tab-hoarder/index.ht...

> If you're the type with a lot of tabs open

I'm not and I don't store/restore tabs on close, so that's not the case here. It's just Firefox + Vimperator + uBlock origin with about:blank as home page.

I'm on Linux/X11 if that matters.

This is probably a good place to plug the fact that Vimperator is going to die with FF57 [1].

If anyone wants to help with making an alternative, look through that thread. I'm particularly invested in Tridactyl [2] but other people are working on others.

[1] https://github.com/vimperator/vimperator-labs/issues/705

[2] https://github.com/cmcaine/tridactyl

Not strictly feature-equivalent, but there's already a working (I use it everyday) port of Vimium for Firefox: https://addons.mozilla.org/en-US/firefox/addon/vimium-ff/

I've been using VimFX all along, which is actively maintained and already compatible with multiprocess.

It's a web browser, not an actual text editor. 99% of the time, you're just wanting familiar keyboard commands for navigation. It feels like Vimperator does so many impractical things almost tongue-in-cheek, just to show how cool it is that they're theoretically possible.

That's odd, from SSD a cold firefox start takes a few seconds on my debian testing (using firefox 54 from apt). Maybe you're using a slow HDD?

Nope. It's a lightning fast m.2 SSD. And warm caches don't help either.

Are Vimperator + uBlock origin the only active add-ons? The Ubuntu Modifications one is known to cause slowdowns, for example.

What happens if you try to completely reset the Firefox profile, and bring back the plugins you want?

> If you're the type with a lot of tabs open

Then pray for Tree Style Tabs to be implemented by default in Firefox.

I hope not. I believe that it is better for Firefox to be as light and bloat-free by default while users are free to install whatever addon provides any extra features that they need.

Tree Style Tab could be an opt-in functionality of vanilla Firefox, that wouldn't be an issue for new users.

Although I firmly believed that tabs on the side make more sense for any kind of users. Nesting tabs require a bit more practice though and that could be an opt-in option.

As far as I can tell, it doesn't look like this - one of my favorite plugins - will survive v57.

See https://github.com/piroor/treestyletab/issues/1224

Especially when we know we have browsed a site before but forgot the URL and remember only some portions of the title.

Firefox address bar is just more productive in simple things like re-opening frequent/historical sites.

In my experience, whenever Firefox takes more than a couple of seconds to start up, I know my Internet connection is acting up. It appears to be doing some sort of blocking network lookup on the startup path, and opens the intial window only after it succeeds or times out.

One thing that helps with Chrome's address bar is typing in a slash when searching for a site in your history. Suppose I visited this URL:

https://en.wikipedia.org/wiki/Lognormal_distribution

Chrome might or might not suggest it when I start typing "logn...". But if I type "/logn" it's there immediately. They're tokenizing URLs in a stupid way, apparently.

> But the one that really keeps me on Firefox is Vimperator. It's the best keyboard oriented browser UI in mainstream browsers. The extensions available for Chrome are nowhere near as good (last time I tried).

Did you ever use vimium on chrome? It's part of what keeps me on Chrome, I remember I had a quick glance at Vimperator a fair while ago, but switched back to chrome as it was what I was used to. I keep wondering about trying again.

Can you talk about the trade-offs between them?

This is supposedly a lot better with Firefox 55, released this week :)

Only for restoring lots of tabs.

And by god is it fast now. I have in excess of 200 tabs open in various groups (RIP Tab groups), and didn't remember that my Firefox had updated. I open Firefox, see it startup instantly and my first reaction was that Firefox somehow forgot all the tabs that I had loaded and had just started a new window. Imagine my surprise when everything was just as I wanted!

Yeah, I have a strong hunch that a ten-second startup time is due to restoring lots of tabs.

You mention tab management. One of the main reasons I like Firefox is due to one, exemplary addon: Tab Mix Plus. It's the kind of tinker-y addon that lets you do almost anything that is typical for Firefox.

With ad-blocking especially, I just can't trust Google to be fully supportive. I mean, who are we kidding? It's literally their business model.

One thing I've been finding lately with firefox is that the Netflix website is abysmally slow. It lags on loading, goes unresponsive a lot etc etc.

I've always watched twitch in Chrome (second browser, other screen, works fine) because firefox used to be bad. It's likely that I will start doing the same with Netflix.

Make some noise to Netflix then to make sure their Website works with Firefox.

If you can watch Netflix with Firefox, sounds like you're on Windows or macOS.

The best browsers for Netflix are IE or Safari. Chrome and Firefox support up to 720p only.

You can watch Netflix with Firefox on Linux, but the first time you do, it has to download a plugin, and you have to reload the window.

Not many people seem to be aware of this, but Firefox Mobile is just as great! You can run full extensions, just like on desktop.

I use Firefox Mobile as well but to be fair extension-support is flakey. A lot of times I install an extension that doesn't work and nothing indicates whether it does or doesn't. Also the extensions store doesn't indicate whether and extension is mobile friendly or not.

Oh man plugin support on mobile, this is a game changer for me. If only Firefox supported 2fa with an authenticator app I would have no hesitation using Firefox as my main browser.

I'm using Firefox on desktop, but Mobile scrolling is just awful even on a flagship smartphone. Just also tried nightly: the same.

> Latest version does multi-processing, e10s is finally here (though it might still get disabled by usage of certain add-ons, I remember I had to force it to stay enabled).

Are multi-processing and e10s separate things?

How do you forcefully enable it? 5/7 of my addins are listed as Legacy so I am still in single process mode, I am dying to try multi-process!

EDIT: See here: https://www.ghacks.net/2016/07/22/multi-process-firefox/

EDIT 2: Doesn't seem to work, for me anyways. It appears to be enabled in about:config but I only see one process running in task manager.

EDIT 3: I lied, it does work, 8 processes running now.

ALSO: Does anyone know if tree-style tabs will be made compatible, or if there is something comparable that is?

Tree Style Tab is the biggest difference for me, if you haven't used it before you are probably slow to browse the web :)

I like a lot the "tabs outliner" extension for Chrome. It's especially useful when you work with many tabs open at the same time, and want to preserve sessions, etc. Unfortunately there is now alternative to that in Firefox. Session Manager comes close, but is painful to use. So I'm still looking forward to such extension for Firefox, because honestly I prefer FF to Chrome for most of the things.

Honestly nothing beats Tree Style Tab, have you tried it?

I've tried it. Three times, I guess, since the early versions of it. All three times I found it useless even though I usually have 30+ tabs opened.

Honestly, this kind of statement is nothing but a superstition that you usually hear from people that think that it's impossible to be productive using different approaches.

For me nothings beats Vimium's "T" or Session Buddy + Keepin' Tabs extensions pair.

That is odd, you should try to use for longer periods of time. I personally use it with hundreds of tabs open and I haven't found anything else that can compare.

> Honestly, this kind of statement is nothing but a superstition that you usually hear from people that think that it's impossible to be productive using different approaches.

Maybe, but I'm pretty sure I'm more productive than you. We should compare each other browsing reddit some day.

>That is odd, you should try to use for longer periods of time. I personally use it with hundreds of tabs open and I haven't found anything else that can compare.

I'm using fork when eating pasta. Still, my chinese friends tell me that nothing beats sticks and I should just try to use them for longer periods of time.

See what I did here?

Your assumtion is baseless. You don't know for how logh I've been using it, nor do you know about the results (aside from the fact that I don't use it anymore).

>Maybe, but I'm pretty sure I'm more productive than you. We should compare each other browsing reddit some day.

I'm sorry, but "browsing reddit" and "productive" are on opposite sides of scale for me.

You are entitled to your opinion, no matter how childish it may be.

Tab Outliner does all of that and more as far as I can tell. I'm certainly happy using it.

Perhaps the biggest reason I use Firefox is for Tree Style Tabs. I've tried to find something equivalent in Chrome.

I installed Tab Outliner briefly, and honestly, I couldn't figure out what the heck it was trying to do. Maybe my mental capacity is too limited, but as far as I could tell it didn't get me one iota closer to my goal. What I've settled on, for the times when I need to use Chrome, is an external helper app called Sidewise.

So Tab Outliner needs to do a LOT more to make its operation more discoverable if it wants more users.

It's certainly not obvious, I'd agree with that. It's a kind of a hybrid of tabs, sessions and bookmarks as far as I use it.

> On performance, in the past it felt sluggish, but now Firefox is fast and for my usage patterns it uses less memory than Chrome.

/me remembers how fast FF was compared to IE 'back in the days'.

Well, bear in mind that websites was way simpler to render for a browser back then.

Also keep in mind that Mozilla is researching better rendering methods through the Quantum project. The potential boost will be huge -- CSS styling and compositing will be faster, JS code that interacts with the DOM will be faster, etc.

I'm very excited about Quantum CSS and Quantum DOM landing.

+1. The perfs on Firefox have improved so much. And the new test pilots are awesome. I freaking love tab containers.

> It baffles me that some people thinks Firefox is becoming a “Chrome clone”, it’s just not the case, it’s just plain silly to make such statement.

That's probably the single most reassuring statement about Firefox that I've heard in some time, coming from a serious dev who makes a popular cross-platform addon for both Firefox and Chrome.

I think as an extension developer he is particularly sensitive to the tech behind Firefox, which makes him understand some of Mozilla's decisions. For example, the move from legacy add-ons to WebExtensions is surely one less maintenance burden for Mozilla.

As a user who doesn't think about such issues, it terribly looks like it's becoming a Chrome clone. I think it's Mozilla's responsibility to have a clearer communication if that's not the case.

Also, the move to WebExtensions is a move to a more secure extension model. Traditional XUL extensions were comparable to the extension developer compiling their own code into the browser. Yikes.

WebExtensions should be better sandboxed and have better permissions management.

You can't get those security benefits if you allow older XUL extensions to stick around. You have to sunset XUL extension at some point.

And, similarly, you can't go to any sort of multiprocess architecture (or multithread) model if extensions can mutate more or less anything at any point, and that's not just about security, that's also about what plenty of users have been asking for for years—performance.

> Also, the move to WebExtensions is a move to a more secure extension model. Traditional XUL extensions were comparable to the extension developer compiling their own code into the browser. Yikes.

Not if you previously moved to the Jetpack, err addon-sdk with cfx, err jpm tool. Now there's yet-another API to move to. At least this one will make it easier to develop portable extensions (but still not straight-forward).

To be perfectly honest I'm not at all interested in "better permissions" for plugins when it comes with the removal of flexibility that you get for free. If I've got plugin-installing malware on my system, I've got worse problems than a rogue plugin.

Give me more useful over more secure any day of the week.

But the flexibility did not come for free! Whenever they changed internal interfaces, they'd either have to create a clone, call it interface2 or break all extensions using them. That's for internal interfaces.

The new model also means actual public support for a well-defined API. It's so much better for developers.

Besides, it also enables some big performance and security wins.

As someone worried about security; I hope that is not the majority opinion.

It's not entirely unreasonable. We use software because it's useful. If you make it so secure that it is no longer useful, what have you got left?

In the case of Firefox extensions, I'm aware of the risks of the old model, but the fact is that the only observable difference it has made to me so far is that when I accidentally hit back on a page with an unsubmitted form the other day I lost about 20 minutes' worth of work, because the extension I used to use that would have saved everything automatically no longer works. This is not progress.

Lazarus: Form Recovery hasn't been maintained in years. But I don't think there's anything about it that can't be done with web extensions. There's already one that has the base functionality: https://addons.mozilla.org/en-US/firefox/addon/textarea-cach...

If you hit Backspace in error, you can disable the “Go Back” action associated with the backspace key using about:config like so:

browser.backspace_action = 2

Read [1] for more instructions.

If you explicitly used the mouse to click the Back button, I am sorry for the time you lost.

1. http://kb.mozillazine.org/Browser.backspace_action

The idea that the XUL extension model is necessary for a browser to be useful is obviously false. The majority of Web users use browsers that do not have a XUL extension model.

(And, of course, I don't believe your desired functionality is incompatible with Web Extensions anyhow.)

Usability will always beat security. This is why usability is one of the 2 most important concerns in security.

Security is like Safety: if it is put on a holy pedestal then everything else suffers.

I always say "Safety Third."

I'd like better permissions, but not at the cost of a more flexible, customisable browser than chrome. There should be reasons to use firefox above and beyond muscle memory.

This would help all the individuals who have inadvertently installed malware addons which do not have pwned systems as soon as there are any, if there are ever any.

Sadly, it is.

It isn't just malware installing plugins, it is the plugins increasing the attack surface for people trying to use the browser to install malware.

But as a user, you're probably just going to want to know if there is an extension that does what you need. Are you worried about the underlying APIs if you're not a developer?

I don't care for myself, but the author of one of my favorite extensions has stated that he's not porting to a webextension because he doesn't want to rewrite (again) and because (at the time he looked, at least) the APIs didn't really support it. I don't care about the API directly, but I absolutely care when they're insufficient.

The API is expanding pretty quickly and FF developers are taking input from addon devs. https://wiki.mozilla.org/WebExtensions#Firefox_57 There are even some people who have "office hours" available to give advice for porting old plugins to the new APIs. https://blog.mozilla.org/addons/2017/03/09/office-hours-supp... They really don't want the APIs to be insufficient either.

I care about the direction of the project.

Something like the Mozilla Hacks blog https://hacks.mozilla.org/2017/08/firefox-55-supports-webvr/ or the Add-ons Blog https://blog.mozilla.org/addons/2017/08/03/extension-example... or just the main Mozilla blog? https://blog.mozilla.org/blog/2017/07/20/firefox-focus-andro...

> For example, the move from legacy add-ons to WebExtensions is surely one less maintenance burden for Mozilla.

On the other hand it is an annoyance for many extension developers and users of those extensions. Half of the extensions i use (like DownThemAll, FireFTP and MAFF) are not WebExtensions compatible and there aren't any alternatives.

What do you think of Opera becoming Chrome?

I don't know. I haven't used Opera since the 1990s.

I fully expect most people will share my view.

Man I remember when Opera was THE one to use

most people will say "What's Opera?"

Kill da wabbit, kill da wabbit!

I think I preferred it, but what killed Opera for me was being bought by a Chinese company + seeing what that company did to Opera Max (which I thought was a "killer app" before the acquisition).

> seeing what that company did to Opera Max (which I thought was a "killer app" before the acquisition)

What did they do?

It never did - Opera was killed just after Kestrel, and a new Chrome clone was slapped with the logo and name. There is no Opera, and hasn't been for some time.

Opera was killed just after 9.6? I thought it survived till Wahoo.

Ah, sorry, my bad, got the codenames mixed up. Presto, i.e. 12.15.

Presto was the layout engine (and called that for as long as it existed as a properly disentangled module). Desktop 12 was codenamed Wahoo.

does not matter, happily 'stuck' using 12.x series :D

I found this disturbing:

"Chromium-based browsers are being “infested” by Instart Logic tech which works around blockers and worst, around browser privacy settings (they may start “infecting” Firefox eventually, but that is not happening now)."

From his linked post:

"Instart Logic will detect when the developer console opens, and cleanup everything then to hide what it does"

Is this implemented via a CDN-delivered script? Why would Chromium-based browsers be more susceptible?

It is indeed disturbing. Why should a web page be able to detect if dev tools has been opened? Isn't this a browser security issue?

It's pretty insane how much your browser knows about you:

http://webkay.robinlinus.com/

There's another one I can't find, but it writes out things like "user moved mouse to x,y. User has been idle for 10 seconds, page lost focus, page gained focus" .. kinda creepy how much is available to the Javascript engine.

This is pretty normal for a UI programming framework. The creepy thing for me is when that stuff is reported back to the origin over a websocket.

You must be talking about clickclickclick.click

And thanks for the new novelty website bookmark :D

https://clickclickclick.click

Clickable link

Reminds me of “Achievement Unlocked”:

http://armorgames.com/play/2893/achievement-unlocked

Elephant Games are incredible and their creator is also imcredible. I highly recommend checking out his other games if you haven't already. http://www.jmtb02.com/

http://imgur.com/6ep0YnW

Operating system, browser, CPU, local IP, connection speed. That's all I was shown, probably thanks to uMatrix blocking 3rd party scripts.

>Browser Plugins

>No plugins detected.

Interesting. I have 6 installed on Firefox.

Firefox no longer reports installed plugins to websites. It causes some interesting behavior on websites that check to see if you have flash before letting you play games (sorry, you need to have flash installed). I had a user script for a while that 'fixed' the navigator.$whatever to show having flash installed so I could play some game; now I just use Shumway and it seems to work.

If you think this stuff is creepy well...okay?

I mean, it's not like every desktop application you've ever used in your life couldn't do the same or more?

The difference is that you run only trusted native applications with the ability to check their source code, while you are visiting untrusted sites which often have obfuscated javascript.

I think that it would be a better comparison between a pdf file and the web: pdfs files can't do the same or more.

PDFs can run JavaScript too. Open this PDF in Chrome: https://raw.githubusercontent.com/osnr/horrifying-pdf-experi...

And I would argue it is harder for the average user to view the JavaScript inside PDFs: on the web just right click and choose Inspect Element right in the browser; for a PDF you'll have to use specialized tools to decode the myriad encoding schemes inside a PDF. The average JavaScript developer doesn't know how to extract JavaScript from a PDF.

> you run only trusted native applications with the ability to check their source code

Is the "you" in this scenario Richard Stallman?

I would suspect it's sniffing for the window-size suddenly changing in certain ways, perhaps along with watching for the normal dev-tools keyboard shortcuts via keydown listeners. I can't actually remember off the top of my head if Chrome suppresses the event in that case, but it wouldn't be surprising if it didn't.

The easy check for this would be to see whether opening the devtools in detached mode via the menus makes it notice.

Note that this would actually be quite a pain to hide from the page, just because it's something the page needs to know to display some stuff and make rendering calculations. If it was hidden from the page, we'd suddenly be complaining about debugging floating footers which are hiding under the devtools.

This is what happens when I trigged DevTools while logging key events:

document.addEventListener('keydown', ({ keyCode }) => console.log(keyCode))

You can see each key.

But there's different ways of opening dev tools. You can use the mouse to right click as well. In fact, when using keyboard shortcuts in the better these days, I have a habit of hitting alt+D first to get to the address bar first (Outlook likes to hijack browser shortcuts like Ctrl+n), in which case the website shouldn't know I'm pressing anything at all.

I think OP's point is you can listen for a bunch of signals: If you see the right keydown events, or if you see a contextmenu followed by a rapid change to innerWidth, they probably opened dev tools, and you should delete your evil cookies.

The person who figured this out probably opened them via menu and had dev tools in another window, so the evil folks couldn't detect the resize.

This actually made me try switching to Firefox again. There's some minor things missing, but for the most part all the features I want are there.

Firefox is maybe 80% of the way there. Just like in the IE Anitrust days, firefox suffers from sites that do not design with it in mind.

Still better than Google Creep. Change to a search engine that protects privacy too.

If you think "not designed with Firefox in mind" breaks things, try using uMatrix for a while.

If people would focus on content in HTML and CSS for layout and newfad devs weren't shoving 50 jscripts a page down our throat this wouldn't be happening as bad. I plan to make all my future sites librejs compatible, and forgoe js altogether whenever possible.

History keeps repeating.

Flash? Now you have heavily javascripted "website".

Table layout? Now you have bootstrap and friends.

Progressive enhancement? Fuck that, we don't have time.

And 5 years from now people will rediscover those and accessibility. Then 5 years later another kind of hell will have appeared to replace this.

The only big change for the current wave is that everything is obfuscated so it's harder for a newcomer to learn by checking how people coded things.

How this could be done if your backend it's a REST API?

You can still render server-side, an with a REST endpoint it should be easy to do so.

I've been using uMatrix for over three years and very very few websites don't work with it.

By far the most annoying 'feature' (more of a consequence of the internet) is the way that you can't whitelist HTTPS sub-domains. (Makes AWS Console a pain.)

Does AWS Console have much that needs blocking? Seems a reasonable place to simply turn off uMatrix. You could also simply use a second browser with uBlock Origin for a limited number of sites - I tend to do that for a lot of checkout /payment options where the repeated reloads of whitelisting in uMatrix could be troublesome.

Can you recommend a search engine? I'm trying DuckDuckGo, but it's just not as good.

> I'm trying DuckDuckGo, but it's just not as good.

It took me a while of using DDG before I realized how much I had equated "good" with "looks like Google".

What finally hit me, hard, was that I switched the DDG theme to a color scheme designed to look like Google search results, and all of a sudden the results "felt better". Markedly better.

So, I started regularly comparing results, every time I found something that I felt I didn't get the results I expected for. I would search, and then search again with !g. And almost every time I ran into something that I didn't like the DDG results for, the Google results weren't actually any better. (The rare times they were, I reported that, and often it got fixed.)

!sp will give you the google results without the google tracking as it's a proxy of google results.

I use "!s" in DDG to get to Startpage [1] search results. One letter shorter to access the same - no need to type "!sp" when one can just type "!s" instead. :)

This does not work for replacing "!spi" (image search on Startpage) though. Using "!si" does a search on a non-existent subdomain sportsillustrated.cnn.com.

[1]: https://www.startpage.com

awesome, DDG rocks

just tried !spi and it works as image search :D

My problem is not the looks, whenever I use !g I'm annoyed how bad it looks. It IS the results. Often when something doesn't have a ton of relevant results, DDG gives the wrong results while !g has what I'm looking for.

In my experience ddg is less contextual. For instance when searching for something that is trending, Google will often give the most expected results even if the search keywords are incredibly vague, while ddg will give more standard results respecting the keywords.

That’s the very reason I switched to ddg, but it bites me back everytime I try to catch up on stuff everybody already knows for days, and need to fallback to !g.

Are you allow google to store cookies? Maybe its because of personalized search google does?

how'd you report to DDG? tried reporting that !gi does not utilizes encrypted.google.com (which I think it should), seems like no dice

I always hit DDG first then if the results aren't great just append the Google bang (!g) in the DDG search field to get an unbubbled goog search.

The DDG bang system is one of its best features in my mind. https://duckduckgo.com/bang

How often do you end up at Google though; a few years back I tried DDG for a couple of months but ended up basically always doing !g and so went back to Google.

Might be time for another go?

I follow a three step model: 1. DDG 2. If that doesn't help, then use !s to search Startpage. 3. If that doesn't help, then use !g to search Google.

Other than the relevance and quality of search results, there are differences in features across these sites, like date range search, for example. Image search also seems to have more flexibility on Google. I haven't checked recently if reverse image search even exists on DDG or Startpage.

https://www.startpage.com gives you Google results but proxied.

Same for me. I fired up Firefox for the first time in years and it works great. The hardest part to get used to is their super-weird hamburger menu layout.

This menu is changing for Firefox 57. It will have a more "normal" menu soon. You can see it today by installing Nightly Firefox.

What Ankit The mobile menu? The mobile menu is a mess if you have extensions installed, because add-on developers don't put their stuff in the tools/page submenu, and there's no way to rearrange it.

Pressing Alt brings up the conventional menu bar, at least on Linux.

Plus you can go hamburger menu, customize, (some drop down menu at the bottom), show menu bar. First thing I do when I install FF on a new computer.

I recommend the Nightly channel. It feels much snappier, more performant and cleaner than the stable version.

Also:

> The purpose of Instart Logic technology is to disguise 3rd-party requests as 1st-party requests, thus bypassing content blockers, and even the ability of browsers to block 3rd-party cookies (because they are stored as 1st-party cookies):

https://github.com/gorhill/uBO-Extra/wiki/Sites-on-which-uBO...

How exactly does this work? The link mentions that it detects when Dev tools are opened and changes something?

>How exactly does this work?

Which part? The making 3rd party cookies into 1st party cookies is likely just a caching proxy. They mention the speed benefits here, and not the cloaking benefit, but.. https://www.instartlogic.com/solutions/appspeed/runtime-opti...

Here are a few suggestions https://stackoverflow.com/questions/7798748/find-out-whether...

Wow, the 'id' getter strategy is devious and effective on Chrome.

https://stackoverflow.com/questions/7798748/find-out-whether...

And he has a list of sites that use WebRTC to get around blocking. Didn't Firefox or someone say they'd reconsider auto-enabling WebRTC if this practise became widespread?

> Why would Chromium-based browsers be more susceptible?

From the linked discussion: "they may start “infecting” Firefox eventually, but that is not happening now"

So it sound like the developers of Instant Logic are simply choosing to target the most popular browser at the moment.

I still don't actually understand what "Instart Logic" is, can anyone explain it?

https://en.wikipedia.org/wiki/Instart_Logic

That doesn't seem related to the topic unless I'm missing it. Also it has nothing to do with browsers or Chrome vs Firefox

http://go.instartlogic.com/AppShield-Ad-Integrity-Data-Sheet...

"Web publishers make simple DNS changes to flow the network domains that carry their HTML through the Instart Logic system. This allows our system to inject a small piece of JavaScript that can detect the presence of ad blockers. When an ad blocker is detected, the JavaScript-based virtualization layer Nanovisor, together with our intelligent cloud-based, machine learning platform, encrypts and delivers all the elements of the page using the customer’s existing delivery services.

As a result, each resource on the page, and any signals and actions such as measurement beacons or user clicks, will have its URL encrypted and obscured. This renders ad blockers ineffective, as they can no longer search for patterns which would indicate a resource is related to advertising.

The result is simply the experience that the web publisher intended on delivering to the end user with no changes to the ad delivery or measurement systems; end users have no need to be aware the technology is even being used."

Buzzword Bingo.

That's actually some pretty cool technology! I don't like what it's being used for, but I like that it exists.

This is basically how viruses get around antivirus. I think the virus/antivirus arms race has been more or less won by viruses, so it looks like this is the end state of the adblock wars.

Ahh see, I didn't even know it was a company.

It's referenced in the OP:

    Chromium-based browsers are being “infested” by Instart Logic tech
    which works around blockers and worst, around browser privacy
    settings (they may start “infecting” Firefox eventually, but that
    is not happening now).

And there is a link to further elaboration: https://github.com/gorhill/uBO-Extra/wiki/Sites-on-which-uBO...

Okay, so they have cookies on a subdomain of the main site's domain. But that in itself is not a problem, since it does not enable them to track me across websites. So I don't have a problem with that, unless they use other tricks. Are they using browser profiling or something similar to correlate across websites?

> Instart Logic tech which works around blockers

Hadn't heard about this, but this is why I still keep long blacklist in my /etc/hosts file even though I use uBlock Origin also.

Out of habit I get mine from http://winhelp2002.mvps.org/hosts.htm. Not sure it's the best one, but I started using it years ago when I was still using Windows and have just stuck with it.

I'm pretty sure there might be a bug for this in the Chromium bug tracker that is hidden from the common folk, just like they hide their bug where websites can detect if you're in private mode(!):

https://github.com/brave/browser-laptop/issues/9082#issuecom...

Any more reading on the Instart Logic tech detecting dev tools and hiding itself? I can't find much online.

Typically it seems to poll window height/width vars in js. https://github.com/sindresorhus/devtools-detect

Another variant: https://stackoverflow.com/questions/7798748/find-out-whether...

Sorry I meant I was looking for more like documentation on the product rather than implementation. Thanks though.

To add to the list:

* You can run the uBlock Origin on Firefox for Android: https://addons.mozilla.org/EN-US/android/addon/ublock-origin...

Afaik there's no ad-blocking extension for Chrome for Android which I find pretty telling. I'm using Firefox on Android and the ad-blocking (less traffic, less blink-blink animations and less CPU consumption) make mobile browsing a night-day difference

There's no extensions on Android Chrome, and the reason is simple: if they enable extensions, people will mostly install ad blockers and that's bad for business at Google

Google is in the process of allowing some adblocking in Android Chrome.

https://arstechnica.com/gadgets/2017/04/report-google-will-a...

Huh. These actually sound like good arguments to switch to Firefox, arguments I've never heard before until now.

One thing I learned several years ago when I decided to jump on the bandwagon and try Chrome was that Chrome was unable to safely block javascript the way NoScript does because the plugin framework doesn't allow a plugin to block Javascript before it's loaded.

So all the noscript equivalent for Chrome could offer was to block Javascript after it had loaded. Which seemed unreal and pointless.

So I stayed on Firefox. Because I've been convinced for many years now that Javascript plays a major role in malware delivery through the browser.

And along with email the browser is the major delivery platform for malware.

NoScript block all three: javascript, java and flash.

Javascript can be used to deliver/encode/decode exploit payload. Usually the exploit itself is java or flash.

At least, that's what I noticed for the zero day RCE that made it up to the first page of Google.

Chrome can block JavaScript before it's loaded, its what uBlock Origin does and others as well (using the WebRequest API available to Chrome extensions)

I found uMatrix to be an adequate substitute once figured out (http://adamantine.me/index.php/2015/11/18/umatrix-desperatel...)

It's important to know that NoScript does far more than block JavaScript; just look up its ABE component, for example.

For technical users, uMatrix' interface is an amazing achievement in, effectively, managing application firewall rules. It's breathtakingly efficient in both communicating active settings to the user and in configuring new rules. I wish my actual firewalls used that interface.

chrome has a setting to block scripts and it lets you add exceptions for sites

it's also easy to access: http://cdn2.ubergizmo.com/wp-content/uploads/2012/11/site-in...

i wish firefox came with something similar

The advantage of Firefox's NoScript plugin is that it can be selective.

Say you randomly visit a site and want to temporarily allow the javascript it uses to do its thing, but you don't want to allow any other javascript on the page such as facebook's and google's. The built-in chrome javascript blocker doesn't let you pick and choose temporary permissions at that moment.

I didn't know the firefox version could do that, it's something I've wanted for sometime.

I moved to firefox once 57 was released on nightly. Firefox is finally usable (in terms of speed) again and I can use it for day to day tasks.

I think I qualify as a poweruser by some standards, I tend to have 100's of tabs open and I've never left Firefox for speed reasons or others because it has held up extremely well over the years. My machine has a lot of RAM so maybe that's one reason things have been quick, and the main drive is an SSD. Is there anything specific about the 57 release that makes you feel caused the speed bottle-neck to disappear?

57 is lightning fast. Like, almost uncomfortably so on my machine.

Broay this is because quantum is much further along in nightly than on the other channels. Specifically, they're more aggressive with multithreaded settings, multiprocess is enabled, and the quantum css component is turned on, too.

Is also helps that we compare to chrome. On Linux chrome doesn't even do GPU rendering. So the HN crowd probably has a disproportionately bad experience with it

> 57 is lightning fast. Like, almost uncomfortably so on my machine.

I thought you were overstating it but I just tried it out and you're right, it's crazy fast.

> 57 is lightning fast. Like, almost uncomfortably so on my machine

As others have said here, I just installed Firefox Nightly after reading this, and you're 100% correct. I think it might even be faster than Chromium for me.

Wait, what? I know that hw accelerated video decoding is generally not available on linux chrome, but I'm pretty sure that lots of other things are. From my chrome://gpu

    Canvas: Hardware accelerated
    CheckerImaging: Disabled
    Flash: Hardware accelerated
    Flash Stage3D: Hardware accelerated
    Flash Stage3D Baseline profile: Hardware accelerated
    Compositing: Hardware accelerated
    Multiple Raster Threads: Enabled
    Native GpuMemoryBuffers: Software only. Hardware acceleration disabled
    Rasterization: Software only. Hardware acceleration disabled
    Video Decode: Software only, hardware acceleration unavailable
    Video Encode: Software only, hardware acceleration unavailable
    WebGL: Hardware accelerated
    WebGL2: Hardware accelerated

But this is with an integrated GPU, so maybe things are different for discrete cards.

Firefox has always been unbearably slow on Linux for me. It's the main reason I swapped to Chrome in the first place. I tried switching back to Firefox about 6 months ago, same problem of extremely slow and laggy UI. Interesting to hear 57 is faster now, it may be worth trying again.

Do you have any extensions installed?

Have you tried using a fresh profile, just to narrow the possible variables?

If you've checked both of those things, and you can characterize the slowness in the context of specific operations (e.g. what "laggy" means, precisely), then I'd recommend filing a bug and working with the developers to track down the problem. Because that is not normal.

Also, current Firefox has `about:performance`, where you can diagnose what addons and tabs can be slowing down the browser. It's quite neat.

I just refreshed my profile and performance improved immensely.

Go to about:config and set layers.acceleration.force-enabled to true. Made a dramatic difference for me in Linux using a Intel iGPU.

You can check the acceleration status in about:support, look at HW_COMPOSITING and OPENGL_COMPOSITING.

Firefox 57 should be a much, much improved experience. e10s with multiple processes started rolling out to users in Firefox 54 and tons of small performance issues have been fixed in 55-57.

On Linux, manually enabling GPU acceleration as user ac29 describes below can a big difference. Unfortunately, a lot of Linux GPU drivers have issues that prevent acceleration from being enabled by default for some users.

Same here, it's why I switched to Vivaldi. I had to restart Firefox every day or so and it still lagged. I've read the other recent post on here that shows 100+ tabs has almost no startup burden in FF57 compared to previous builds. I should try it again.

Here's an in-depth article on Firefox 57 and all the big changes:

https://www.cnet.com/special-reports/mozilla-firefox-fights-...

This article is good but the annoying div that covers your mobile browser when you are in landscape, is not!

OMG. Why do they do that?

has cnet always been this bad? I mean you need JS to read the thing

and the whole article is on a floating div?

For those who don't notice the speed, multiprocess may be disabled due to certain addons. Go to about:support to check if it enabled. The addon compatibility checker addon can tell you which are the offending addons. For me 1password was the big blocker, but they recently released a beta that works with the new API. Sorry for the lack of links, I'm on mobile.

Oh interesting. Firefox still seems slow and a bit of a memory hog compared to Chrome on my machine. Sure enough I checked and three add-ons are marked as legacy (and presumably disabled the multiprocess stuff): uBlock Origin, Websocket Disabler, and NoScript.

At least uBlock Origin is compatible with multi-processes. I'm using it right now.

Firefox 55 marks classic extensions as legacy, this has nothing to do with multi-process comparability.

Yep, not legacy, but "not compatible with multiprocess" is what it should show for offending addons.

Well, how can one determine which addons are multi-process compatible?

I may have to try Firefox again once 57 is in portage. A few months back I switched to Vivaldi, begrudgingly. I really liked Firefox, but the speed issues were becoming unbearable.

Vivaldi has been a lot faster and mostly an alright experience, and I've watched many of the issues I've found for it get addresses in recent builds. Still there are many things I miss about Firefox, not to mention supporting that community and the browser I've used for well over a decade (including back when it was Phoenix, the original Mozilla and the old Netscape 6 that proceeded them).

How has the nightly been for you in terms of stability? Been thinking of switching to it from beta. The memory issues on MacOS are killing me, and I believe there are fixes in nightly now.

IME, desktop nightly hasn't ever outright crashed (less lucky with mobile nightly). Sometimes I notice minor rendering glitches on various sites, but I also have Servo's CSS engine enabled which might be doing it (it's not yet the default).

Well, it used to crash a lot at some point : when e10s was first activated by default in Nightly (in 2013 IIRC) it crashed several times a day. I stopped using nightly for a year afterwards.

Yeh it doesn't crash for me, it just chews up memory until it's unusable. SO far so go though. We'll see how it last through the night.

Slightly OT: is that what a 'Discourse' page looks like? It's pretty awful: it will automatically update the URL as you scroll past each post in any direction, while breaking the Back button, so good luck getting back to the original post, since neither clicking on Back nor reloading the page will get you there. Basic UX failure.

What browser are you using? Because when I scroll on that page and the URL changes, it doesn't affect my Back stack (this is in Safari).

Using Firefox for Android.

I can't not notice the irony that this is happening with FF on the mozilla.org Web site.

That's the behavior I see using Firefox.

It looks like a feature to me : this way when you copy the address it links directly to the right comment. Of course this comes at the expense of a working back button.

The page is using Location.replace[0] to update the URL and replaces the current history entry without affecting back/forward behavior on pretty much any browser.

The one downside is that the URL may no longer point to the comment you were originally linked to.

[0] https://developer.mozilla.org/en-US/docs/Web/API/Location/re...

Keep in mind that it's not within Google's incentives to facilitate ad-blocking and prevention of tracking. After all, that's where the lion's share of their revenue comes from. However, Mozilla is free to actively support such efforts.

If that was that clear cut, they would ship tracking protection enabled by default, not just in Private Browsing mode.

The default configuration of Safari is actually protecting you better than Firefox's and most users don't have an ad blocker installed.

Good point. Mozilla made most of their money from Google, and other advertisers, iirc. "More free" might've been prudent.

You make a good observation about Safari too. Apple doesn't make much money from advertising--they still sell hardware. They can provide privacy to users at little expense to their core business.

> Mozilla made most of their money from Google, and other advertisers, iirc.

The much bigger problem is webpage owners which lose almost all incentive to support Firefox, if it blocks their ads. You'd have broken webpages all over the place.

Just like in IE/Edge, the "Do not track" setting used to be enabled by default, then it became disabled by default, and for good reason. The argument is, if it is enabled by default, sites will not bothered to support it since it was not something that the user turned on explicitly and was aware of.

Tracking Protection isn't Do Not Track. Tracking Protection in Firefox blocks web trackers

https://support.mozilla.org/en-US/kb/tracking-protection-pbm

In my experience tracking protection breaks a lot of websites so I am not surprised it's not enabled by default

I agree. Not just that, I would add that Google's incentive is often to encourage usage of these services despite being a detriment to the user. To this day, Android still does not have Night Mode built in probably because so people would simply use the device more instead of going to sleep.

Opt out adblocking should be the number 1 differentiator as it has the biggest impact on browsing including performance, security and eye sore. It is borderline negligence that moz://a is not pushing it while Google and co are lubing up users with their Acceptable Ads nonsense.

Firefox is coming back, finally- I think their market share is at the bottom and we'll see a big uptake over the next couple of years.

Here's hoping! We need a privacy oriented browser that's kickass for dev work as well.

Pay attention to this project and volunteer if you wish - https://voice.mozilla.org/ - it may be a big thing for Mozilla

Market share has nothing to do with features/functionality. Google has the ability to promote their products to the big audience.

Market share has already been on the rise again since Firefox 48, which was the release that shipped the separation of the UI and content in two processes.

People here probably didn't notice right away, since you pretty much had to have no extensions installed for a long time for it to be enabled, but casual users seem to have noticed...

Bold statement!

uBlock Origin on Firefox would be more powerful than uBlock Origin on Chrome, but does it mean that uBlock Origin webextension on Firefox will be as powerful as uBlock Origin "legacy" Firefox extension ?

This is a post of gorhill from the last months Firefox - Google Analytics fiasco:

> Legacy uBlock Origin can block the network request to GA.

> However webext-hybrid uBO as per Network pane in dev tools does not block it. Same for pure webext Ghostery, the network request to GA was not blocked, again as per Network pane in dev tools.

> What is concerning is that both uBO webext-hybrid and Ghostery report the network request to GA as being blocked, while it is really not as per Network pane in dev tools. It's as if the order to block/redirect the network request was silently ignored by the webRequest API, and this causes webext-based blockers to incorrectly and misleadingly report to users what is really happening internally, GA was not really blocked on about:addons, but there is no way for the webext blockers to know this and report properly to users.

https://github.com/mozilla/addons-frontend/issues/2785#issue...

The issue you linked is specific to the `about:` pseudo-protocol. uBO's WebExtensions version works as intended on the web.

I know that, thanks. I posted it as a real life example of where webextensions are still not as powerful as the so called legacy extensions and wonder if that specific case still applies, is it fixed, planning to be fixed, or are there other specific examples where webextensions fall short.

Yeah, that specific case wasn't fixed; it appears that Mozilla doesn't intend to let addons run on `about:`. However, they did make `about:` respect DNT by disabling GA.

WebExtensions currently fall short when it comes to any addon that modifies the UI significantly (tree-style tabs etc), though it's been mentioned in some other comments here that they're talking to addon devs to extend the API where possible.

> However, they did make `about:` respect DNT by disabling GA.

The irony is that since most people have DNT disabled having it enabled would make it easier for you to be tracked.

> it appears that Mozilla doesn't intend to let addons run on `about:`.

Why is that?

Couldn't the devtools listener shenanigans be solved merely by putting a "pause" button in the browser chrome (possibly through an extension)? Browsers are already throttling CPU usage when the tab isn't visible, so it doesn't seem like it would be too difficult to just throttle to 0 with a toggle.

Even better-- have the pause button in devtools window, "pause" by default when you open devtools, and then unpause once something gets mutated/re-layout'd.

I guess you'd still need to protect the devtools shortcut key so that any DOM shenanigans are guaranteed to get invoked after the devtools listener. But browsers already have all kinds of crazy edge-cases in the name of security (e.g., no manual triggering of <select> menu). Keeping polymorphic worms from corrupting the devtools state seems rather important by comparison.

> It baffles me that some people thinks Firefox is becoming a “Chrome clone”, it’s just not the case, it’s just plain silly to make such statement.

If you use a much narrower definition of "clone" than is typically used in this context, then sure. If, however, you use "clone" a bit more flexibly, and note the word "becoming", then it's a different story. That's not to say that Firefox won't be better than Chrome, and it's certainly not to say that it won't have any advantages over Chrome, but it is giving up some of its major current advantages.

I am considering going back to FF, but it seems FIDO U2F still isn't done completely and the U2F Extension for FF is not working anymore since the WebExtension switch.

Please correct me if missed something, but i think i have to hold off for a little bit longer.

Just today someone posted that they're about to get U2F in the main browser:

https://bugzilla.mozilla.org/show_bug.cgi?id=1245527

Actually, here's the U2F patch https://bugzilla.mozilla.org/show_bug.cgi?id=1388843

Side question, where are you using U2F?

I love the principle, but I can't use it with AWS, I can't use it with my bank, I can't use it with my domain registrar, and I can't use it with Office 365.

That's 0/4 of the high priority targets for me.

http://www.dongleauth.info/ lists U2F support status for many websites.

That's actually pretty depressing.

Under "Cloud Computing", ONLY GCP has support.

Under "security" vendors, no one does. "Payment" vendors again only list Google, and none of the domain registrars do.

In fact the most positive field is "social networks", with three separate ticks.

That is my understanding as well. I haven't been able to get my U2F working on recent Firefox builds. It's such a shame because I really want to use U2F instead of an authenticator app. I have like 20 different sites in there and finding the right number always takes me a minute or two.

Also Google Hangouts and Meet do not work.

Google literally checks for Chrome >_<

On GitHub, U2F works with the Firefox addon https://addons.mozilla.org/en-US/firefox/addon/u2f-support-a...

meet worked well for me the other day on Firefox Nightly (57)

The current plan has U2F shipping as soon as Firefox 57.

I've been really disappointed with the direction Firefox has been moving since they decided to make changes that would permanently break some of their most powerful and useful extensions, like Pentadactyl.

As someone who uses WebRTC to deliver real value (I'm an engineer @ Peer5 YC W17) - this abuse of WebRTC is awful.

I think WebRTC related tooling should get a lot better - and extensions should be able to hook into WebRTC calls just as easily as they do to regular functions.

Websites can just grab a fresh copy of RTCPeerConnection from a different realm anyway (an iFrame in this case) - it looks like uBlock is mostly stuck (unless it prevents sites from opening said realms).

I still think Chrome has some advantages. For example you can disable a lot of things like location services in the settings. In Firefox you can decline access to location once a site asks for it but I would rather disable it once and for all if I am setting up a machine for a less tech-savvy person.

Also, firefox comes with tons of built in features you cannot disable. In past they have caused security issues (e.g. the pdf.js exploit).

https://www.mozilla.org/en-US/firefox/geolocation/ "How do I turn off Location-Aware Browsing permanently?"

Just set geo.enabled to false.

There's also a preference to permanently disable pdf.js there. Or you can change the default PDF reader: https://support.mozilla.org/en-US/kb/disable-built-pdf-viewe...

You can disable everything in Firefox. Have you ever browsed about:config?

> the pdf.js exploit

Overall having pdf.js is a benefit to internet browsing. Should we not innovate and try to improve our tools just to preserve security?

> Overall having pdf.js is a benefit to internet browsing

I would doubt it. The experience that pdf.js provides is inferior to dedicated programs like xpdf.

> Should we not innovate and try to improve our tools just to preserve security?

We should, but we should not make such things like pdf.js unable to be disabled by the user.

> I would doubt it. The experience that pdf.js provides is inferior to dedicated programs like xpdf.

That's not the point, I open dozens of PDF daily and I don't want to have to switch programs all the time. An integrated light PDF viewer is one of the best new feature of modern browsers.

PS: You can set the pdfjs.disabled pref to true on the about:config page to disable the build-in PDF viewer

PS2: Not sure this still works.

I will admit that I just took pawadu's word for it. I personally had no idea if it is possible to disable pdfjs or not.

That being said, I will also agree that it is convenient sometimes but it is much slower and much less compatible than native viewers, making it useless for me about half the time. Still, I see no reason why it needs to be integrated into firefox instead of being just an addon (even if it is installed by default).

> I am not aware of any anti-fingerprinting initiative taken up with Chromium

Brave is Chromium-based and has anti-fingerprinting tech (which it was the first to include IIRC): https://github.com/brave/browser-laptop/wiki/Fingerprinting-...

It also works on Brave for Android.

I'm using Brave atm, but I'm about to give it up. The tabs frequently freeze and I can only hover over them to preview. I can't click on them.

Adding a bookmark takes about a minute.

Brave won't remember BASIC passwords

General sluggishness

Kickass Torrents is able to launch ads when clicking in the search box.

> Kickass Torrents

But Kickass Torrents died a year ago or so.

Unfortunately Brave doesn't have extensions and won't let you restore some settings from backup or transfer them to another PC, so it's not really a complete browser for most techies the way we think of Chrome and Firefox. Note that the settings loss thing is an issue (ehem "feature") with Chrome/Chromium itself and not specific to Brave on Windows builds.

The Tor Browser has some kind of antifingerprinting stuff in it. I don't know how it compares to what Brave does.

Many of the Tor project's anti-fingerprinting measures are gradually being merged into mainline Firefox.

Indeed, I remembered wrong. I think it was bcrypt who implemented it in both Tor Browser and Brave.

I would love to use Firefox for it's privacy credibility, the Awesome Bar and to prevent monopolization of the Web.

Unfortunately 2017 is the year of the CPU usage apocalypse on the Web. Go to this insane Guardian page, scroll down a page, and observe what happens for a minute or two perhaps scrolling down some more: https://www.theguardian.com/news/2017/aug/10/adele-vocal-cor...

The numbers keep jumping around a lot, but very roughly what I'm seeing is this:

  Safari: 2% - 8%
  Chrome 50% - 150%
  Firefox 150% - 250%

(100% is one CPU core. I'm not using any ad-blockers)

Obviously, these numbers are non-deterministic and depend on the individual ads that are being displayed. But the numbers are roughly representative of what I've been seeing over the last couple of months.

I tried this:

  1. With uBlock Origin running, I don't go above 11% CPU 

  2. I turned uBlock Origin off: reloading immediately sent my CPU to 80%, and it *stabilised* at a constant 30%.

As I said, it's non-deterministic, so I'm not surprised if you're seeing something different.

I have made it a habit to try resource hungry pages in all my browsers. The variance is huge but the pattern is pretty clear when it comes to CPU usage, especially between Safari and everyone else (excluding Edge and IE as I don't use Windows).

Incidentally, I changed from Firefox 32bit to 62bit today, and the page loads like a dream.

Which version of Firefox is that? It recently became much faster, and is set to see yet another improvement with version 57 (due in three months, I believe).

Firefox 54.0.1 on macOS 10.12.6. Firefox says it's up-to-date.

57 is Firefox Nightly. They’ve done a lot of performance work in between 54 and 57.

Try nightly. Or even FF 55. There's a huge chasm of difference - they put a huge focus on performance improvement the past couple of development cycles.

Alright, that's supposed to already be a lot better (although, as said, it will get even better). You might want to check about:support, and see what it says next to "Multiprocess Windows". If that's disabled, then you won't see the speedups from 54 (and it will usually give a hint about why it's disabled).

> Chromium-based browsers do not support user styles

Does anyone know what gorhill means by this? Stylish for Chrome seems to work fine: https://chrome.google.com/webstore/detail/stylish-custom-the...

Am I missing something? (Probably, but what?)

IIRC, stylish for chrome converts userstyles into javascript, and runs the scripts to add inline styles to elements on the page. stylish for firefox changes the page's stylesheet.

Last time I checked stylish seemed to insert a link tag in the head linking to the css file.

Edit: on Chrome Stylish inserts a <style> tag at the end with the css, it seems stylish insert the css via javascript in Firefox though.

Related: Can we have Tree Style Tabs implemented by default in Firefox?

Currently, there aren't even the APIs needed by Tree Style Tabs in WebExtensions. That's likely to change, but not until after Firefox 57.

That's why I wish they would implement it as a default function of Firefox, not as an extension.

I heard somewhere that Firefox's security showing was pretty dismal before they introduces e10s with seccomp-bpf sandboxing. The anecdote I heard was that in "hacking competitions" a Chrome vulnerability was worth a serious hunk of cash, Firefox was worth almost nothing because it was too easy. After sandboxing, Firefox RCEs are worth money again. Does anyone know whether this claim is accurate or misleading? I know I've switched back to Firefox because of it.

The claim is correct. The security of IE9+, Edge and Chrome is far superior than Firefox. As Geohot said, writing an exploit for Firefox is similar to a harder CTF challenge (done in an day or two). While IE or Chrome Exploits cost a lot. I can back it up with references, but https://www.zerodium.com/program.html shows a pretty clear picture (Scroll down to Payout Ranges). It will take FF like 3-5 years until they have a sandbox as good as the other Browsers, sadly.

I was viewing https://wiki.mozilla.org/Security/Sandbox and it appears that Firefox on Linux now has some kind of sandboxing. I presume it's not as good as Chrome but I'm sure it's raised the security level significantly. Realistically, how much danger am I in by using Firefox?

Web/browser Extensions is a terrible standard is it EXTREMELY limiting for power users.

While that my not impact a ad blocker, there are countless extensions that can not work with Web Extensions and will make Chrome err sorry Firefox far less appealing to people.

For me, more than a few of the extensions I use regularly are not compatible with Web Extensions, and a few of them that are critical to my productivity are in limbo still

That is the Source of the "Chrome Clone". The switch to Web Extensions is hated by many many firefox power users.

Sadly they feel the users that have stuck around all of these years, that did not abandoned them for Chrome are worthless, and have chosen to attempt to attract those users that did abandon FF for Chrome back. They are doing this by making a browser that is unappealing to me (and many others actual FF users, not Chrome Users who are the most vocal proponents of Firefox's current direction), a user that has been a FF loyalist since FF version 1.

I am not 100% sure I will switch to another browser, the options are very thin these days but it will be a sad day for me when FF57 is all that is left

Do you have one example of such extension that won't work with web extensions?

Session Manager, which I've used since Firefox 2. To add insult to injury I downgraded to an earlier nightly and it no longer worked either, had to blow away the UI customization config and reinstall the addon for it to re-appear and work again.

https://addons.mozilla.org/en-US/firefox/addon/y-u-no-valida...

vimperator https://addons.mozilla.org/en-US/firefox/addon/vimperator/

TreeStyleTabs

https://github.com/piroor/treestyletab/issues/1224

Seems they have all the APIs needed for it at the very least approved. It's not like Mozilla just said screw everyone... Let's become chrome. They are putting in the effort to make web extensions viable for even the more advanced uses.

They are making to where a version of TreeTabs are possible, this new API will enable functionality like in Chrome (see my other comment) but it will not be the same.

if I wanted Chrome style Vertical tabs I would have moved to chrome years ago

Seeing as how there is an api in place to have a built in sidebar in firefox, plenty of tab and window API methods available, a way to hide the horizontal tabs at the top of the screen and the developer of treeStyleTabs saying that they will be able to move to webextensions fine... I fail to see how this will be inferior to an XUL extension. Can you elaborate on how the old tree style tabs is different other than using XUL?

Unrelated, but the fact that the developer doesn't get the extension AMO approved and uses eval() all over the place should give some pause as well.

He uses eval in safe ways, according to the developer. So I think your argument is mout unless you can point the unsafe uses.

Now, the real question is: "why isn't Firefox developing a default Tree Style Tab?"

I think at this point enough people are using it, and it has proven to be a better way to browse.

>Unrelated, but the fact that the developer doesn't get the extension AMO approved and uses eval() all over the place should give some pause as well.

He does, it is in the official add-on site, but their approval process is slow, and a few times a Firefox update has broken it and I've had to download the update from the dev's site because it takes a long time to update on the official site.

I've seen people recommend this as a WebExtension-compatible replacement for TreeStyle Tabs, though I can't vouch for it myself: https://addons.mozilla.org/en-US/firefox/addon/tree-tabs/

It is no where near the same and has the same failing of the Chrome Vertical Tab Solutions like

https://chrome.google.com/webstore/detail/chrome-side-tabs/h...

https://chrome.google.com/webstore/detail/vtabs/okpnlgbgcfch...

It is not part of the UI part of the browser like the XUL TreeStyleTabs but a separate Panel that ends up being buggy and feeling separate from the experience almost like managing your tabs from a separate window

The screenshot alleges that it's in a sidebar, no? How is that different from TreeStyle Tabs, which is also in a sidebar?

Hiding the top tabbar is one of the webextension APIs folks are working on, IIRC.

For now you can use userchrome.css to hide it, can't you?

Here's 2:

TileTabs Self-Destructing Cookies

TabCenter

Tab Center Redux that is WebExtensions compatible:

https://addons.mozilla.org/en-US/firefox/addon/tab-center-re...

I was really impressed that ublock origin worked on mobile firefox on android.

I recently switched to an iphone, but sadly, the ios version of Firefox does not support the extensions.

I tried switching to FF a while back but it didn't take.

Right now I'm using Vivaldi.

I use Edge and looks like is blocking everything w/o problems.

Doesn't PrivacyBadger^1 solve the fingerprinting problem?

[1] https://www.eff.org/privacybadger

An interesting quote from Hill, from the article linked to:

> It baffles me that some people thinks Firefox is becoming a “Chrome clone”, it’s just not the case, it’s just plain silly to make such statement.

He lists several ways in which FF is better, from a security standpoint.

Reply on news.ycombinator.com