Slashdot Mirror
Firefox 44 Deletes Fine-Grained Cookie Management (mozilla.org)
ewhac writes: Among its other desirable features, Firefox included a feature allowing very fine-grained cookie management. When enabled, every time a Web site asked to set a cookie, Firefox would raise a dialog containing information about the cookie requested, which you could then approve or deny. An "exception" list also allowed you to mark selected domains as "Always allow" or "Always deny", so that the dialog would not appear for frequently-visited sites. It was an excellent way to maintain close, custom control over which sites could set cookies, and which specific cookies they could set. It also helped easily identify poorly-coded sites that unnecessarily requested cookies for every single asset, or which would hit the browser with a "cookie storm" — hundreds of concurrent cookie requests.
Mozilla quietly deleted this feature from Firefox 44, with no functional equivalent put in its place. Further, users who had enabled the "Ask before accept" feature have had that preference silently changed to, "Accept normally." The proffered excuse for the removal was that the feature was unmaintained, and that its users were, "probably crashing multiple times a day as a result" (although no evidence was presented to support this assertion). Mozilla's apparent position is that users wishing fine-grained cookie control should be using a third-party add-on instead, and that an "Ask before accept" option was, "not really nice to use on today's Web."
Mozilla quietly deleted this feature from Firefox 44, with no functional equivalent put in its place. Further, users who had enabled the "Ask before accept" feature have had that preference silently changed to, "Accept normally." The proffered excuse for the removal was that the feature was unmaintained, and that its users were, "probably crashing multiple times a day as a result" (although no evidence was presented to support this assertion). Mozilla's apparent position is that users wishing fine-grained cookie control should be using a third-party add-on instead, and that an "Ask before accept" option was, "not really nice to use on today's Web."
Seems to be as fine grained as I need.
Ah, I see they are following the Gnome school of user interface design.
They seem to be really trying to shoot themselves in the foot lately.
I have an add-on that keeps only the cookies I explicitly select, the rest get deleted whenever I close Firefox, or when I manually delete cache and cookies with shift-control-delete. Just get that and have all the 'fine-grained' control you want.
Are YOU using the TOOL, or is the TOOL using YOU? Think about it!
I leave a site, its cookies explode.
Moreover, the allegation that enabling the feature destabilized the browser is pharmaceutically pure bullshit. I've been using the feature since its inception, and have Firefox windows open and running for days at a time without ill effect.
Contrariwise, I just went to check my cookie store, and found a bunch of new, unapproved, unwelcome, provably unnecessary cookies have appeared in just the week since I moved from v43 to v44. Deleting them after the fact is not a solution. Once set, tracking can take place immediately. The damage has already been done.
The proffered reasons for the change are easily shown to be false, so I do not hold out any hope that Mozilla management will have a change of heart on this matter and reinstate the long-standing feature.
Would anyone care to recommend a cookie management add-on?
Editor, A1-AAA AmeriCaptions
after another year or so of breaking them with nearly every damned release?
You guys just can't be satisfied. "This or that feature should be a plugin!" Mozilla removes features and suggests they are better handled by plugins "No! Not that feature!"
Their plugins sometimes break between releases because of the way plugins are structured, so they announce that they're replacing their plugin architecture with something guaranteed to have a more stable API. "No! You're destroying everything! NoScript will never work again!" "We're working with NoScript to ensure it continues to function in the manner users expect." "Liar! I hate you!"
Mozilla's users, at least on Slashdot, seem absolutely determined to jump the shark...
Required reading for internet skeptics
I built a new Windows image for our workstation PXE deployments, this time without Firefox.
If you're going to be just another trash browser you're no longer getting installed on the systems I'm responsible for.
In true Mozilla fashion, the discussion on the bug tracker has been censored, so people can't even effectively complain about it.
Check the dates in the bug report. The UI and underlying code have been there since it was called Netscape. The "bug" mysteriously appeared over five years ago, but the work to remove the feature was done in late 2015, and was only rolled out in FF44.
Editor, A1-AAA AmeriCaptions
^^^ This
Self-Destructing Cookies was a genuine break-through in cookie privacy.
I wish the idea would be extended to other tracker-enabling downloads like fonts and HTML5 web storage.
And this would be my perfect browser. Focus on one thing only.. properly and safely rendering a page.. that's it!
If you want cookie retention and management, use an add on..
If you want DRM video (looking at you Netflix), use an add on..
If you want bookmark management, use an add on..
If you want , use an add on..
Users will pick what features they want on the web, and what features they don't. Stop trying to shove shit like Pocket down our throats and removing features we use.
Everything we need to know about the sorry state of Firefox is shown by the new Brave web browser that Brendan Eich is creating.
Look at what Brave's FAQ page says:
For those who don't know, Brendan Eich worked at Netscape, created JavaScript, co-founded the Mozilla project, and was even the CEO of Mozilla as recently as 2014. He has a very long history with the technology behind Gecko and Firefox.
Yet despite having so much experience with Mozilla's technology, his team has gone with Chromium as the basis of their browser. Like their FAQ says, Chromium is better than Firefox "by every measure".
The problem for Mozilla is that while Firefox has become total shit, they have no better alternative to offer. The Servo project is sputtering, at least partially due to it using Rust, which itself is an immature programming language.
I don't know what Mozilla is going to do. The only option available now is to throw away Servo, throw away Rust, and try as hard as they can to get Firefox fixed up. But even that probably won't be enough. Things are looking extremely bleak for Firefox.
I fucking hate sites that cause cookie storms.
I got hit by one today, at Chandra Observatory, of all places.
Set your cookies to request always and prepare for > 30 of them: http://chandra.si.edu/photo/20...
However, it doesn't seem like this solution of Mozilla's is a great one if one were to take the new default into consideration.
But it's why I'm still on v39.0 - can't keep up to all the changes
You are mostly right. Although it is unclear how many other extensions won't be adaptable to the new model. They are working with NoScript because NoScript is the 3rd most popular add-on for firefox. But what about those odd-ball add-ons that only have a couple of hundred users?
Meanwhile one thing that is legitimately and inarguably stupid is this add-on signing requirement they keep pushing back every couple of releases. They want to force you to submit your add-on source code to them for signing. At first they were doing automated code inspection and rejected add-ons that didn't pass, even for stylistic reasons. It took a couple of months of bitching before they finally backed off that level of scrutiny, doh!
But it is still a problem for people who have internally developed extensions - forcing them to choose between running an unsupported version of firefox or exposing their source code to mozilla who can not guarantee that it won't be pilfered away via corporate espionage.
All they need to do to fix it is make mozilla check for a list of exceptions to the signature requirements in an admin-only writable location (like /usr/lib/mozilla/ on linux or an admin-only part of the registry on windows). The code to do that is already 99% written because they already pull config data out of those locations, just need to verify it is admin-only writable.
But they keep resisting the obvious, instead insisting that anyone who wants to run an unsigned add-on must run a completely separate installation of firefox and thus forgo all the security benefits of getting auto-updates straight from them. The end result is much reduced security for those people - no crypto signatures for any add-ons and they must do manual compiles each time there is a new firefox release - and really, only the most hard-core of users is ever going to do that in a timely fashion. Just because you have an odd-ball add-on doesn't mean you are that hard-core.
I'm not that hard-core, but I still run the defunct "redirect cleaner" because none of the replacement add-ons quite match the original's functionality in corner cases. If I had enough time to compile every new release of firefox, I would have enough time to fix one of the replacement redirect-cleaner extensions to handle the corner-cases too.
Yes, I "shouted". Obviously to OP has no clue.
Denying the creation of a cookie in the first place has nothing to do with deleting them when Firefox is closed (whoever closes ALL of their FF windows anyway?).
I hope Pale Moon keeps the feature, but, IMO, FF44 is now nearly useless.
For web fonts and similar 3rd party assets you want Smart Referer. Unless the primary website's address or id is encoded in the URL, this stops such tracking.
The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
hat's across all versions on all platforms!
Which is the only way to get the number that low. Mobile users tend not to change browsers. Most have few, if any, any options. Including mobile is deceptive.
Required reading for internet skeptics
Sure we can be satisfied. All they have to do is give control to the user instead of making inane changes because they know better for us.
If no one was maintaining this feature, the proper thing to do would be disable on new installs, check settings on upgrades, and put a job posting out for someone to volunteer to maintain it. While they are at it, notify the users of the problem and stop pretending their shit don't stink.
In fewer words, show the users some respect.
It worked well with MS and Edge.
How about Mozilla Bono?
I have been using Firefox since the early days. Sure there were some releases with problems but 44 for me is the worst ever in my opinion. I have completely wiped it from APPDATA and Programs, reinstalled, yet frequent crashes. Crashes immediately if loading from the taskbar in Windows 7. If I use any plugins like Ad Block Plus or Noscript I get high CPU utilization and it sucks up allot of memory. Occasionally it just disappears in the middle of doing something.
Now with the cookie thing which I use frequently in web development and other plugins that will be borked, that's it I am done. They are forcing me to adopt another default for all my work.
I will check out waterfall listed above. I started to look at Palemoon before this and thought do these alternatives have dev teams or just one guy that will some day will disappear?
This report is about removing optional user control over which cookies get created. Firefox 44 still allows users to delete individual cookies. Open up Preferences, go to the Privacy tab, click on "remove individual cookies" (a hyperlink) and you will see a list of all your cookies, grouped by domain name. Click on the ">" before a domain name to see the cookies for that domain. Select and delete as desired.
Personally, I prefer to use NoScript but allow websites to create cookies. That way I can whitelist domains in NoScript until a website works, without having to worry about which cookies to allow. Once I've finished with a website, I can always delete all the relevant cookies until next visit. This works well for me; YMMV.
Some where back in the dim recent past, Firefox's ESCape key no longer meant abort everything and return control completely to the user. No matter if the base html is incomplete, no matter if some goofy-gumdrop JSON cloud-abortion is in progress, or a 302 redirect is in progress. No matter if you'll have to settle for a blank page because CSS cannot decide what color the text will be. Just ABORT. Now the ESC key means hardly anything.
Now in the face of incomplete loads, packet loss, severely delayed DNS lookups, javascript tumors that are busy metastasizing to grow the page from seeds using repeated lookups to unresponsive and overworked database servers --- all of this results in pages that won't stop loading, tabs that will not close immediately, or even pages with visible readable content that will not respond to scrolling requests or link clicks... until... exactly what I never found out.
The purported reason was to save the poor deep data content providers from aborted transactions caused by unwashed masses hitting reload and ESC. I say, if they're overloaded or vulnerable in any way to aborts or identical re-submits they are vulnerable to script kiddies too and someone has not done their job properly or provisioned their servers adequately. I never considered the ability to abort a web load as anything but an intrinsic RIGHT --- until it was taken away. It was,like, what are they thinking?
I've had to force-close Firefox to regain control. And no we're not talking about Flash or embed delays either, I run NoScript. This is Firefox's native process refusing to abort everything under all conditions.
If content providers bite into some apple of complexity (for example) embedding advertising and load sharing schemes that do little tricks (such as) using gobblegook DNS names with low or zero TTL, they deserve to be sandbagged for their effort by the masses until they re-think their decision and (god forbid) roll back in the general direction of 'static' content.
Unfortunately this is something a third-party addon cannot really fix. If ever I was temped to fork a whole project and create a new subculture to fix one aggravating feature=bug this is it.
<blink>down the rabbit hole</blink>