Slashdot Mirror


Firefox 44 Arrives With Push Notifications (mozilla.org)

An anonymous reader writes: Mozilla today launched Firefox 44 for Windows, Mac, Linux, and Android. Notable additions to the browser include push notifications, the removal of RC4 encryption, and new powerful developer tools. Mozilla made three promises for push notifications: "1. To prevent cross-site correlations, every website receives a different, anonymous Web Push identifier for your browser. 2. To thwart eavesdropping, payloads are encrypted to a public / private keypair held only by your browser. 3. Firefox only connects to the Push Service if you have an active Web Push subscription. This could be to a website, or to a browser feature like Firefox Hello or Firefox Sync." Here are the full changelogs: Desktop and Android.

33 of 182 comments (clear)

  1. Great! by Motherfucking+Shit · · Score: 4, Insightful

    Who has a list of which configuration options I need to go into about:config and disable this time?

    --
    "BSD: Free as in speech. Linux: Free as in beer. Windows 10: Free as in herpes." --Man On Pink Corner in #52607549.
    1. Re:Great! by buchner.johannes · · Score: 2, Informative

      Just don't subscribe to anything -- every page requires you to grant it permission.

      --
      NB: The message above might reflect my opinion right now, but not necessarily tomorrow or next year.
    2. Re:Great! by fahrbot-bot · · Score: 5, Informative

      Who has a list of which configuration options I need to go into about:config and disable this time?

      As buchner.johannes noted, just don't subscribe to anything, but from what I have read, set:

      • dom.webnotifications.enabled = false
      • dom.webnotifications.serviceworker.enabled = false
      --
      It must have been something you assimilated. . . .
    3. Re:Great! by Somebody+Is+Using+My · · Score: 4, Insightful

      Just don't subscribe to anything -- every page requires you to grant it permission.

      No, it requires more than that. According to Mozilla themselves, "Firefox maintains an active connection to a push service in order to receive push messages as long as it is open." Supposedly the connection is encrypted and anonymized, but you'll have to take their word on it and anyway, it's another potentially-vulnerable service running in the background. So it's not just a matter of "don't subscribe and you'll be safe"; there needs to be a way to disable this service entirely.

      Oh wait... there is.

    4. Re:Great! by ZeRu · · Score: 3, Funny

      Firefox, the only software that comes with a warranty.

      --
      If you post as an AC, don't expect me to spend a mod point on you.
    5. Re:Great! by fahrbot-bot · · Score: 5, Informative

      Who has a list of which configuration options I need to go into about:config and disable this time?

      As buchner.johannes noted, just don't subscribe to anything, but from what I have read, set:

      • dom.webnotifications.enabled = false
      • dom.webnotifications.serviceworker.enabled = false

      Other candidates seem to also be:

      • dom.push.connection.enabled = false
      • dom.push.enabled = false
      --
      It must have been something you assimilated. . . .
    6. Re:Great! by Nutria · · Score: 4, Informative

      Its called Chrome.

      Chrome has had push notifications for quite a while.

      --
      "I don't know, therefore Aliens" Wafflebox1
    7. Re:Great! by Anonymous Coward · · Score: 5, Insightful

      Find me evidence of unwanted behavior in Chrome.

      GoogleUpdate.exe

      Also the on by default "OK Google" eavesdropping, desktop notifications and search prediction crap.

    8. Re:Great! by sims+2 · · Score: 3, Interesting

      Anyone know where to find old versions of chrome?
      Or a way to disable chrome's auto update function so it doesn't later decide you forgot to re-enable it and update anyway?

      Auto updates are nice until they decide when I want to update for me.

      --
      Minimum threshold fixed. Thanks!
    9. Re:Great! by jopsen · · Score: 5, Insightful

      but you'll have to take their word on it

      No, you can view the source... All of it... Both client and server side.

      https://github.com/mozilla-ser...
      If I'm not mistaken... There a lot of mozilla projects, but this one seems recent.

      there needs to be a way to disable this service entirely.

      At least look up about.config before complaining, it's right in there under "dom.push.enabled".

      But really, I don't see the point...

    10. Re:Great! by Tablizer · · Score: 3, Funny

      Who has a list of which configuration options I need to...disable [useless new features]?

      1. Go to palemoon.org

      2. Click the Download Browser button.

      3. Click "Confirm" at install prompt.

      4. Profit!

    11. Re:Great! by wonkey_monkey · · Score: 3, Insightful

      No, it requires more than that.

      More? Or do you mean less? It does require permission to establish a push connection, as far as I can tell.

      According to Mozilla themselves [mozilla.org], "Firefox maintains an active connection to a push service in order to receive push messages as long as it is open."

      "Firefox maintains..." - that particular quote says nothing about whether permission is required to establish such a connection in the first place.

      There's something a bit non-sequitur-ish about your first two sentences.

      --
      systemd is Roko's Basilisk.
  2. The next RSS by buchner.johannes · · Score: 2

    "a website could notify you when something important happened, even if you [don’t] have the site open"
    Cool!

    Is RSS dead now, like web onthologies?

    --
    NB: The message above might reflect my opinion right now, but not necessarily tomorrow or next year.
    1. Re:The next RSS by squiggleslash · · Score: 2

      I think it's intended more for things like "You have a new email" rather than "Here are the most recent articles on my blog".

      --
      You are not alone. This is not normal. None of this is normal.
    2. Re:The next RSS by mbkennel · · Score: 4, Insightful


      And will be used for "One Weird Trick to a Titanic Penis" and "Firefox has detected a CRITICAL security problem. Click on _this link_ to eliminate the malware from your system"

    3. Re:The next RSS by zoward · · Score: 3, Interesting

      RSS is dying because sites don't like it. People use it as a shortcut to see whether anything on their list of favorite blogs is worth navigating to the site to read. If not, then they won't visit the site, taking page hits (and ad revenue) from the site. I love RSS, but it seems like sites are dropping support for it left and right.

      --
      "Can't you see that everyone is buying station wagons?"
  3. And stupidly enforced mandatory extension signing by Anonymous Coward · · Score: 3, Insightful

    This version is also the first to require signed extensions with no way to:
    1) Disable the signature check at all
    2) Use any signature other than Mozilla's
    3) Install a extension built and packaged by your distribution repository (unless Mozilla signs each build)
    4) Forcefully install a extension that you built yourself

    I don't understand why Mozilla gets away with this type of hidden DRM. At least in Secure Boot you could enroll your own signatures.

    Here, the only option you have is to switch to an unbranded fork of Firefox.

  4. The Description of this is Scary by cruff · · Score: 5, Insightful
    From the push notification link describing it:

    A website registers a Service Worker with the browser. Service Workers are small JavaScript programs with super powers like intercepting network requests or running even when their parent website is closed.

    What could possibly go wrong?

    1. Re:The Description of this is Scary by Anonymous Coward · · Score: 4, Insightful

      "or running even when their parent website is closed."

      This is all for ads and tracking you.

      Firefox is dead.

    2. Re:The Description of this is Scary by Anonymous Coward · · Score: 2, Informative

      Well *don't fucking register* you fucktard.

    3. Re:The Description of this is Scary by roca · · Score: 3, Informative

      Chrome already has push notifications. In both browsers a user action is required to subscribe to push notifications for a site so this can't be done behind your back.

      iOS and Android have push notifications too. Hope you don't use a smartphone.

    4. Re:The Description of this is Scary by QuietLagoon · · Score: 2

      Well *don't fucking register* you fucktard.

      I'd rather this feature be a separate program. I'd want to be notified at times when the browser is not open. And I don't want the websites for which I register to know every time I have my browser open.

      .
      This just looks more and more like Mozilla continuing to add non-browser-related bloat to an already bloated Firefox.

  5. payloads are encrypted by fustakrakich · · Score: 2

    Yeah, to keep your antivirus and ad blockers out of the way.

    Oh well, at least there's still Netscape.

    --
    “He’s not deformed, he’s just drunk!”
  6. Old timers don't bother to learn the simple things by Okian+Warrior · · Score: 5, Funny

    Who has a list of which configuration options I need to go into about:config and disable this time?

    You must be an old timer!

    Programs are configurable! Just go through all the apps and programs that you use on a daily basis and change whatever you want to make the system work to your liking.

    All these features are easy to change, and learning a mere handful of methods will get you anywhere you want to go.

    1) Go to about.config, click on the "I understand", type in "this.obscure.value", double click it to change value. The "this.obscure.value" is named in a transparent, easily understandable way such as "browser.cache.disk.smart_size.enabled". This enables the "smart size" feature of the caching system. It's obvious what it does, because it's name says it all.

    2) Go to start->run->regedit, navigate to "this obscure value", type in "add new value" in DWORD format and set it's value to 1. For instance, to disable the new volume control and go back to the old style, just navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion, create a new key MTCUVC, create a new DWORD EnableMtcUvc, and set its value to 0.

    Only old folks think that's not simple, and I don't for the life of me know why!

    3) Pick a random number, put "KB" in front of it, and do what's described there. For example, KB3035583 tells you how Microsoft has helpfully introduced "additional capabilities for Windows Update notifications when new updates are available to the user". It's just telling you how Windows 10 is now available. If you want to customize this behaviour, you can use task manager to stop the GWX.exe process. Or, you can go to programs and then click or tap on View installed updates, then scroll down until you see the KB3035583 update, select it, press "uninstall", and then confirm that you want to uninstall it.

    Nothing could be simpler, I just *don't get* where these old folks are coming from!

    4) Changing things in linux it's even easier! Just go to /etc as root and vi "some-random-file", and change the configuration manually. It's easy to do, because all the configuration files are in one place! For example, remote disks are called "shares", and the process that manages this is called samba, and the file to edit is thus /etc/samba/smb.conf.

    What could be easier? The .conf ending lets you know that it's a configuration file!

    If you don't know how to use vi, simply type "man vi" and you'll find all the information you need!

    Really, I don't understand why old folks don't understand these things - everything is so simple!

  7. Re:And stupidly enforced mandatory extension signi by rastos1 · · Score: 4, Interesting

    This version is also the first to require signed extensions

    I'm confused. We are delaying the removal of this preference to Firefox 46

  8. Don't worry by ArchieBunker · · Score: 4, Funny

    Give Pottering a week and we'll have some spaghetti code that does the same thing in kernel.

    --
    Only the State obtains its revenue by coercion. - Murray Rothbard
  9. Re:Drop it. by rudy_wayne · · Score: 2, Informative

    If you haven't already, rather than messing around with settings and installing extensions, just drop it. Uninstall and don't look back. There are other browsers.

    Sadly, all the "other browsers" suck just as much as Firefox, they just suck in different ways.

  10. Prediction: FF at 2% of the market by Dec 2016 by Anonymous Coward · · Score: 3, Interesting

    So based on last month's stats, Firefox is down to about 7% of the browser market. That's across all versions, on all desktop and mobile (where Firefox for Android has a massive 0.05% of the market) platforms.

    At this point, Firefox as a whole is nearly below iOS Safari 9.2, IE 11, and UC Browser for Android. It almost has fewer users than Opera Mini, even! Hell, even Chrome 46 still has almost as many users as Firefox has in total, and Chrome is up to version 48 now!

    It's now clear that Firefox 44 introduces a lot of shit that users just don't want, and there's a lot more dumb shit in the pipeline, too.

    Based on this, I'm going to make a prediction: Firefox will be at or under 2% of the market by the end of 2016.

    So many of Firefox's changes only serve to drive users away to other browsers, and I don't see anything suggesting that they'll start listening to their few remaining users any time soon. Rust and Servo are total dead ends at this point, so we can't count on them to save Firefox.

    Once Firefox hits such a low single-digit share of the market, it's likely that Mozilla will be considered completely irrelevant. This is bad for the web, of course, since it cements the WebKit/Blink monoculture.

    1. Re:Prediction: FF at 2% of the market by Dec 2016 by hyades1 · · Score: 2

      For me, the final straw was when Firefox started calling Google "untrusted", then refused to let me make an exception and go about my usually-seamless search business. I don't know why the behaviour started. I don't care. They were already on thin ice after switching off my Garmin GPS update and map extensions, disabling my Kaspersky special functions like virtual keyboard, and other stuff I won't bore you with.

      I'm almost completely switched over to Pale Moon now. It's faster, and it actually works. Fuck Firefox.

      --
      I've calculated my velocity with such exquisite precision that I have no idea where I am.
  11. What about WebSockets? by Billy+the+Mountain · · Score: 3, Informative

    Web push is already easily handled through WebSockets. I wrote a couple applications that are able to handle hundreds of random notifications per second coming from a server. Works with Chrome, Firefox and even IE. Older versions of IE require a polyfill but even that works great.

    --
    That was the turning point of my life--I went from negative zero to positive zero.
  12. security.tls.insecure_fallback_hosts by klui · · Score: 2

    Does anyone know if security.tls.insecure_fallback_hosts is now deprecated? I have an old device that will never get its SSL certificates reissued and I cannot create a new certificate with better algorithms. I use an old portable version of Firefox that I use to sometimes login. I noticed with Firefox 44 if I now go to the IP address, which I have added in the above preference name, I am greeted with the Advanced button and expanding it gives me a link to "(Not secure) try loading 'ip address' using outdated security." If I click on it it does nothing and gives redirects back to the "Your connection is not secure" page.

    The latest version of ssh allows one to whitelist hosts with deprecated encryption so I have access that way, too. It would be nice to not have Firefox 44 and another just to access this device.

  13. Re:And stupidly enforced mandatory extension signi by Dagger2 · · Score: 2

    That doesn't really fix any of the problems with signing.

  14. Re:Old timers don't bother to learn the simple thi by rtb61 · · Score: 3, Interesting

    Yet, mind bogglingly enough it is still way simpler than trying to fix windows registry. Mind you fuck up about:config and the browser stops working, Windows registry fucks itself up and you computer stops working. Want to keep a computer working, always dual boot and that way you can boot to Linux to fix your gaming and browsing machine. I have managed to keep windows 7 going since getting this computer without a reinstall by that very method. Damn being able to edit a text file makes like so much easier when it comes to fixing a broken OS or broken program. Having to reinstall a program or and entire OS and every program you have because you couldn't edit a text file is fucking nuts. One five minute edit versus hours and hours of reinstall, oh, yeah that edit is so very, very hard.

    --
    Chaos - everything, everywhere, everywhen