mccr8

The account used to file that bug has not filed any other bug reports, so it isn't clear to me if they did report the underlying security issue that they found. (Disclaimer: I work on Firefox, but I'm just speaking for myself.)

We fix memory leaks when people report them and we can reproduce them. Usually it is due to some combination of particular addons and particular websites, but of course the obscurity of any particular leak doesn't help you if you are hitting it regularly.

Like dblohm7 said, the issue here is when something besides the currently running instance of Firefox does an update. This can happen with the Linux distro packages or if you open Firefox with multiple profiles at the same time. I know it is a big pain, but hopefully this at least helps you understand what is going on.

If you choose "restore previous session" under general preferences, then you can at least not lose the set of open tabs when you restart.

As for 2, Firefox already does this, and has for about 4 years. Since those comments in 2008 and 2015, Firefox has shipped the Electrolysis project, which makes Firefox multi process. The UI (mostly) runs in a different process, which massively improved UI responsiveness, because janky websites can't interfere with clicking on stuff in the UI. One web site crashing can still cause another web site to crash, if it happens to be in the same process (out of 8) but we're hard at work on the Fission project which will move individual website domains into their own process. Though you can still end up with one instance of Google Docs crashing and taking down another one.

In Firefox, if you go to about:memory and click on "Measure", you can get some kind of breakdown of where the memory is being used. I don't know how useful it will be to understand why it is using more memory, but it can be interesting.

I think the phrase you may be thinking of is the more poetic "War is the continuation of politics by other means" by Carl von Clausewitz.

I could be mistaken, but I think internally reported issues that don't make it to release aren't assigned CVE numbers, which might be what he means by "disclosed".

Of course, as you say, we do rate almost all security issues, and eventually make them public, so the information is only a bugzilla search away! https://bugzilla.mozilla.org/buglist.cgi?keywords=sec-critic...

This update is fixing the second half of the same exploit.

Be aware that running multiple profiles at once can cause issues with updates. One instance can end up updating, which means that the other instance can no longer create new processes, because it is still on the old version, and it gets updated in place.

The new version that just came out added a new feature where different channels (Release, Nightly, etc.) have different profiles, and for some people it seems to have not picked the right profile for the channel they use. You can try looking at about:profiles. Your old profile might be in there, and then I think you can switch back to it.

Microsoft basically shut down the IE team after they beat Netscape, which gave Firefox a chance to produce a better product. Web browsing is so closely tied to Google's core business that they're unlikely to mothball Chrome development.

Yes, though they were only necessary on OS X.

Doing a full release takes a lot longer, so they presumably decided to use a faster method where possible. https://hacks.mozilla.org/2018/03/shipping-a-security-update...

Yeah, I had the same issue, with the same name on the account. Somebody I know also had this issue, and after a few rounds of back and forth with support they managed to get the bogus account deleted, and I think their plan was to then create a new account. I was going to try logging in with my Google Account (which is the same email) but who knows if that will work or not. I think it is easier to just wait a year for exclusivity to expire. There's plenty of games out there to play.

YouTube fixed something a few days after that post. I no longer experience the slowness it was describing in Firefox.

Do you have scaled resolution enabled? If so, that sounds like this bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1404042

I think there's been a little bit of progress on that issue, but not much, unfortunately.

WebReplay requires recording and replaying a lot of low level system specific stuff, like system calls, IPC traffic, stack, and the heap. The "Porting" section of the linked article talks about this. I think the design is intended to support working on different operating systems (as compared to rr which is likely to only ever work on Linux), but porting will require additional work.

The section "Comparison with other projects" in the linked article has a comparison to other replay efforts, including what was done for WebKit. I think WebReplay is lower level than the WebKit work, but higher level than rr, which gives you various tradeoffs.

That sounds kind of like a known issue with scaled resolution on OSX. Unfortunately, it doesn't look like any progress has been made on it.

https://bugzilla.mozilla.org/show_bug.cgi?id=1404042

I don't know about uBlock Origin (which is what you probably meant) but according to press articles AdBlock Plus gets paid money by Google to not block their ads, which feels at least in the ballpark to what Brave is trying to do.

Comparing the number of CVEs is not a good way to compare how vulnerable different browsers are. For instance, I believe that Firefox and maybe Chrome bucket together multiple internally reported vulnerabilities into a single CVE.

None of the Firefox Quantum work has looked at power usage, so don't expect any changes on that front.

You can't enable them in the release version of Firefox. You'd have to use Nightly, I believe.

Safari supports DRM, it just uses FairPlay instead of Widevine. https://en.wikipedia.org/wiki/FairPlay

> How does seeing which sites users use that need Flash drive their decision-making. Either they support Flash, or they don't.

I'm not saying I support this proposal or not, but here's an example of why this could be useful: Chrome was considering deprecating some API, because it wasn't supported by other browsers and they didn't think that it was used very much.

They collected generic statistics about how much it was used, but the numbers turned out to be much higher than expected, so they were considering leaving it alone. What if some fairly popular website they just hadn't heard of used the API? You might not want to break it, or at least you'd want to get in touch with the site to see if they could move to a more widely supported API.

In the end, they somehow (maybe through spidering, or somebody just happened across it in their own browsing) figured out that the high usage was due to being used by some ad network for fingerprinting. Not only was this not a reason to keep supporting the API, it was a reason to stop supporting it!

The Tor Browser has some kind of antifingerprinting stuff in it. I don't know how it compares to what Brave does.

Some sites, such as YouTube, don't start playing a video until you switch to the tab.

> When you start Firefox two times in a row, the dialog "Firefox is already running, please close the running instance" or something like this pops up.

This is actually due to shutdown (rather than startup) being too slow. Your profile is still in use from the instance of Firefox taking too long to shut down, so when you start a new instance it hits this error. This should be a little better with multiprocess, because web pages are run in a separate process, and we kill that process more quickly, so shutdown should be faster.

Patches for many of these issues have been public already for a few weeks, so waiting another day or two won't cause much additional harm. The CVEs do not contain test cases.

Quantum Compositor is just a separate process for GPU stuff. It isn't ported from Servo.

One bit of E4X trivia: a bug in the Firefox E4X implementation was taken advantage of by an exploit called "EgotisticalGiraffe", according to the Snowden documents. The implementation of E4X in Firefox was large and complex.

https://www.schneier.com/blog/archives/2013/10/how_the_nsa_a...