Mozilla Tech

It's with much sadness that we announce the passing of our friend and colleague Ralph Giles, or rillian as he was known on IRC. Ralph began contributing to Xiph.org in 2000 and became a core Ghostscript developer in 2001[1]. Ralph made many contributions to the royalty-free media ecosystem, whether it was as a project lead on Theora, serving as release manager for multiple Xiph libraries or maintaining Xiph infrastructure that has been used across the industry by codec engineers and researchers[2]. He was also the first to ship Rust code in Firefox[3] during his time at Mozilla, which was a major milestone for both the language and Firefox itself. Ralph was a great contributor, a kind colleague and will be greatly missed. [1]: http://www.wizards-of-os.org/archiv/sprecher/g_h/ralph_giles.html [2]: https://media.xiph.org/ [3]: https://medium.com/mozilla-tech/deploying-rust-in-a-large-codebase-7e5…

>As for the why — I explained why afterwards. Not just Mozilla has the ability to steal your passwords: any government which can force it to comply can also snarf your passwords. As for precedent, court orders require third parties to do things all the time. I would love to see if you can prove this. Please see their latest audit: https://blog.mozilla.org/security/2017/07/18/web-service-audits-firefo… https://medium.com/mozilla-tech/how-firefox-sync-keeps-your-secrets-if… When you enter your Firefox Account password, we first strengthen it by applying some cryptographic hashing, and then derive two separate keys: an authentication key, and an encryption key. The authentication key is transmitted to the server to prove that you own the account. A bug in TLS might cause this key to be leaked, and someone who intercepts this key could use it to authenticate to your account. But they cannot use it to access your sync data, because: The encryption key is used to encrypt your sync data before it leaves your machine. Since this key is never transmitted to the server, it cannot be leaked by a bug in TLS like the one that affected Cloudflare.

https://hacks.mozilla.org/2018/11/firefox-sync-privacy/ https://medium.com/mozilla-tech/how-firefox-sync-keeps-your-secrets-if…

The blog post linked from the release notes has some more information about AV1: https://medium.com/mozilla-tech/mozilla-celebrates-release-of-free-hig…

While it may not be an explicit goal, everything I’ve read implies that, for example the heading in this wiki on oxidization: https://wiki.mozilla.org/Oxidation > Moving forward, the goal of Oxidation is to make it easier and more pleasant to use Rust in Firefox, and correspondingly to increase the amount of Rust code in Firefox. And then there is the Rust page on Mozilla’s site: > Mozilla also utilizes Rust in many of its core initiatives including Servo and key parts of Firefox. https://research.mozilla.org/rust/ Where “key parts” is a link to the project quantum announcement: https://medium.com/mozilla-tech/a-quantum-leap-for-the-web-a3b7174b3c1… > Initially, Quantum will share a couple of components with Servo, but as the projects evolve we will experiment with adopting even more.

If you have master password set in the browser then the password db is encrypted locally. I remember there being some noise about it not being very secure encryption, so better check the details if that is critical for you. As for the Firefox Accounts/Sync stuff, afaik MozCo servers see only encrypted content. https://medium.com/mozilla-tech/how-firefox-sync-keeps-your-secrets-if… might provide more insight

Here's a whole article on the new process model: https://medium.com/mozilla-tech/the-search-for-the-goldilocks-browser-… The overhead is minimal since we're not doing process-per-tab: we cap the number of processes to 4 by default. So if you have 500 tabs, loaded or otherwise, you're not going to have 500 processes. I believe we spin up the processes on demand, so if you have 499 unloaded tabs and 1 loaded tab, you should only have one content process, but I'd have to source dive to confirm that.

If it still doesn't work for you now you may want to give it another try once Project Quantum is further along the way (a year?): https://medium.com/mozilla-tech/a-quantum-leap-for-the-web-a3b7174b3c1… Servo looks super fast, but they don't seem to want to just rip-out Gecko and put Servo in there, just replace bits and pieces over time. I think that's a mistake, despite the hurdles of doing that, and especially if the end result in terms of performance is something like 60-70% of Servo as opposed to 100%. https://www.phoronix.com/scan.php?page=news_item&px=MTgzNDA https://www.phoronix.com/scan.php?page=news_item&px=Google-Servo-P…

The meaning of "Quantum" is a bit confusing. I thought it was only Servo ports, but after I read your post I looked around and found this. I guess it's any improvement to Gecko? "Quantum has a number of components, including several adopted from the Servo project." https://medium.com/mozilla-tech/a-quantum-leap-for-the-web-a3b7174b3c1…

> The Firefox project is literally years behind in security and performance, I think the Mozilla Foundation doesn't understand how critical the current situation is. https://blog.mozilla.org/blog/2016/08/02/exciting-improvements-in-fire… https://blog.mozilla.org/futurereleases/2016/08/02/whats-next-for-mult… https://medium.com/mozilla-tech/a-quantum-leap-for-the-web-a3b7174b3c1…

> Rust language in Gecko is an important part of Project Quantum. For anybody who missed this, Project Quantum is a Mozilla project to dramatically improve Gecko. Part of this project is to bring in Servo components like CSS and WebRender, hence the Rust dependency. More awesome info: https://wiki.mozilla.org/Quantum https://medium.com/mozilla-tech/a-quantum-leap-for-the-web-a3b7174b3c1… https://billmccloskey.wordpress.com/2016/10/27/mozillas-quantum-projec…

https://medium.com/mozilla-tech/a-quantum-leap-for-the-web-a3b7174b3c1… The intention is to replace the parts where Servo > Gecko.

Some accounts and web resources related to…

Data in Firefox Sync is end-to-end encrypted, while data synced to Chrome is subject to Google's privacy policy. "The security model of Firefox Sync ensures that your sync data is encrypted before it ever leaves your machine, and that the password to unlock this encryption is never transmitted to the server. Not even Mozilla can access your sync data, so while we transmit it all over TLS for additional security, we do not depend on the confidentiality of TLS to keep your data safe." https://medium.com/mozilla-tech/how-firefox-sync-keeps-your-secrets-if… "When you sync Chrome with your Google Account, we use your browsing data to improve and personalize your experience within Chrome. You can also personalize your experience on other Google products, by allowing your Chrome history to be included in your Google Web & App Activity." https://www.google.com/chrome/privacy/

Does this include the pausing of videos opened in a background tab until the tab is first focused? I recall that it was held back from the expected FF 53 release and expected in 54, but I'm not seeing anything about it. Edit: Just tested, and it seems like this is not included yet again. Will it come out in FF 55, in... 6 weeks? Edit 2: Not sure if this would reach anyone who can fix it, but heads up that both links about the multiprocess firefox point to the Mozilla blog, not to medium as stated in the second link. Is it supposed to be this page linked to from the blog post? [0] [0] https://medium.com/mozilla-tech/the-search-for-the-goldilocks-browser-… Edit 3: Plenty of people seem to be suggesting this is available already. I think that has been the case for awhile now, but not by default. It was something that was mistakenly specifically called out in the release notes for 53. I thought it was a much large discussion thread, but this is the comment I was recalling [1] with a reply linking to the bug report [2] which claims it was added to the FF54 release notes 3 months ago, but has seen action since including discussion in another bug just two days ago. [1] https://news.ycombinator.com/item?id=14151468 [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1308154